Skip to content

Commit a27749e

Browse files
rolling-coderolling-code
authored
Add files via upload
1 parent b4eec8f commit a27749e

1 file changed

Lines changed: 312 additions & 0 deletions

File tree

‎generic/rmm_nrpt_block.ps1‎

Lines changed: 312 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,312 @@
1+
#requires -RunAsAdministrator
2+
<#
3+
Creates local NRPT rules to divert selected RMM-related namespaces to 127.0.0.1 for test blocking.
4+
Generated from rmm_domains.csv. This is LOCAL ONLY to the current machine.
5+
Notes:
6+
- NRPT is DNS-based. It will not block raw IP connections.
7+
- Some apps may experience DNS timeouts because 127.0.0.1 is used as a sinkhole nameserver.
8+
- To remove rules created by this script later, run: .\rmm_nrpt_block.ps1 -Remove
9+
#>
10+
param([switch]$Remove)
11+
12+
$Namespaces = @(
13+
'.-dms.zoho.com.cn',
14+
'.01com.com',
15+
'.247ithelp.com',
16+
'.acronis.com',
17+
'.action1.com',
18+
'.adobeconnect.com',
19+
'.aeroadmin.com',
20+
'.alpemix.com',
21+
'.ammyy.com',
22+
'.analytics.insight.rapid7.com',
23+
'.anydesk.com',
24+
'.anyplace-control.com',
25+
'.anysupport.net',
26+
'.anyviewer.com',
27+
'.aomeisoftware.com',
28+
'.api.jumpcloud.com',
29+
'.api.netreo.com',
30+
'.api.splashtop.com',
31+
'.api.splashtop.eu',
32+
'.assist.jumpcloud.com',
33+
'.auvik.com',
34+
'.aweray.net',
35+
'.baramundi.com',
36+
'.barracudamsp.com',
37+
'.basecamp.com',
38+
'.beamyourscreen.com',
39+
'.beanywhere.com',
40+
'.beinsync.com',
41+
'.beinsync.net',
42+
'.beyondtrustcloud.com',
43+
'.bluetrait.io',
44+
'.bomgarcloud.com',
45+
'.cc.centrastage.net',
46+
'.cdn.getgo.com',
47+
'.cell-1.domotz.com',
48+
'.centuriontech.com',
49+
'.cloud.tanium.com',
50+
'.cloudbackup.management',
51+
'.cloudberrylab.com',
52+
'.cmdm.comodo.com',
53+
'.connect.backdrop.cloud',
54+
'.connectwise.com',
55+
'.content.rview.com',
56+
'.crossloop.com',
57+
'.dameware.com',
58+
'.deskday.ai',
59+
'.deskroll.com',
60+
'.desktop.qq.com',
61+
'.desktopstreaming.com',
62+
'.devtunnels.ms',
63+
'.distantdesktop.com',
64+
'.dms.zoho.com',
65+
'.dms.zoho.com.eu',
66+
'.domotz.co',
67+
'.domotz.com',
68+
'.donkz.nl',
69+
'.downloads.io',
70+
'.duetdisplay.com',
71+
'.dwservice.net',
72+
'.ehorus.com',
73+
'.electric.ai',
74+
'.emcosoftware.com',
75+
'.encapto.com',
76+
'.endpoint.ingress.rapid7.com',
77+
'.ericom.com',
78+
'.ezhelp.co.kr',
79+
'.fastsupport.com',
80+
'.fastviewer.com',
81+
'.fixme.it',
82+
'.fleetdeck.io',
83+
'.fortra.com',
84+
'.gatherplace.com',
85+
'.gatherplace.net',
86+
'.getalphacontrol.com',
87+
'.getgo.com',
88+
'.getscreen.me',
89+
'.goto.com',
90+
'.gotoassist.at',
91+
'.gotoassist.com',
92+
'.gotoassist.me',
93+
'.gotohttp.com',
94+
'.gotomypc.com',
95+
'.goverlan.com',
96+
'.heartbeatrm.com',
97+
'.helpme.net',
98+
'.helpu.co.kr',
99+
'.hoptodesk.com',
100+
'.hostedrmm.com',
101+
'.idrive.com',
102+
'.immy.bot',
103+
'.imperosoftware.com',
104+
'.instanthousecall.com',
105+
'.instanthousecall.net',
106+
'.intelliadmin.com',
107+
'.internetid.ru',
108+
'.iperius-rs.com',
109+
'.iperius.com',
110+
'.iperiusremote.com',
111+
'.islonline.com',
112+
'.islonline.net',
113+
'.itagent.com',
114+
'.itsm-us1.comodo.com',
115+
'.itsupport247.net',
116+
'.ivanti.com',
117+
'.ivanticloud.com',
118+
'.jumpdesktop.com',
119+
'.jumpto.me',
120+
'.kabuto.io',
121+
'.kabutoservices.com',
122+
'.kace.com',
123+
'.kaseya.com',
124+
'.kaseya.net',
125+
'.khelpdesk.com.br',
126+
'.kickidler.com',
127+
'.level.io',
128+
'.litemanager.com',
129+
'.litemanager.ru',
130+
'.logicnow.com',
131+
'.logmein-gateway.com',
132+
'.logmein.com',
133+
'.logmein.eu',
134+
'.logmeininc.com',
135+
'.logmeinrescue.com',
136+
'.logmeinrescue.eu',
137+
'.lunixar.com',
138+
'.managedsupport.kaseya.net',
139+
'.manageengine.com',
140+
'.mdmsupport.comodo.com',
141+
'.mdt.qq.com',
142+
'.meshcentral.com',
143+
'.mikogo.com',
144+
'.mikogo4.com',
145+
'.miradore.com',
146+
'.mremoteng.org',
147+
'.msp360.com',
148+
'.mspbackups.com',
149+
'.my.auvik.com',
150+
'.mygreenpc.com',
151+
'.mymeetinggoogle.com',
152+
'.n-able.com',
153+
'.naverisk.com',
154+
'.nchuser.com',
155+
'.net.anydesk.com',
156+
'.netbird.io',
157+
'.netop.com',
158+
'.netreo.com',
159+
'.netsupportmanager.com',
160+
'.ngrok.com',
161+
'.ninja-backup.com',
162+
'.ninjaone.com',
163+
'.ninjarmm.com',
164+
'.ninjarmm.net',
165+
'.nomachine.com',
166+
'.ntrsupport.com',
167+
'.nvaccess.org',
168+
'.ocsinventory-ng.org',
169+
'.opti-tune.com',
170+
'.optitune.us',
171+
'.panorama9.com',
172+
'.parallels.com',
173+
'.parsec.app',
174+
'.parsec.gg',
175+
'.pcvisit.de',
176+
'.pilixo.com',
177+
'.pulseway.com',
178+
'.r2.cloudflarestorage.com',
179+
'.radmin.com',
180+
'.real-time-collaboration.com',
181+
'.rel.tunnels.api.visualstudio.com',
182+
'.relay.splashtop.com',
183+
'.remote.it',
184+
'.remote.management',
185+
'.remotecall.com',
186+
'.remotedesktop-pa.googleapis.com',
187+
'.remotedesktop.com',
188+
'.remotedesktop.google.com',
189+
'.remotepass.com',
190+
'.remotepc.com',
191+
'.remoteutilities.com',
192+
'.repairshopr.com',
193+
'.rmansys.ru',
194+
'.rmm.datto.com',
195+
'.rmmservice.ca',
196+
'.rmmservice.com.au',
197+
'.rmmservice.eu',
198+
'.royalapps.com',
199+
'.rport.io',
200+
'.rudesktop.ru',
201+
'.runsmart.io',
202+
'.rustdesk.com',
203+
'.rview.com',
204+
'.screenconnect.com',
205+
'.screenmeet.com',
206+
'.scrn.mt',
207+
'.search.namequery.com',
208+
'.senso.cloud',
209+
'.servably.com',
210+
'.server-eye.de',
211+
'.server.absolute.com',
212+
'.set.me',
213+
'.setme.net',
214+
'.showmypc.com',
215+
'.signalserver.xyz',
216+
'.simple-help.com',
217+
'.site24x7.cn',
218+
'.site24x7.com',
219+
'.site24x7.eu',
220+
'.site24x7.in',
221+
'.site24x7.net.au',
222+
'.skyfex.com',
223+
'.sophos.com',
224+
'.sophosupd.com',
225+
'.sophosupd.net',
226+
'.sorillus.com',
227+
'.soti.net',
228+
'.splashtop.com',
229+
'.spyanywhere.com',
230+
'.spytech-web.com',
231+
'.startsupport.com',
232+
'.superops.ai',
233+
'.superopsalpha.com',
234+
'.superopsbeta.com',
235+
'.support.services.microsoft.com',
236+
'.supremocontrol.com',
237+
'.swi-tc.com',
238+
'.syncroapi.com',
239+
'.syncromsp.com',
240+
'.system-monitor.com',
241+
'.systemmonitor.co.uk',
242+
'.systemmonitor.eu.com',
243+
'.systemmonitor.us',
244+
'.tailscale.com',
245+
'.tailscale.io',
246+
'.teamviewer.com',
247+
'.techinline.net',
248+
'.teknopars.com',
249+
'.tele-desk.com',
250+
'.tightvnc.com',
251+
'.tmate.io',
252+
'.todesk.com',
253+
'.todesktop.com',
254+
'.ultraviewer.net',
255+
'.ultravnc.com',
256+
'.weezo.me',
257+
'.weezo.net',
258+
'.xeox.com',
259+
'.zabbix.com',
260+
'.zerotier.com',
261+
'.zoho.com',
262+
'.zoho.com.au',
263+
'.zoho.com.cn',
264+
'.zoho.eu',
265+
'.zoho.in',
266+
'.zohoassist.com',
267+
'.zohoassist.com.cn',
268+
'.zohoassist.jp'
269+
)
270+
271+
$Tag = 'RMMBlockTest'
272+
273+
function Test-IsAdmin {
274+
$current = [Security.Principal.WindowsIdentity]::GetCurrent()
275+
$principal = New-Object Security.Principal.WindowsPrincipal($current)
276+
return $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
277+
}
278+
279+
if (-not (Test-IsAdmin)) { throw "Run this script in an elevated PowerShell session." }
280+
281+
if ($Remove) {
282+
$existing = Get-DnsClientNrptRule | Where-Object { $_.Comment -eq $Tag -or $_.DisplayName -like "RMM block:*" }
283+
foreach ($rule in $existing) {
284+
try {
285+
Remove-DnsClientNrptRule -Name $rule.Name -Force -ErrorAction Stop
286+
Write-Host "Removed NRPT rule: $($rule.Name) [$($rule.Namespace -join ",")]" -ForegroundColor Yellow
287+
} catch {
288+
Write-Warning "Failed to remove NRPT rule $($rule.Name): $_"
289+
}
290+
}
291+
return
292+
}
293+
294+
$existingNs = @{}
295+
Get-DnsClientNrptRule | ForEach-Object {
296+
foreach ($ns in $_.Namespace) { $existingNs[$ns.ToLower()] = $_.Name }
297+
}
298+
299+
foreach ($ns in $Namespaces) {
300+
if ($existingNs.ContainsKey($ns.ToLower())) {
301+
Write-Host "Skipping existing namespace: $ns" -ForegroundColor DarkYellow
302+
continue
303+
}
304+
try {
305+
Add-DnsClientNrptRule -Namespace $ns -NameServers "127.0.0.1" -Comment $Tag -DisplayName "RMM block: $ns" -ErrorAction Stop | Out-Null
306+
Write-Host "Added NRPT block rule for $ns" -ForegroundColor Green
307+
} catch {
308+
Write-Warning "Failed to add NRPT rule for ${ns}: $_"
309+
}
310+
}
311+
312+
Write-Host "Done. Review with: Get-DnsClientNrptRule | Where-Object Comment -eq "$Tag"" -ForegroundColor Cyan

0 commit comments

Comments
 (0)