Skip to content

Commit f19c419

Browse files
silversword411silversword411
authored
Merge pull request #248 from silversword411/main
add WIP: TRMM agent installer and lock/unlock scripts. Thx CBG_ITSUP
2 parents b0a0b28 + e44c7a7 commit f19c419

3 files changed

Lines changed: 177 additions & 0 deletions

File tree

‎scripts_wip/Win_TRMM_Agent_Installer_and_Locker.ps1‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
<#
2+
.SYNOPSIS
3+
Script to install and configure the Tactical RMM (TRMM) Agent.
4+
5+
.DESCRIPTION
6+
This script performs several tasks to install and secure the Tactical RMM (TRMM) Agent on a Windows machine.
7+
It includes setting up necessary prerequisites, installing the TRMM agent, configuring Windows Defender exclusions,
8+
locking down services, and preventing access to specific folders.
9+
10+
.PARAMETER RMMurl
11+
The deployment URL to download the Tactical RMM Agent installer.
12+
13+
.EXAMPLE
14+
$RMMurl = "https://example.com/path/to/agent.exe"
15+
# (Run the script with the specified URL)
16+
# This will download and install the TRMM agent, configure exclusions, lock services, and secure folders.
17+
18+
.NOTES
19+
v1.0 8/22/2024 CBG_ITSUP Initial version
20+
#>
21+
22+
###############################################
23+
###### Prerequisites ####
24+
###############################################
25+
26+
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
27+
28+
$RMMurl = "Insert RMM agent URL here"
29+
30+
$Path = Test-Path -Path "C:\Program Files\TacticalAgent\tacticalrmm.exe"
31+
32+
###############################################
33+
############ Install TRMM Agent ########
34+
###############################################
35+
36+
If ($Path -eq $false) {
37+
38+
Add-MpPreference -ExclusionPath "C:\ProgramData"
39+
40+
Invoke-WebRequest $RMMurl -OutFile "C:\ProgramData\trmm-agent.exe"
41+
42+
Start-Process -Wait "C:\ProgramData\trmm-agent.exe" -ArgumentList '-silent'
43+
44+
Remove-MpPreference -ExclusionPath "C:\ProgramData"
45+
46+
Remove-Item "C:\ProgramData\trmm-agent.exe" -Force
47+
48+
}
49+
###############################################
50+
### Exclude TRMM paths in Windows Defender ####
51+
###############################################
52+
53+
Add-MpPreference -ExclusionPath "C:\Program Files\Mesh Agent\*"
54+
Add-MpPreference -ExclusionPath "C:\Program Files\TacticalAgent\*"
55+
Add-MpPreference -ExclusionPath "C:\ProgramData\TacticalRMM\*"
56+
57+
###############################################
58+
#### Lock Down Services ####
59+
###############################################
60+
61+
Start-Process -FilePath "$env:comspec" -ArgumentList "/c sc config tacticalrmm start=auto"
62+
63+
Start-Process -FilePath "$env:comspec" -ArgumentList "/c sc start tacticalrmm"
64+
65+
Start-Process -FilePath "$env:comspec" -ArgumentList "/c sc.exe sdset tacticalrmm D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
66+
67+
Start-Process -FilePath "$env:comspec" -ArgumentList '/c sc config "Mesh Agent" start=auto'
68+
69+
Start-Process -FilePath "$env:comspec" -ArgumentList '/c sc start "Mesh Agent"'
70+
71+
Start-Process -FilePath "$env:comspec" -ArgumentList '/c sc.exe sdset "Mesh Agent" D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)'
72+
73+
###############################################
74+
##### Prevent access to TRMM folders ###
75+
###############################################
76+
77+
Invoke-Expression -Command:"icacls ""C:\Program Files\TacticalAgent"" /T /setowner system"
78+
Invoke-Expression -Command:"icacls ""C:\Program Files\TacticalAgent\unins000.exe"" /inheritance:d /grant System:F /deny Administrators:F"
79+
Invoke-Expression -Command:"icacls ""C:\Program Files\TacticalAgent"" /T /inheritance:d /grant System:F /deny Administrators:F"
80+
81+
Exit 0

‎scripts_wip/Win_TRMM_Agent_Locker.ps1‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
<#
2+
.SYNOPSIS
3+
Lock down services and prevent access to TRMM folders.
4+
5+
.DESCRIPTION
6+
This script configures and starts the "tacticalrmm" and "Mesh Agent" services, setting security descriptors to enforce security. Additionally, it restricts access to the TacticalAgent directory and its executable to prevent unauthorized access.
7+
8+
.NOTES
9+
v1.0 8/22/2024 CBG_ITSUP Initial version
10+
#>
11+
12+
13+
###############################################
14+
#### Lock Down Services ####
15+
###############################################
16+
17+
Start-Process -FilePath "$env:comspec" -ArgumentList "/c sc config tacticalrmm start=auto"
18+
19+
Start-Process -FilePath "$env:comspec" -ArgumentList "/c sc start tacticalrmm"
20+
21+
Start-Process -FilePath "$env:comspec" -ArgumentList "/c sc.exe sdset tacticalrmm D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
22+
23+
Start-Process -FilePath "$env:comspec" -ArgumentList '/c sc config "Mesh Agent" start=auto'
24+
25+
Start-Process -FilePath "$env:comspec" -ArgumentList '/c sc start "Mesh Agent"'
26+
27+
Start-Process -FilePath "$env:comspec" -ArgumentList '/c sc.exe sdset "Mesh Agent" D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)'
28+
29+
###############################################
30+
##### Prevent access to TRMM folders ###
31+
###############################################
32+
33+
Invoke-Expression -Command:"icacls ""C:\Program Files\TacticalAgent"" /T /setowner system"
34+
Invoke-Expression -Command:"icacls ""C:\Program Files\TacticalAgent\unins000.exe"" /inheritance:d /grant System:F /deny Administrators:F"
35+
Invoke-Expression -Command:"icacls ""C:\Program Files\TacticalAgent"" /T /inheritance:d /grant System:F /deny Administrators:F"
36+
37+
Exit 0

‎scripts_wip/Win_TRMM_Agent_unLocker.ps1‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<#
2+
.SYNOPSIS
3+
Unlock TacticalRMM Agent and optionally remove it.
4+
5+
.DESCRIPTION
6+
This script unlocks the TacticalRMM Agent by modifying folder permissions and resetting service security descriptors. Additionally, it includes an optional parameter to remove the TacticalRMM Agent if specified.
7+
8+
.PARAMETER remove
9+
A boolean parameter that, if set to $True, will trigger the removal of the TacticalRMM Agent.
10+
11+
.OUTPUTS
12+
None
13+
14+
.EXAMPLE
15+
.\script.ps1 -remove $False
16+
- Unlocks the TacticalRMM Agent by adjusting permissions and resetting service security descriptors without removing the agent.
17+
18+
.EXAMPLE
19+
.\script.ps1 -remove $True
20+
- Unlocks the TacticalRMM Agent and then removes it using its uninstaller.
21+
22+
.NOTES
23+
v1.0 8/22/2024 CBG_ITSUP Initial version
24+
25+
#>
26+
27+
28+
param (
29+
30+
[Parameter()]
31+
[string]$remove
32+
)
33+
34+
#######################################################
35+
############ UnLock TacticalRMM Agent #################
36+
#######################################################
37+
38+
#################### App Folder #######################
39+
40+
Invoke-Expression -Command:"icacls ""C:\Program Files\TacticalAgent"" /T /inheritance:d /grant System:F /grant Administrators:F"
41+
42+
Invoke-Expression -Command:"icacls ""C:\Program Files\TacticalAgent\unins000.exe"" /inheritance:d /grant System:F /grant Administrators:F"
43+
44+
Invoke-Expression -Command:"icacls ""C:\Program Files\TacticalAgent"" /T /inheritance:d /grant System:F /grant Administrators:F"
45+
46+
##################### Services ########################
47+
48+
Start-Process -FilePath "$env:comspec" -ArgumentList "/c sc.exe sdset tacticalrmm D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
49+
50+
Start-Process -FilePath "$env:comspec" -ArgumentList '/c sc.exe sdset "Mesh Agent" D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)'
51+
52+
53+
#######################################################
54+
######### Optional: Remove TacticalRMM Agent ##########
55+
#######################################################
56+
57+
If ($remove -eq $True) {
58+
Start-Process -Wait -FilePath "$env:comspec" -ArgumentList '/c ""C:\Program Files\TacticalAgent\unins000.exe"" /VERYSILENT'
59+
}

0 commit comments

Comments
 (0)