script to alert if 'Run task as soon as possible after scheduled start is missed' is enabled for given Scheduled TaskName

Download JSON Download Python

Ratings

(0)

Release Time

09/22/2023

Downloads

275 times

Update Time

11/19/2024

Views

509 times

Share-it:

Tags

Task Scheduler

Description
Screen Shots

!!! NOTE: give the scheduled TaskName in the "TaskName" variable in the script for which you want to check 'Run task as soon as possible after scheduled start is missed' is enabled or disabled and alert if it is enabled.

This is the Custom Monitoring Script which is used to check whether the 'Run task as soon as possible after scheduled start is missed' is enabled or disabled for the given Scheduled TaskName. if it is enabled, the script will alert.

Run the script as custom monitoring

https://wiki.comodo.com/frontend/web/topic/how-to-use-custom-script-procedure-monitoring

You need to Run the Script auto-remediation alert on Run below procedure:(refer the below image)

Refer the below wiki link for Auto remediation alert Configurations:
https://wiki.comodo.com/frontend/web/topic/how-to-configure-alerts

Note:

Please Do not Use the Script as Normal Procedure

The below-mentioned script is Auto Remediation Procedure its Only for the above Custom monitoring script.

Before running the custom monitoring you need to import below-mentioned auto-remediation procedure in normal proceed

This script could be used as an custom monitoring procedure for the below auto-remediation script.

https://scripts.itarian.com/frontend/web/topic/script-to-disable-run-task-as-soon-as-possible-after-scheduled-start-is-missed-for-given-scheduled-taskname

this script has been scanned with virustotal.com and xcitium verdict cloud.

PYTHON SCRIPT FILE SHA1 VALUE - da85f0938a1b7aac3ed00db1f680a3e717686c8d

JSON FILE SHA1 VALUE - f044c1e3bfc41252a590f2484f011dbc8dc2294a

Procedure's Instructions

TaskName = r"COMODO Scan {2BC1F438-A318-4CCC-A065-86425D4B75E5}" #give here the scheduled TaskName

import os
from subprocess import PIPE, Popen
import ctypes

class disable_file_system_redirection:
    _disable = ctypes.windll.kernel32.Wow64DisableWow64FsRedirection
    _revert = ctypes.windll.kernel32.Wow64RevertWow64FsRedirection
    def __enter__(self):
        self.old_value = ctypes.c_long()
        self.success = self._disable(ctypes.byref(self.old_value))
    def __exit__(self, type, value, traceback):
        if self.success:
            self._revert(self.old_value)

class ExecutionPolicy:
    def __enter__(self):
        with disable_file_system_redirection():
            #getting current executionpolicy
            self.old_policy = os.popen('powershell "Get-ExecutionPolicy"').read().strip()
            #setting execution policy to RemoteSigned
            os.popen('powershell "Set-ExecutionPolicy RemoteSigned"').read()
    def __exit__(self, type, value, traceback):
        with disable_file_system_redirection():
            #setting execution policy back to previous policy
            os.popen('powershell "Set-ExecutionPolicy %s"'%(self.old_policy)).read()

def alert(arg):
    sys.stderr.write("%d%d%d" % (arg, arg, arg))

def ecmd(command):   
    from subprocess import Popen, PIPE
    import ctypes
    
    with disable_file_system_redirection():
        obj = Popen(command, shell = True, stdout = PIPE, stderr = PIPE)
    out, err = obj.communicate()
    ret=obj.returncode
    return ret,out,err

PScontent = """
$Task = Get-ScheduledTask -TaskName "%s"
$Flag = $Task.Settings.StartWhenAvailable
$Flag
"""%TaskName

ps_name='powershell_file.ps1'
ps_path=os.path.join(os.environ['TEMP'], ps_name)
with open(ps_path, 'wb') as wr:
    wr.write(PScontent)
    
with ExecutionPolicy():      
    ret,out,err = ecmd('powershell "%s"'%ps_path)
    
if ret==0:
    if out:
        if out.strip().lower()=="true":
            print("'Run task as soon as possible after scheduled start is missed' is enabled for the taskname - '%s'"%(TaskName))
            alert(1)
        elif out.strip().lower()=="false":
            print("'Run task as soon as possible after scheduled start is missed' is disabled for the taskname - '%s'"%(TaskName))
            alert(0)
    else:
        print("couldn't find 'Run task as soon as possible after scheduled start is missed' is enabled or disabled for the taskname - '%s'"%(TaskName))
else:
    print(err)
    alert(0)

Comments

No Comments.

script to alert if 'Run task as soon as possible after scheduled start is missed' is enabled for given Scheduled TaskName

Comments

Leave a Comment