Deploying apps to fix zero-day issues

The Toolkit Tips & Tricks
1

I thought I'd share this with others in the community here, in case it is useful.

With a perceivable increase in software updates to fix Zero-Day security threats in earlier versions of software, I wanted to change our default 3 deferrals for all deployments.
About 18 months ago (while we were still using PSADT 3.x), I raised a feature request via GitHub, so see if it would be possible to expose the Deferrals as a command line option, so I didn't have to change the script manually and repackage each time a zero-day issue was published. The PSADT developers gave me some very helpful advice / suggestions, which I would take away and see if I could get them to work.

The Aim...

I wanted to add a -DeferTimes parameter to the Command Line, which I can use when a new software version needs to be installed more urgently.
This would allow me to set the defer times to zero, effectively removing the defer times for this package.
Anyhow, many months later, I invested some time this week to get this working.

What I did to achieve this

In the param block at the top of the Invoke-AppDeployToolkit.ps1 script, add the following (remember to include a comma after the previous 'last' parameter :wink:)

[Parameter(Mandatory = $false)]
[Int32]$DeferTimes = 3

This will set the default number of deferrals to 3, so if I choose not to pass the -DeferTimes parameter on the command line, the app will default to giving the user up to 3 deferrals before the app must be installed.

I also modified the DeferTimes line into my $saiwParams block(s) - I had 'defaulted' it to DeferTimes = 3 previously):

$saiwParams = @{
        AllowDeferCloseProcesses = $true
        DeferTimes = $DeferTimes
        CheckDiskSpace = $true
        PersistPrompt = $true
        BlockExecution = $true
    }
    if ($adtSession.AppProcessesToClose.Count -gt 0)
    {
        $saiwParams.Add('CloseProcesses', $adtSession.AppProcessesToClose)
    }
    Show-ADTInstallationWelcome @saiwParams

    ## Show Progress Message (with the default message).
    Show-ADTInstallationProgress

N.B. I have 2 (identical) $saiwParams blocks in my scripts, one in the Pre-Install section and one in the Pre-Uninstall section.
To deploy an app wrapped in PSADT using these code additions, I can now either set the install command as follows for no deferrals:

.\Invoke-AppDeployToolkit.exe -DeploymentType Install -DeferTimes 0

or set the uninstall command as follows for no deferrals:

.\Invoke-AppDeployToolkit.exe -DeploymentType Uninstall -DeferTimes 0

This allows me to update (or remove) out of date software containing a zero day security threats, with less opportunity for users delaying this. :tada:

FYI: Using our 'standard' PSADT install command line

.\Invoke-AppDeployToolkit.exe -DeploymentType Install

Will result in users continuing to receive up to 3 deferrals before the software is installed, this can obviously be adjusted via the main param block if we choose to change it in the future.

5 Likes