Foreach - Passing variable to Invoke-Command (Tamper protect disable)

[tri_94]

Hi there

 

I've wrote a script to disable tamper protect and uninstall Sophos. Which works fine for a computer, I replace the computer name and tamper code.

 

I'm trying to make this work for a large group of computers, so I've created a csv with name and tamper code.

 

$entry.Tamper gives me correct code. However it seems that it doesn't pass the correct one to the computer, at the end of the function I've put $code which shows the correct code but it fails to disable the tamper.

If I run the 2nd code below which is the same basically the same script but I manual put a value for tamper is works and disables the tamper.

 

Thanks

 

 

$Info = Import-csv "D:\test\1.csv"



Foreach ($entry in $Info) {



$Global:Computer = $entry.name

$Global:Tampercode = $entry.Tamper





Write-host $computer 



$reboot = 0





Function Tamper {



#Enable WinRM service on remove computer, required for Invoke-Command.

Get-Service -Name WinRM -ComputerName $computer | Start-service



$session = New-PSSession -ComputerName $computer

Invoke-Command -Session $session -ScriptBlock { 



$Tamper = "C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe"

$Toff = "-TPoff"

#$Tampercode = Read-host "Enter Tamper Code"



$code = $Tampercode



$T = $Toff+" "+$code



Start-Process -FilePath $Tamper -ArgumentList $T



}

$code}



[/Code]
 
 

Single Computer and works
 

[Code]

$Computer = "Computer1"





$reboot = 0





Function Tamper {



#Enable WinRM service on remove computer, required for Invoke-Command.

Get-Service -Name WinRM -ComputerName $computer | Start-service



$session = New-PSSession -ComputerName $computer

Invoke-Command -Session $session -ScriptBlock { 



$Tamper = "C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe"

$Toff = "-TPoff"

#$Tampercode = Read-host "Enter Tamper Code"

$Tampercode = "09999999999"



$T = $Toff+" "+$Tampercode



Start-Process -FilePath $Tamper -ArgumentList $T



}}



[/Code]

[chaplic]

Having a function called tamper and a variable name the same is making my head go fuzzy, I don't see how your single example is working either because the function tamper is never called?

[tri_94]

Having a function called tamper and a variable name the same is making my head go fuzzy, I don't see how your single example is working either because the function tamper is never called?

 

Hi there

 

Sorry i had posted the Function which is not working.

 

I've now uploaded the full code.

[Steve21]

The first thing that would spring to mind, have you checked your CSV file doesn't include anything like special chars? As it won't then match it if it's importing it with the special char, but would when you type it manually

 

Notepad++ is a good test, as you can turn on the special chars showing in there to see if there are any

 

Steve

[tri_94]

The first thing that would spring to mind, have you checked your CSV file doesn't include anything like special chars? As it won't then match it if it's importing it with the special char, but would when you type it manually

 

Notepad++ is a good test, as you can turn on the special chars showing in there to see if there are any

 

Steve

 

I manually put the code in the csv, so I know the code it correct with no extra chars.

 

In the script I call $code to check what it has in the variabile and I’ve even copied what it showed and used that in the my single computer script and it worked fine.

[free780]

I used the API and queried the Tamper Protection Password. You need to be careful though. Protect the keys and the data.

[ThomL]

Messed about with the code, I don't have the ability to test - is this any good:

Function DisableTamper ($computer, $TamperCode){
   #Enable WinRM service on remove computer, required for Invoke-Command.
   Get-Service -Name WinRM -ComputerName $computer | Start-service
   $session = New-PSSession -ComputerName $computer
   Invoke-Command -Session $session -ScriptBlock {
       $TamperPath = "C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe"
       $TamperArgs = "-TPoff $TamperCode"
       Start-Process -FilePath $TamperPath -ArgumentList $TamperArgs
   }
}

Function Zap($Computer, $TamperCode){
   $reboot = 0

   Write-host "$Computer - Now trying to disable Tamper"
   DisableTamper -computer $Computer -TamperCode $TamperCode

   Write-host "$Computer - Copying Sophos Zap"
   Copy "\\Server\Sophos\SophosZap.exe" "\\$Computer\c$\"

   Write-host "$Computer - Starting remote connection"
   $session = New-PSSession -ComputerName $computer
   Invoke-Command -Session $session -ScriptBlock {
       Write-host "$Computer - Running SophosZap"
       $ZapPath = "c:\SophosZap.exe"
       $ZapArgs = "--confirm"
       Start-Process -FilePath $ZapPath -ArgumentList $ZapArgs
   }

   Write-host "$Computer - Check log file for next step required (last line)"
   $SEL = get-content "\\$computer\C$\Users\User\AppData\Local\Temp\Sophos Windows Endpoint Zap log.txt"
   $amount = ($SEL.Count -1)

   if($SEL[$amount] -imatch "Outcome reboot required: 1"){
       Write-Host "$Computer - Reboot Required"
       $reboot = 1
       if (Restart-Computer -ComputerName $Computer -Wait -Timeout 45){
           $reboot = 0
       }else{
           write-host "$Computer - Reboot failed"
       }
   }else{
       Write-Host "$Computer - Reboot not required"
       $reboot = 0
   }

   Write-host "$Computer - Start remote service again"
   Get-Service -Name WinRM -ComputerName $computer | Start-service

   Write-host "$Computer - Next step to disable Tamper again"
   DisableTamper -computer $Computer -TamperCode $TamperCode

   if (test-path -PathType Leaf -Path "\\$Computer\c$\SophosZap.exe"){
       Write-host "$Computer - Starting remote connection"
       $session = New-PSSession -ComputerName $computer
       Invoke-Command -Session $session -ScriptBlock {
           write-host "$Computer - Running SophosZap Again"
           $ZapPath = "c:\SophosZap.exe"
           $ZapArgs = "--confirm"
           Start-Process -FilePath $ZapPath -ArgumentList $ZapArgs
       }
   }

   Write-host "$Computer - Check log file for next step required (last line)"
   $SEL = get-content "\\$computer\C$\Users\User\AppData\Local\Temp\Sophos Windows Endpoint Zap log.txt"
   $amount = ($SEL.Count -1)
   
   if($SEL[$amount] -imatch "Outcome reboot required: 1"){
       Write-Host "$Computer - Reboot Required"
   }else{
       Write-Host "$Computer - Reboot not required for SophosZap but rebooting to reinstall via GPO"
   }
   
   Remove-Item "\\$computer\c$\SophosZap.exe"
   Restart-Computer -ComputerName $Computer

   $reboot = 0

   Write-Host "$computer - Sophos Zap Uninstall has has finished"
}

$Info = Import-csv "D:\test\1.csv"Foreach ($entry in $Info) {

   Write-Host "################################################`r`n $($entry.name)"

   Zap -computer $entry.name -TamperCode $entry.Tamper

   Write-Host "$($entry.name) Complete.`r`n################################################"
}

Edited July 29, 2021 by ThomL

[MartinByard]

I think it might be due to passing a variable in the Invoke-Command scriptblock that has been defined outside of that script block (I seem to recall falling foul of this myself a while back).....

 

i think if instead of $TamperCode in @ThomL's suggestion, it was $using:TamperCode then that might work

[ThomL]

I think it might be due to passing a variable in the Invoke-Command scriptblock that has been defined outside of that script block (I seem to recall falling foul of this myself a while back).....

 

i think if instead of $TamperCode in @ThomL's suggestion, it was $using:TamperCode then that might work

 

Good catch, another tweaked version that might be worth trying:

 

Function DisableTamper ($computer, $TamperCode) {
   #Enable WinRM service on remove computer, required for Invoke-Command.
   Get-Service -Name WinRM -ComputerName $computer | Start-service
   $session = New-PSSession -ComputerName $computer
   Invoke-Command -Session $session -ScriptBlock -ArgumentList $TamperCode {
       param($TamperCode)
       $TamperPath = "C:\Program Files\Sophos\Endpoint Defense\SEDcli.exe"
       $TamperArgs = "-TPoff $TamperCode"
       Start-Process -FilePath $TamperPath -ArgumentList $TamperArgs
   }
}

Function ExecuteZap ($computer){
   #Enable WinRM service on remove computer, required for Invoke-Command.
   Get-Service -Name WinRM -ComputerName $computer | Start-service
   $session = New-PSSession -ComputerName $computer
   Invoke-Command -Session $session -ScriptBlock {
       $ZapPath = "c:\SophosZap.exe"
       $ZapArgs = "--confirm"
       Start-Process -FilePath $ZapPath -ArgumentList $ZapArgs
   }
}

Function RebootRequired($computer){
   $SEL = get-content "\\$computer\C$\Users\User\AppData\Local\Temp\Sophos Windows Endpoint Zap log.txt"
   $amount = ($SEL.Count -1)
   if($SEL[$amount] -imatch "Outcome reboot required: 1"){
       return $true
   }else{
       return $false
   }
}

Function Zap($Computer, $TamperCode) {
   Write-host "$Computer - Now trying to disable Tamper"
   DisableTamper -computer $Computer -TamperCode $TamperCode

   Write-host "$Computer - Copying Sophos Zap"
   Copy "\\Server\Sophos\SophosZap.exe" "\\$Computer\c$\"

   Write-host "$Computer - Running SophosZap"
   ExecuteZap -computer $Computer
   
   Write-host "$Computer - Check if reboot required"
   if(RebootRequired -computer $Computer){
       Write-Host "$Computer - Reboot Required"
       if (Restart-Computer -ComputerName $Computer -Wait -Timeout 90){
           Write-Host "$Computer - Reboot Complete"
       }else{
           Write-Host "$Computer - Reboot failed"
       }
   }else{
       Write-Host "$Computer - Reboot not required"
   }
   
   Write-host "$Computer - Start remote service again"
   Get-Service -Name WinRM -ComputerName $computer | Start-service

   Write-host "$Computer - Next step to disable Tamper again"
   DisableTamper -computer $Computer -TamperCode $TamperCode

   Write-Host "$Computer - Running SophosZap Again"
   ExecuteZap -computer $Computer

   Write-host "$Computer - Check if reboot required"
   if(RebootRequired -computer $Computer){
       Write-Host "$Computer - Reboot Required"
   }else{
       Write-Host "$Computer - Reboot not required for SophosZap but rebooting to reinstall via GPO"
   }

   Remove-Item "\\$computer\c$\SophosZap.exe"

   Restart-Computer -ComputerName $Computer

   Write-Host "$computer - Sophos Zap Uninstall has finished"
}

$Info = Import-csv "D:\test\1.csv"

Foreach ($entry in $Info) {

   Write-Host "################################################`r`n $($entry.name)"

   Zap -computer $entry.name -TamperCode $entry.Tamper

   Write-Host "$($entry.name) execution complete.`r`n################################################"

}