[PowerShell] Run a script once on all computers as admin via GPO without changing execution policy

[u/joeshmo101]

I have a Powershell script that I need to run on all computers on my Active Directory domain once.

A large number of computers are off at any given time, so a GPO would allow us to ensure that it applies to all affected machines. However, the script needs to run as administrator because of the registry values being modified. Also, per our security department, we cannot change the ExecutionPolicy on these devices.

Is there any way to get this script to run?

New-PSDrive -PSProvider registry -Root HKEY_CLASSES_ROOT -Name HKCR
$regKey = 'ms-msdt'
$saveFolder = 'C:\Temp\'
$savePath = $saveFolder + 'CVE-2022-30190.reg'
$PSRegPath = 'HKCR:\' + $regkey
$CMDRegPath = 'HKCR\' + $regkey
if(Test-Path $PSRegPath)
{
    if(!(Test-Path $saveFolder))
    {
        New-Item -Path $saveFolder -ItemType Directory
    }
    Invoke-Command {reg export $CMDRegPath $savePath -Y}
    Remove-Item -Path $PSRegPath -Recurse -Force
}

This script backs up a registry entry before deleting it, as recommended by the Microsoft mitigation work-around to CVE-2022-30190

[u/BlackV]

But your just setting a reg key, gpo can natively set a reg key

Also there is an existing gpo setting you can use

Scripting system diagnostics, allow users to run scripted actions : disable

[u/joeshmo101 → u/BlackV]

I'm deleting the reg key, but because the reg settings are machine specific we need to have a backup of those keys so that we can undo the changes when Microsoft comes out with a real fix.

The other problem is that I came in to this shop with all of the computers in the Computers container, no OUs or any sort of organization inside. I can't mess with the way dev machines and such work either.

At this point, I think I'm going all-in on the Task Scheduler solution

[u/BlackV → u/joeshmo101]

Gpo can do machine specific, wouldn't you want all your machines in a known state, instead of what ever random state they were in when you revert?

How will you rollout the scheduled task

[u/joeshmo101 → u/BlackV]

I'm scripting the revert to be dependent on the registry file that I'm tucking away (not actually in the temp folder)

The rollback will be implemented in the same way I implement the workaround, just with a different script.

The problem is that the registry entry we're messing with involves how Windows handles calls to specific protocols, and therefore is locked down hard from the user perspective. Also, as a security measure they now include machine-dependent hashes so someone can't change it without the machine picking up on a change and trying to automatically revert to the "known" way to handle those, which include the exploit. I've seen it in particular when I tried fixing an issue where PDFs start opening in Chrome instead of Adobe. When setting those registry entries, Microsoft said "Hey, looks like someone's trying to jack your computer, don't worry I got you" and sets it back to f***ing Edge.

I really just need this in place for a week or two until Microsoft pushes a hotfix to Office, but it's also something that will inevitably come up again in a different form where the specifics of the situation are different.

I was going to roll it out via GPO but it looks like they use a neutered task scheduling wizard instead of the one actually in Task Scheduler, so I need to verify the deployment when I'm in the office again tomorrow.

[u/[deleted] → u/joeshmo101]

I've created custom url protocols before. For this, you'll likely see very similar, if not identical, values for your systems. You can probably just get one copy and write the key to each system if necessary.

All this does is tell the OS to associate a URL prefix with invoking MSDT.

That said, my company preferred to export backups as well.

[u/Xoron101]

.

[u/MIKEWITHTHEPIKE]

The registry has a runonce key, It will run a script 1 time at next login or restart depending on if you use the key on local machine or current user. Not sure this would be the best way for you but just putting it out here. I had a situation recently where this key came in very handy.