PowerShell 修復腳本

本文包含客戶可實作或作為範本的範例腳本，幫助他們學習如何自行製作。 請利用此處提供的資訊來 建立修復腳本套件。

文字描述

此表格顯示腳本名稱、描述、偵測、修復及可配置項目。 名稱以 End Detect 開頭的腳本檔是偵測腳本。 修復腳本以 開頭。Remediate 這些腳本可從本文下一節複製。

指令碼名稱 描述
請檢查網路憑證
Detect_Expired_Issuer_Certificates.ps1
Remediate_Expired_Issuer_Certificates.ps1		 偵測由 CA 在機器或使用者個人儲存庫中簽發且已過期或接近到期的憑證。
透過在偵測腳本中更改 的 $strMatch 值來指定 CA。 為 指定 0 $expiringDays 以尋找過期憑證，或指定其他天數以尋找接近到期的憑證。

透過向使用者發出吐司通知來補救。
請指定$Title$msgText與值，包含訊息標題和你希望使用者看到的文字。

通知使用者可能需要更新的證書過期。

用登入的憑證執行腳本：是的
清除過期證書
Detect_Expired_User_Certificates.ps1
Remediate_Expired_User_Certificates.ps1		 偵測由 CA 在當前使用者個人儲存庫中簽發的過期憑證。
透過在偵測腳本中更改 的 $certCN 值來指定 CA。

透過刪除 CA 從當前使用者個人儲存庫中簽發的過期憑證來修復。
透過在修復腳本中更改 的 $certCN 值來指定 CA。

從目前使用者的個人儲存庫中尋找並刪除 CA 頒發的過期憑證。

用登入的憑證執行腳本：是的
更新過時的群組政策 (內建)
Detect_stale_Group_Policies.ps1
Remediate_stale_GroupPolicies.ps1		 偵測最後一次群組原則更新是否比7 days之前更頻繁。
這個腳本套件包含在 Remediations 裡，但如果你想更改閾值，會提供一份副本。 透過修改偵測腳本中的 值 $numDays 來自訂七天門檻。

透過執行gpupdate /target:computer /force來修復，並gpupdate /target:user /force

能協助減少憑證與設定透過群組原則交付時的網路連線相關支援呼叫。

用登入的憑證執行腳本：是的

檢查網路憑證腳本套件

此腳本套件偵測由 CA 在機器或使用者個人儲存庫中發出、已過期或接近過期的憑證。 腳本會透過向使用者發出吐司通知來修復。

Detect_Expired_Issuer_Certificates.ps1

#=============================================================================================================================
#
# Script Name:     Detect_Expired_Issuer_Certificates.ps1
# Description:     Detect expired certificates issued by "CN=<your CA here>" in either Machine
#                  or User certificate store
# Notes:           Change the value of the variable $strMatch from "CN=<your CA here>" to "CN=..."
#                  For testing purposes the value of the variable $expiringDays can be changed to a positive integer
#                  Don't change the $results variable
#
#=============================================================================================================================

# Define Variables
$results = @()
$expiringDays = 0
$strMatch = "CN=<your CA here>"

try
{
    $results = @(Get-ChildItem -Path Cert:\LocalMachine\My -Recurse -ExpiringInDays $expiringDays | where {$_.Issuer -match $strMatch})
    $results += @(Get-ChildItem -Path Cert:\CurrentUser\My -Recurse -ExpiringInDays $expiringDays | where {$_.Issuer -match $strMatch})
    if (($results -ne $null)){
        #Below necessary for Intune as of 10/2019 will only remediate Exit Code 1
        Write-Host "Match"
        Return $results.count
        exit 1
    }
    else{
        #No matching certificates, do not remediate
        Write-Host "No_Match"
        exit 0
    }
}
catch{
    $errMsg = $_.Exception.Message
    Write-Error $errMsg
    exit 1
}

Remediate_Expired_Issuer_Certificates.ps1

#=============================================================================================================================
#
# Script Name:     Remediate_Expired_Issuer_Certificates.ps1
# Description:     Raise a Toast Notification if expired certificates issued by "CN=..."
#                  to user or machine on the machine where detection script found them. No remediation action besides
#                  the Toast is taken.
# Notes:           Change the values of the variables $Title and $msgText
#
#=============================================================================================================================

## Raise toast to have user contact whoever is specified in the $msgText

# Define Variables
$delExpCert = 0
$Title = "Title"
$msgText = "message"

# Main script
[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null
[Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null
[Windows.Data.Xml.Dom.XmlDocument, Windows.Data.Xml.Dom.XmlDocument, ContentType = WindowsRuntime] | Out-Null

$APP_ID = '{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WindowsPowerShell\v1.0\powershell.exe'

$template = @"
<toast>
    <visual>
        <binding template="ToastText02">
            <text id="1">$Title</text>
            <text id="2">$msgText</text>
        </binding>
    </visual>
</toast>
"@

$xml = New-Object Windows.Data.Xml.Dom.XmlDocument
$xml.LoadXml($template)
$toast = New-Object Windows.UI.Notifications.ToastNotification $xml
[Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier($APP_ID).Show($toast)

Clear stale certificates script package

此腳本套件偵測由 CA 在當前使用者個人儲存庫中簽發的過期憑證。 腳本透過刪除 CA 從當前使用者個人儲存庫中發出的過期憑證來修復。

Detect_Expired_User_Certificates.ps1

#=============================================================================================================================
#
# Script Name:     Detect_Expired_User_Certificates.ps1
# Description:     Detect expired certificates issued by "CN=<your CA here>" to User
# Notes:           Change the value of the variable $certCN from "CN=<your CA here>" to "CN=...".
#                  Don't change $results
#
#=============================================================================================================================

# Define Variables
$results = 0
$certCN = "CN=<your CA here>"

try
{
    $results = Get-ChildItem -Path Cert:\CurrentUser\My -Recurse -ExpiringInDays 0 | where {$_.Issuer -eq($certCN)}
    if (($results -ne $null)){
        #Below necessary for Intune as of 10/2019 will only remediate Exit Code 1
        Write-Host "Match"
        Return $results.count
        exit 1
    }
    else{
        Write-Host "No_Match"
        exit 0
    }
}
catch{
    $errMsg = $_.Exception.Message
    Write-Error $errMsg
    exit 1
}

Remediate_Expired_User_Certificates.ps1

#=============================================================================================================================
#
# Script Name:     Remediate_Expired_User_Certificates.ps1
# Description:     Remove expired certificates issued by "CN=<your CA here>" to User
# Notes:           Change the value of the variable $certCN from "CN=<your CA here>" to "CN=..."
#
#=============================================================================================================================

# Define Variables
$certCN = "CN=<your CA here>"

try
{
    Get-ChildItem -Path cert:\CurrentUser -Recurse -ExpiringInDays 0 | where {$_.Issuer -eq($certCN)} | Remove-Item
    exit 0
}
catch{
    $errMsg = $_.Exception.Message
    Write-Error $errMsg
    exit 1
}

Update stale 群組政策腳本套件

這個腳本套件包含在 Remediations 裡，但如果你想更改閾值，會提供一份副本。

這個腳本套件會偵測最近一次群組原則的刷新是否比7 days之前更大。 腳本透過執行 gpupdate /target:computer /force 和 gpupdate /target:user /force來修復。

Detect_stale_Group_Policies.ps1

#=============================================================================================================================
#
# Script Name:     Detect_stale_Group_Policies.ps1
# Description:     Detect if Group Policy has been updated within number of days
# Notes:           Remediate if "Match", $lastGPUpdateDays default value of 7, change as appropriate
#
#=============================================================================================================================

# Define Variables

try {
    $gpResult = [datetime]::FromFileTime(([Int64] ((Get-ItemProperty -Path "Registry::HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}").startTimeHi) -shl 32) -bor ((Get-ItemProperty -Path "Registry::HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}").startTimeLo))
    $lastGPUpdateDate = Get-Date ($gpResult[0])
    [int]$lastGPUpdateDays = (New-TimeSpan -Start $lastGPUpdateDate -End (Get-Date)).Days

    if ($lastGPUpdateDays -gt 7){
        #Exit 1 for Intune. We want it to be within the last 7 days "Match" to remediate in SCCM
        Write-Host "Match"
        exit 1
    }
    else {
        #Exit 0 for Intune and "No_Match" for SCCM, only remediate "Match"
        Write-Host "No_Match"
        exit 0
    }
}
catch {
    $errMsg = $_.Exception.Message
    return $errMsg
    exit 1
}

Remediate_stale_GroupPolicies.ps1

#=============================================================================================================================
#
# Script Name:     Remediate_stale_GroupPolicies.ps1
# Description:     This script triggers Group Policy update
# Notes:           No variable substitution needed
#
#=============================================================================================================================

try {
    $compGPUpd = gpupdate /force
    $gpResult = [datetime]::FromFileTime(([Int64] ((Get-ItemProperty -Path "Registry::HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}").startTimeHi) -shl 32) -bor ((Get-ItemProperty -Path "Registry::HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy\State\Machine\Extension-List\{00000000-0000-0000-0000-000000000000}").startTimeLo))
    $lastGPUpdateDate = Get-Date ($gpResult[0])
    [int]$lastGPUpdateDays = (New-TimeSpan -Start $lastGPUpdateDate -End (Get-Date)).Days

    if ($lastGPUpdateDays -eq 0){
        Write-Host "gpupdate completed successfully"
        exit 0
    }
    else{
        Write-Host "gpupdate failed"
        }
}
catch{
    $errMsg = $_.Exception.Message
    return $errMsg
    exit 1
}

後續步驟

關於部署腳本套件的資訊，請參見 修復（Remediations）。

  • Last updated on