Automated Uninstall of Unauthorized Applications

After reading Asadeh's how-to on remotely uninstalling applications via a report drill down, I got the itch to automate the uninstall for black listed software already in my environment. Here is the result...

Create the Uninstall Task

Click to view.

Open Tasks, Right click > New > Task/Job

Select Script
Name: App Uninstall Script
Script Type: VBScript

Enter this slightly modified copy of Asadeh's vbscript in the content pane;

dim uninstallcmd
uninstallcmd = lcase(%!input2!%)
if instr(uninstallcmd, "msiexec") > 0 then
  first=instr(uninstallcmd, "{")
  last=instr(uninstallcmd, "}")
  prodguid=mid(uninstallcmd, first, last)
  newcommand="msiexec.exe /x" + prodguid + " /quiet /lv " + "%temp%\" + prodguid + ".log"
  Set WshShell = WScript.CreateObject( "WScript.Shell" )
'  WshShell.Run newcommand
  WshShell.Exec newcommand

else
  Set WshShell = WScript.CreateObject( "WScript.Shell" )
  newcommand = chr(34)+uninstallcmd+chr(34)
  WshShell.Run newcommand
end if

As discussed in Asadeh's original article this task can be accessed via URL;

 http://localhost/Altiris/TaskManagement/taskaccess.aspx
?taskAccessRequestType=startTask&taskAccessTaskGuid=0da5ac47-38d5-43c8-b594-2bed885b4ed5&taskAccessInstancename=&INPUT2="%UninstallPath%"
&@AssignedResources=%ResourceGuid%

Knowing this we can now create a Notification Policy that will assign resources to this task passing everything via URL.

Click to view.

Right Click > New > Notification Policy
Name: Remove Google Toolbar
Source: Query
Click "Edit Query"

SELECT T0.[Name] AS 'Name',  
T0.[Version] AS 'Version',  
replace(T0.[Uninstall Path],char(34),'') AS 'UninstallPath',  
T1.[Name] AS 'PC Name',  
T1.[_ResourceGuid] AS 'ResourceGuid'  
FROM  
[Inv_AeX_AC_Identification] T1  
INNER JOIN  
[Inv_AeX_OS_Add_Remove_Programs] T0 ON T1.[_ResourceGuid] = T0.[_ResourceGuid]  
WHERE T0.[Name] like %targetApp%

Local Parameters:
Name: targetApp
Type: Basic
Value: '%google toolbar%'
Enable Schedule: Once

Select "Launch Automated Action" and hit add, then hit the pencil to edit.

Name: Execute Uninstall
Enabled: check
Execute: Once Per Row
Application: d:\taskpost.vbs "%DS:UninstallPath%" "&@AssignedResources=%DS:ResourceGuid%"

Originally I tried using IE as the application but noticed a hidden IE window would remain under AeXSVC.exe as confirmation. So I wrote up a vbs to do this dirty work for me. The Application string reflects the location on your NS.

Option Explicit
Dim oHTTP, url, data1, data2, task, allheaders
'Set oHTTP = CreateObject("Microsoft.XMLHTTP")
Set oHTTP = CreateObject("MSXML2.ServerXMLHTTP")
task = "?taskAccessRequestType=startTask&taskAccessTaskGuid=0da5ac47-38d5-43c8-b594-2bed885b4ed5&taskAccessInstancename=&INPUT2="

If Wscript.Arguments.Count = 0 Then
		WScript.Quit [9000]
Else
     data1 = Chr(34) & WScript.arguments(0)
     data2 = Chr(34) & WScript.Arguments(1)
End If

'%DS:UninstallPath% "&@AssignedResources=%DS:ResourceGuid%"
url = "http://localhost/Altiris/TaskManagement/taskaccess.aspx" & task & data1 & data2

oHTTP.open "GET", url, False
oHTTP.send

'WScript.Echo oHTTP.responseText
Set oHTTP = nothing

As you can see this VBS requires msxml2.

It may also be nice to see results in your inbox.

Select "Email Automated Action" click add, then hit pencil.

Name: Notification of Uninstall Action Taken
Enabled: Checked
To: enter@email.com
Subject: Notification of Uninstall Action Taken
Message: %Results%

This will email us the results of the query we made several steps ago.

With that you can just clone the notification policy and edit the targetApp parameter.

Thanks to Asadeh for a great start. A zip of the Notification policy and Task are attached.

If any of this somehow strands you back to 1955 and you need to time a lightening strike perfectly to pump your flux capacitor full of power the moment your Delorian hits 88mph because your mom was hitting on you and your body starts to disappear due to gross neglect of the time space continuum, it's not my fault! Please, do share any feedback.