The document discusses scripting and automation capabilities in GFI MAX RemoteManagement. It provides an overview of scripting concepts, how scripts can be used for monitoring checks and automated maintenance tasks, and examples of built-in and custom scripts. The document also covers best practices for writing scripts, including using command line arguments, interacting with the file system, registry, applications, and returning results.

1. Scripting and Automation
GFI MAX RemoteManagement
Mark Petrie, Director of Engineering
GFI MAX

2. Scripting and Automation
» Introduction to scripting in GFI MAX RemoteManagement:
» Just what EXACTLY do we mean by scripting?
» Who is using scripting and for what purpose?
» Using built-in scripts
» Pro-active Monitoring Checks
» Automated Maintenance Tasks
» Using community scripts from fixitscripts.com
» Find solutions to problems you have
» Writing your own scripts…
» Return codes
» Considerations
» Getting started
» Coding guidelines
» Using the API
» Examples

3. Introduction

4. Just what EXACTLY do we mean by scripting?
» Upload, deploy, schedule and run scripts for additional:
» Monitoring Checks (Windows, OSX and Linux)
» Maintenance Tasks (Windows only)
» Scripts can be written in variety of common languages:
» DOS Batch and CMD
» VBS and Powershell
» Ruby, Python, Perl and PHP
» Javascript
» AppleScript
» BASH
» Upload script once, downloaded as required (without Agent update)
» Very powerful, but also secure:
» Script source can only be uploaded by superuser
» Signed (public/private key encryption) when downloaded by Agents

5. Are people using it?
» 7.5 million script checks run every day!
» Over 140,000 monitoring script checks
» 260,000 maintenance tasks run every day!
» What is it being used for?
» Monitoring bespoke applications and hardware
» Automating onboarding new clients
• Automating software installation
• Enforcing standard configurations
» Regular scheduled maintenance
» Automated fault resolution

6. Using built-in scripts

7. Pro-active Monitoring Checks
» Deploy as either 24x7 or DSC script check
» Get alerts and view results in Dashboard and Client Reports
» Timeout limited to 150 seconds

8. What Monitoring Checks are already available?
» Application Control:
» Running Process
» System User Count
» SQL Query
» Exchange:
» Large Mailboxes
» Mail Queue Size
» Store Control
» Security Center:
» Antivirus Status
» Windows Firewall
» Windows Update

9. What Monitoring Checks are already available?
» Virtualisation:
» VMware ESXi – Datastore Free Space
» VMware ESXi Health – CPUs
» VMware ESXi Health – Fans
» VMware ESXi Health – Memory
» VMware ESXi Health – PSUs
» VMware ESXi Health – Sensors
» VMware ESXi Health – Storage
» VMware ESXi – Virtual Machine Inventory
» VMware ESXi – Virtual Machine Power State

10. Monitoring Datastore Free Space and Storage Health

11. Monitoring running VMs

12. Monitoring VM resource usage

13. Automated Maintenance Tasks
» Upload script to Dashboard
» Deploy site wide or to individual workstations and servers
» Schedule once per day, week or month
» Run in response to a failed check
» View results in Dashboard
» Automated Tasks Report
» Timeout per schedule

14. What Maintenance Tasks are already available?
» Antivirus:
» Malwarebytes
» Sophos Definition Update
» Application Control:
» Running Process
» SQL Query
» Exchange:
» Store Control
» Clean-Up:
» Clean Temp Files
» Clear Event Log
» Defrag
» Windows
» Schedule Reboot
» Service Control
» Virtualisation
» VMware ESXi – Virtual Machine Control

15. Stopping, starting and restarting VMs

16. Using community scripts

17. fixitscripts.com
433 problems /
requests for scripts
584 total scripts
269 scripts tagged
for MAX RM
328 PowerShell
scripts
Visitors from over
100 countries
179 VBScript scripts
18,420 visitors in
last 3 months
797 registered users
Over 2 minutes
duration per visit

18. Using script from fixitscripts.com

19. Writing your own scripts

20. Return codes
» Extend GFI MAX to monitor anything!?
» Use exit codes to cause check to fail:
» Exit 0 to cause check to pass
» Exit non-zero to cause check to fail
» Exit >1000 to display text output in Dashboard
» Batch
echo “Error Message”
exit 1001
» VBS
wscript.echo( “Error Message” )
wscript.Quit(1001)
» PowerShell
Write-Host “Error Message”
Exit 1001

21. Considerations and Limitations

22. Local system account
» User context (Session Zero)
» No user interaction
» No network Resources

23. Environment Variables
» Command line arguments solve this…

24. Timeouts

25. Getting started

26. Documentation

27. Don’t reinvent the wheel!
» Steal Learn from Others Scripts
» fixitscripts.com
» GFI Forum
» LinkedIn
» Google!
» Identify the problem trying to solve
» Look at ServiceDesk – where is time being spent on tickets
» Check Google (Why reinvent the wheel?)
» Investigate using tools (ProcessMonitor, ProcessExplorer, etc)
» Find Applications/Commands
» Command Switches
» Use previous scripts as a template and import into GFI MAX

28. Example from LinkedIn (service recovery)

29. Example from LinkedIn (service recovery)

30. Script writing guidelines

31. Visual Basic and Powershell
» Visual Basic Script fully supported since Windows 2000
» Powershell supported from WindowsXP onwards
» May need to be installed on some older systems
» Using Windows Script Host WScript object, you can access:
» Arguments passed to script
» Command Line Shell
» File System
» Registry
» Services
» Network (not if running as Local System Account)
» VBS can also access Windows Management Instrumentation

32. Script structure
» Clearly identify problem trying solve
» Any script needs to do the following:
» Declare variables to be used
» Parse command line arguments
» Interact with Windows or Application
» Handle any errors
» Return results

33. Declaring variables and constants
» Good practice to force all variables to be declared before use
» Use g_ to indicate global variables and clarify variable scope
» Use type hinting to indicate variables intended purpose
» Use Constants for magic numbers that won’t change
' Usage: { start | stop | restart } "Service Name“
Option Explicit
Dim g_oArgs, g_nMode, g_sServiceName
Const MODE_START = 101
Const MODE_STOP = 102
Const MODE_RESTART = 103

34. Command Line Arguments
» Arguments passed into script via command line can be used to:
» Control behaviour of script (for example: action to perform)
» Pass in the target of script (for example: service to restart)
» Setup additional environment variables (If not available to Local System)
» Advantages over hard-coding script behaviour and target?
» Common code (e.g. connect to service manager) can be reused
» Reduces number of scripts and improves maintainability of library

35. Command Line Arguments
» Accessing arguments:
» DOS Batch uses %1, %2 etc (note %0 is name of script)
» Linux shell scripts (BASH) use $1, $2 etc ($0 is name of script)
» Dynamic langauges (Perl, PHP) use $argc (count) and @argv (array)
» VBS uses WScript.Arguments object:
• WScript.Arguments.Count method gives number of arguments
• WScript.Arguments(0) is first argument etc
» Scripts ran by Advanced Monitoring Agent:
» Two arguments are always appended to command line (for debug)
» -logfile logname can be ignored

36. Command Line Arguments
' Usage: { start | stop | restart } "Service Name“
Set g_oArgs = WScript.Arguments
If g_oArgs.Count < 2 Then
WScript.Echo "Invalid Arguments"
WScript.Quit(1)
End If
Select Case g_oArgs(0)
Case "start"
g_nMode = MODE_START
Case "stop"
g_nMode = MODE_STOP
Case "restart"
g_nMode = MODE_RESTART
Case Else
WScript.Echo "Invalid Args"
WScript.Quit(1)
End Select
g_sServiceName = g_oArgs(1)

37. Interacting with applications
» Windows Script Host can run applications on local system
» Application has status 0 until it terminates
Set g_oShell = WScript.CreateObject("WScript.Shell")
Set g_oRunningApp = g_oShell.Exec( "c:/path/to/my.exe arg0 arg1" )
Do While g_oRunningApp.Status = 0
WScript.Sleep 100
Loop
WScript.Echo "Application Terminated“
» Application will be ran as user Agent running under (Local System Acc)
» Any pop-up or user intervention will likely cause script timeout

38. Interacting with file system
• Create a File System Object to access any file or directory listing
Set g_oFileSystem = CreateObject( "Scripting.FileSystemObject" )
Set g_oTextFile = g_oFileSystem.OpenTextFile( "c:test.txt", 1 )
Do Until g_oTextFile.AtEndOfStream
g_sNextLine = g_oTextFile.Readline
WScript.Echo g_sNextLine
Loop
• Use regular expressions to parse file contents
Set oRegExp = New RegExp
oRegExp.Pattern = "^GETd.pdf$"
Do Until oTextFile.AtEndOfStream
sCurrentLine = oTextFile.Readline
If oRegExp.Test( sCurrentLine ) Then
nAccessed = nAccessed + 1
End If
Loop
• Regular expressions can also be used to extract or replace matches

39. Interacting with registry
» Registry stores config and management information of OS and Apps
» Hierarchical organisation of keys and values (like filesystem)
» A key can store many other keys.
» A key can have default data.
» A value can only store data and cannot store other values or keys
» Data types of values must be explicitly set on creation
» REG_BINARY – Binary Data (0’s and 1’s)
» REG_DWORD – Double Word (Numeric, up to 32bit values)
» REG_QWORD – Quadruple Word (Numeric, up to 64bit values)
» REG_MULTI_SZ – A Set of Strings
» Retrieve a value from Registry using RegRead (e.g. path to application)
Set g_oShell = WScript.CreateObject ("WScript.Shell")
g_sMBAMLocation = g_oShell.RegRead _
("HKLMSOFTWAREMicrosoftWindowsCurrentVersionApp Pathsmbam.exe")
» Write a value to registry using RegWrite (e.g. reconfigure an application)
g_oShell.RegWrite ( “key_location”, “value”, “key_type” )

40. Handling errors
» On Error GoTo 0 (default)
» Will cause script to exit, use only for fatal non-recoverable errors
» On Error Resume Next
» Will cause script execution to continue, allowing you to handle error
» Err variable set to last error code
» Script follows rule until presented with another error handing instruction
» The scope of rule is per sub-routine only
» Use function to handle errors consistently
Function stHandleFatalError( innExitCode, insMsg )
If Err.Number <> 0 Then
Err.Clear
On Error GoTo 0
WScript.Echo insMsg
Wscript.Quit innExitCode
End If
On Error Resume Next
Err.Clear
End Function

41. Return results to Dashboard
» Use exit codes to cause check to fail:
» Exit 0 to cause check to pass
» Exit non-zero to cause check to fail
» Exit >1000 to display text output in Dashboard
» Batch
echo “Error Message”
exit 1001
» VBS
wscript.echo( “Error Message” )
wscript.Quit(1001)
» PowerShell
Write-Host “Error Message”
Exit 1001

42. Putting it all together
Option Explicit
Dim g_oWindowsFirewall
On Error Resume Next
Set g_oWindowsFirewall = WScript.CreateObject( "HNetCfg.FwMgr" )
stHandleFatalError 2001, "Unable to create Firewall object"
If g_oWindowsFirewall.LocalPolicy.CurrentProfile.FirewallEnabled = 1 Then
WScript.Echo "Windows Firewall Enabled"
WScript.Quit ( 0 )
Else
WScript.Echo "Windows Firewall Disabled"
WScript.Quit ( 2000 )
End If
Function stHandleFatalError( innExitCode, insMsg )
If Err.Number <> 0 Then
Err.Clear
On Error GoTo 0
WScript.Echo insMsg
Wscript.Quit innExitCode
End If
On Error Resume Next
Err.Clear
End Function

43. Windows Management Instrumentation
» WMI allows access to almost all Windows components
» Make modifications to settings and initiate operations
» For example, check Print Spooler is running…
sServiceName = "Spooler"
sComputer = "."
On Error Resume Next
Set oWMIService = GetObject("winmgmts:" & strComputer & "rootCIMV2")
stHandleFatalError( ERROR_CREATEOBJECT_WMI )
Set oService = oWMIService.Get("Win32_Service.Name='" & sServiceName & "'")
If oService.State = "Running" Then
WScript.Echo "Print Spooler is Running"
WScript.Quit ( 0 )
Else
' Restart Service etc...

44. Windows Management Instrumentation
http://msdn.microsoft.com/en-us/library/aa394554(v=vs.85).aspx

45. Scripting and API

46. Getting the data you need from API
» Used mainly to get data out of GFI MAX RemoteManagement
» Easy to manipulate with PowerShell:
$apikey = “YOUR API KEY"
$clientsurl = "https://www.systemmonitor.us/api/?apikey=$apikey&service=list_clients"
[xml]$xmlclients = (new-object System.Net.WebClient).DownloadString($clientsurl)
» Example Uses:
» Getting serial number data
» Getting MAC addresses for Wake-on-LAN
» See online help system for full instructions

47. Example: Workstations that have not been scanned in 90 days
$apikey = "YOUR API KEY"
$CurrDate = Get-Date
$clientsurl = "https://www.systemmonitor.us/api/?apikey=$apikey&service=list_clients"
$wstable = @()
[xml]$xmlclients = (new-object System.Net.WebClient).DownloadString($clientsurl)
foreach ($xmlclientslist in $xmlclients.result.items.client) {
$clientid = $xmlclientslist.clientid
$sitesurl="https://www.systemmonitor.us/api/?
apikey=$apikey&service=list_sites&clientid=$clientid"
[xml]$xmlsites = (new-object System.Net.WebClient).DownloadString($sitesurl)
foreach ($xmlsiteslist in $xmlsites.result.items.site) {
$siteid = $xmlsiteslist.siteid
$wsurl = "https://www.hound-dog.us/api/?
apikey=$apikey&service=list_workstations&siteid=$siteid"
[xml]$xmlws = (new-object System.Net.WebClient).DownloadString($wsurl)
foreach ($xmlwslist in $xmlws.result.items.workstation) {
[datetime]$wsdate = $xmlwslist.last_scan_time
if (($CurrDate).Subtract($wsdate).Days -gt 90) {
$wsObj = "" | select Client,WSName,Age
$wsObj.Client = $xmlclientslist.name."#cdata-section"
$wsObj.WSName = $xmlwslist.name."#cdata-section"
$wsObj.Age = ($CurrDate).Subtract($wsdate).Days
$wstable += $wsObj
}}}}

48. Example: Wake devices before patching
param($siteid)
$apikey = "Put your API Key here“
$apiurl = “https://www.systemmonitor.us/api/?apikey=$apikey”
$url = "$($apiurl)&service=list_workstations&siteid=$siteid"
[xml]$xmlmac = (new-object System.Net.WebClient).DownloadString($url)
foreach ($xmlmacws in $xmlmac.result.items.workstation) {
$macString = $xmlmacws.mac1."#cdata-section"
$mac = $macString.split(':') | %{ [byte]('0x' + $_) }
$UDPclient = new-Object System.Net.Sockets.UdpClient
$UDPclient.Connect(([System.Net.IPAddress]::Broadcast),4000)
$packet = [byte[]](,0xFF * 6)
$packet += $mac * 16
[void] $UDPclient.Send($packet, $packet.Length)
write-output "Wake-On-Lan magic packet of length $($packet.Length) sent to
$macString"
}

49. Real-world examples

50. Real-world examples
» Custom Monitoring
» Automate repetitive tasks
» Onboarding new clients
» Software installation
» Preventing tickets

51. Custom Monitoring
» Check current time vs. NTP server
$ntpcheck = w32tm /stripchart /dataonly /computer:pool.ntp.org /samples:1
[int]$ntpchecktime = $($ntpcheck.Split()[-1]).Split("s")[0].Substring("1")
Write-Output "$ntpchecktime seconds"
if ($ntpchecktime -gt 300) {
Write-Output "Check failed"
Exit 1001
}

52. Onboarding new clients
» Make sure all of your standards are enforced from the start
» Install and configure SNMP
» Software deployment
» Enable RDP
» Enable Wake on LAN
» Open ports in the firewall

53. Install and configure SNMP
cmd /c Servermanagercmd -install SNMP-Services
reg add HKEY_LOCAL_MACHINESYSTEMCurrentControlSet
servicesSNMPParametersValidCommunities /v ROString /t
REG_DWORD /d 4 /f
reg delete HKEY_LOCAL_MACHINESYSTEMCurrentControlSet
ServicesSNMPParametersPermittedManagers /f
Stop-Service -Name SNMP
Start-Service -Name SNMP

54. Software deployment
» Download MSI or EXE and use silent switches to install software
» Host on your website, Dropbox, or similar file storage solution
» Silent switches are typically available with software documentation
» MSI install files always use msiexec with the same switches for installation
Msiexec /I {filepath} /quiet /qn /norestart REBOOT=reallysuppress
» Check HKLMSoftwareMicrosoftWindowsUninstall for MSI uninstall string. Add /quiet to
switch to make quiet
Msiexec /I {filepath} /quiet /qn /norestart REBOOT=reallysuppress

55. Download and install OpenManage
$file_url = "http://downloads-us.dell.com/FOLDER00574377M/1/OM-SrvAdmin-Dell-
Web-WIN-7.1.0-5304_A00.exe"
$file_name = "OMSA-6.5.0-2247_A01.exe"
$numafiles_path = "$Env:SystemDriveNumaNetworks"
if ((Test-Path $numafiles_path) -eq $false) {
New-Item -type directory -Path $numafiles_path | Out-Null
}
if ((Test-Path "$numafiles_path$($file_name)") -eq $false) {
$file_dload_file = "$numafiles_path$($file_name)"
$file_dload = new-object System.Net.WebClient
$file_dload.DownloadFile($file_url,$file_dload_file)
cmd /c $numafiles_path$file_name /auto $numafiles_pathOpenManage
}
cmd /c msiexec /i
$numafiles_pathOpenManageWindowsSystemsManagementSysMgmt.msi
/quiet /norestart

56. Preventing tickets
» Fix problems detected by your monitoring scripts
» Reduce the amount of tickets coming into your helpdesk
» Setup using an automated task
» Don’t run at a specified time, run at a specified event
» Able to run at the failure of most checks (Service, Event, AV Update)
» Script will run at next 24/7 check-in following failure
» Examples:
» Clear and start print spooler when service stops
» Force AV definition update when definitions are old
» Run disk cleanups when disk gets full

57. Clear Print Spooler and restart service
Set objShell = CreateObject("WScript.Shell")
Set objFSO = CreateObject("Scripting.FileSystemObject")
Set objWMIService = GetObject("winmgmts:{impersonationLevel=impersonate}!"_
& “.rootcimv2")
SpoolDirectory = objShell.RegRead("HKLMSystemCurrentControlSet"_
& "ControlPrintPrintersDefaultSpoolDirectory")
Set objFolder = objFSO.GetFolder(SpoolDirectory)
For Each objFile In objFolder.Files
WScript.Echo "Deleteing "+objFile.Name
objFile.Delete(Force)
Next
Set objSpooler = objWMIService.Get("Win32_Service='spooler'")
If objSpooler.State = "Stopped" Then
WScript.Echo "Starting Spooler."
objSpooler.StartService()
End If

58. Summary

59. Summary
» Scripting allows you to extend monitoring and automate maintenance
» 7.5 million script checks and 260,000 maintenance tasks run every day
» Built-in scripts available to add now with no programming knowledge required
» Hundreds of community scripts available on fixitscripts.com for you to use
» If you do want to write your own scripts
» Ensure script returns appropriate return code for pass/fail
» See script writing guidelines in help system
» Borrow and build on top of other scripts
» Save time onboarding new clients, automating maintenance and preventing tickets
» Check your ServiceDesk for where time is being spent on tickets

60. Thank You
Conferences.gfimax.com/app