Tuesday, November 26, 2013

Recipe: last MSI installed on a computer

This is a PoC of Powershell script to monitor MSIs installed packages in the local machine, it is ready to run every 5 minutes and launches an action if anything is installed in this period of time.


 #Deploy as 5 minutes management task.  
  $softinst=Get-EventLog application -InstanceId 1033 -Source MsiInstaller -Before ([System.DateTime]::Now) -After ([System.DateTime]::Now).AddMinutes(-5)  
  if ($softinst -eq $null)  
  {  
   Write-Host "No new software installed in the last 5 minutes"  
  }  
  else{   
  #Skip autoupdates  
  if ($_.Message -notcontains "Microsoft Endpoint"){  
  #Action  
  }  
  }  

You can run it as scheduled task and send email as action to control every 5 minutes which are the new MSI packages installed in one machine.
You can deploy it across domain using GPO and scheduled task ( http://technet.microsoft.com/en-us/library/cc725745.aspx ) using powershell.exe with parameter -command{} and invoke-command{\\UNC\scripts}
Remember the execution policy, you can manage it with GPO in Computer Configuration | Administrative Templates | Windows Components | Windows PowerShell and configure the Turn On Script Execution setting

No comments:

Post a Comment