You are using an ad blocker that is interfering with our web typography and internal javascript. Please whitelist our domain to live in a more beautiful world. No ads here, just really great software!
cookie alert

We use cookies to offer you a better browsing experience, analyze site traffic, personalize content, and serve targeted advertisements. If you continue to use this site, you consent to our use of cookies.

Nexthink Library

Device Compliance Advanced

Latest Version: 1.0.0.0
Install
Configuration

Required Modules

Nexthink Act
Nexthink Engage
Nexthink Enhance

Platforms

Windows only

Compatibility

V6.9 and later

Description

In addition to the content provided in the Device Compliance pack, the Device Compliance Advanced pack also provides a set of Remote Action that will help you:

  • Retrieve an unique fingerprint from installed Trust Root Certificate Authorities, HOSTS file, Samba configuration and LAN Manager.
  • Authentication level to ensure if devices are in accordance with company policy.
  • Current status of Windows Security Center components.
  • Delete unwanted certificates from Trust Root Certificate Authorities.

There are some compliance aspects that will function immediately that the pack is installed and some that require a small amount of configuration.

This pack also uses Scores which must be configured by Nexthink Professional Services or by a certified Nexthink partner.

Screenshots

Versions

  • 1.0.0.0 - 14 May 2020 - Initial release

Disable SMB1

Script Description

ADVANCED SCRIPTDisables SMB1 network protocol and prints script execution result in 'Execution status details' field. The script is designed for Windows 10 and 7.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
Campaign Id UID of the Disable SMB1 campaign. It informs user that their device should be manually rebooted to apply system changes

Outputs

None.

Further Information

Before disabling SMB1 network protocol, confirm that devices in your network are not actively using it. Device reboot is required to disable SMB1 protocol. The script informs user, using campaign, that the device should be manually rebooted.

Get SMB1 Status

Script Description

Obtains SMB1 network protocol status and prints it in 'Execution status details' field. The script is designed for Windows 10 and 7.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

None.

Further Information

Before disabling SMB1 network protocol, confirm that devices in your network are not actively using it. SMB1 network protocol is enabled on all Windows 7 editions and Windows 10 releases before 1709. SMB1 protocol can be disabled by GPO setting or Nexthink Act script 'Disable-SMB1'.

Get Windows Security Center Health Status

Script Description

Returns information about health status of Windows Security Center components, that includes Firewall, AutoUpdate,

AntiVirus, AntiSpyware, InternetSettings, UserAccountControl and Windows Security Center monitoring service. Possible values are:

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
Anti Spyware Status String The aggregation of all anti-spyware products for target device
Anti Virus Status String The aggregation of all antivirus products for target device
Auto Update Status String The automatic update settings for target device
Firewall Status String The aggregation of all firewalls for target device
Internet Settings Status String The settings that restrict the access of web sites in each of the Internet zones for target device
User Account Control Status String The User Account Control settings for target device
Security Center Service Status String The running state of the Windows Security Center service on target device

Get NTLM Authentication Level

Script Description

Retrieves the NTLM authentication level to verify if devices are using NTLMv2 authentication.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

None.

Further Information

The Network security: NTLM authentication level setting determines which challenge/response authentication protocol is used for network logons.
Check the possible list of security levels and their behavior here.

HOSTS file integrity check

Script Description

Returns the hash of the HOSTS file, as well as a list containing all entries.Useful for retrieving a unique fingerprint from all devices to ensure that the HOSTS file is in accordance with company policy.A Finder investigation should be used to compare the retrieved fingerprints against that of a known, trusted device.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
Hosts File Entries Hash String Hash of the HOSTS file
Hosts File Entries StringList List of entries of the HOSTS file

Trusted Root Certification Authorities certificate store integrity check

Script Description

Returns the hash of the Trusted Root Certification Authorities certificate store, as well as a list containing all their thumbprints.Useful for retrieving a unique fingerprint from all devices to ensure that the installed Trust Root Certificate Authorities are in accordance with company policy.A Finder investigation should be used to compare the retrieved fingerprints against that of a known, trusted device.

Execution context and suggested scheduling

Run the script as 'interactive user'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

None.

Outputs

Label Type Description
Root CAs Hash String Hash of the Trusted Root Certification Authorities certificate store
Root CAs Thumbprints StringList List of thumbprints for the Trusted Root Certification Authorities
Other Root CAs Thumbprints StringList Continuation list of thumbprints (used only if character count exceeded 1020)

Remove Certificates

Script Description

Deletes a specific certificate based on a thumbprint provided by the user in order to avoid badly deployed certificates.

Execution context and suggested scheduling

Run the script as 'local system'. The script should be executed manually.

A timeout of 120 seconds is recommended.

Parameters

Label Description
Thumbprint Thumbprint

Outputs

None.

Further Information

DISCLAIMER - The removal of certain key CAs could potentially harm your machine. Use with caution.

Thank you!