#Disable-ScheduledSEPTasks

<#
There are a lot of servers with enabled SEP-related tasks in Task Scheduler.
The tasks don't run because the executable doesn't exist.
Disable these tasks to clean up log noise and prevent someone from placing a malicious file in the path

Greg Beifuss
2021-08-25 12:20
#>


#Grab specific computers
$Computers = Get-ADComputer -Filter { (name -notlike "AC*") -and (name -notlike "WIFI*") -and (name -notlike "DON*") -and (Enabled -eq "True") } | Select-Object -ExpandProperty DNSHostName | Sort-Object


#Do this the Powershell 7 way
$Computers | ForEach-Object -Parallel {
    Test-Connection -ComputerName $Computer -Count 1 -Quiet -ErrorAction Stop
    Get-ScheduledTask -CimSession $_ -TaskPath "\Symantec Endpoint Protection\" }

#Do this the legacy way.
#If pingable, try to connect and disable tasks
ForEach ($Computer in $Computers) {
    # Test connection with computer
    Test-Connection -ComputerName $Computer -Count 1 -Quiet -ErrorAction Stop

    # Disable SEP tasks on machines
    $scriptblock = {Get-ScheduledTask -TaskPath "\Symantec Endpoint Protection\" | Disable-ScheduledTask}
    Invoke-Command -ComputerName $Computer -ScriptBlock $scriptblock | Out-Null
}

#Get-ScheduledRootTasks

<#
Get all scheduled tasks at the root level "\" (this is where staff typically create them and avoids OS/Application-created tasks)
Export the results to a CSV

Modified from https://github.com/exevolution/Get-AllScheduledTasks/blob/master/Get-AllScheduledTasks.ps1

Greg Beifuss
2021-08-25 12:25
#>


Function Connect-TaskScheduler {
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory = $True, ValueFromPipeline = $True)]
        [String]$ComputerName
    )

    Begin {
        $objScheduledTask = New-Object -ComObject("Schedule.Service")
    }
    Process {
        Try {
            Write-Verbose "Connecting to $ComputerName"
            $objScheduledTask.Connect("$ComputerName")
            Write-Verbose "Connected: $($objScheduledTask.Connected)"
        }
        Catch { Write-Error "Failed to connect to $ComputerName" }
    }
    End {
        Return $objScheduledTask
    }
}

Function Get-AllScheduledTasks {
    [CmdletBinding()]
    Param(
        [Parameter(Mandatory = $True)]
        [ValidateScript( { If ($_.GetType().BaseType.Name -eq "MarshalByRefObject" -and $_.Connected -eq $True) { $True }Else { Throw "Not a valid Task Scheduler connection object" } })]
        $Session,

        [Parameter(ValueFromPipelineByPropertyName = $True)]
        [ValidateNotNullOrEmpty()]
        [String[]]$Path = "\",

        [Parameter()]
        [Switch]$Recurse = $False
    )

    Begin {
        $Tasks = @()
        $Paths = @()
    }

    Process {
        $Paths += Get-TaskSchedulerPaths -Session $Session -Path $Path -Recurse:$Recurse
        $Tasks += $Paths | ForEach-Object { $_.Path | Get-TaskSchedulerTasks -Session $Session }
    }
    End {
        Return $Tasks
    }
}

Function Get-TaskSchedulerPaths {
    [CmdletBinding()]
    Param(
        [Parameter(ValueFromPipeline = $True)]
        [ValidateNotNullOrEmpty()]
        [String[]]$Path = "\",

        [Parameter(Mandatory = $True)]
        [ValidateScript( { If ($_.GetType().BaseType.Name -eq "MarshalByRefObject" -and $_.Connected -eq $True) { $True }Else { Throw "Not a valid Task Scheduler connection object" } })]
        $Session,

        [Parameter()]
        [Switch]$Recurse = $False
    )

    Begin {
        $Paths = @()
    }
    Process {
        $BasePath = $Session.GetFolder("$Path")
        $Paths += $BasePath
        $Paths += $BasePath.GetFolders(1)
        If ($Recurse) {
            ForEach ($P in $Paths) {
                If ($P -eq $BasePath) { Continue }
                Else { $Paths += Get-TaskSchedulerPaths -Session $Session -Path $P.Path -Recurse }
            }
        }
    }
    End {
        Return $Paths
    }
}

Function Get-TaskSchedulerTasks {
    [CmdletBinding()]
    Param(
        [Parameter(ValueFromPipeline = $True)]
        [ValidateNotNullOrEmpty()]
        [String[]]$Path = "\",

        [Parameter(Mandatory = $True)]
        [ValidateScript( { If ($_.GetType().BaseType.Name -eq "MarshalByRefObject" -and $_.Connected -eq $True) { $True }Else { Throw "Not a valid Task Scheduler connection object" } })]
        $Session
    )

    Begin {
        $AllTasks = @()
    }

    Process {
        $Folder = $Session.GetFolder("$Path")
        $FolderTasks = $Folder.GetTasks(0)

        ForEach ($Task in $FolderTasks) {
            If ((($Task.Path.ToCharArray() | Where-Object { $_ -eq '\' } | Measure-Object).Count -eq 1) -and ($Task | Where-Object -Property Name -NotMatch '^(SensorFramework|Optimize Start Menu|ShadowCopyVolumeUser_Feed|User_Feed|OneDrive|MicrosoftEdgeUpdateTask|GoogleUpdateTask|Adobe Acrobat Update Task)')) {
                $RunAsID = $Task | Select-Object @{Name = "RunAs"; Expression = { [xml]$xml = $_.xml ; $xml.Task.Principals.Principal.UserId } } | Select-Object -ExpandProperty RunAs -ErrorAction Stop
                If ($RunAsID -match "S-\d-(?:\d+-){1,14}\d+") {
                    Switch ($RunAsID) {
                        "S-1-5-18" { $RunAs = "LOCAL SYSTEM"; break }
                        "S-1-5-19" { $RunAs = "LOCAL SERVICE"; break }
                        "S-1-5-20" { $RunAs = "NETWORK SERVICE"; break }
                        Default {
                            Try { $RunAs = Get-ADUser -Identity $RunAsID | Select-Object -ExpandProperty SamAccountName -ErrorAction Stop }
                            Catch {
                                Try { $RunAs = Get-ADGroup -Identity $RunAsID | Select-Object -ExpandProperty SamAccountName -ErrorAction Stop }
                                Catch { $RunAs = $RunAsID }
                            }
                        }
                    }
                }
                Else { $RunAs = $RunAsID }

                $HashTable = [Ordered]@{
                    ComputerName = $Session.TargetServer
                    Name         = $Task.Name
                    RunAs        = $RunAs
                    Action       = $Task | Select-Object @{Name = "Actions"; Expression = { [xml]$xml = $_.xml ; $xml.Task.Actions.Exec.Command } } | Select-Object -ExpandProperty Actions -ErrorAction Stop
                    Arguments    = $Task | Select-Object @{Name = "Arguments"; Expression = { [xml]$xml = $_.xml ; $xml.Task.Actions.Exec.Arguments } } | Select-Object -ExpandProperty Arguments -ErrorAction Stop
                    LastRunTime  = $Task.LastRunTime
                    NextRunTime  = $Task.NextRunTime
                    TaskEnabled  = $Task.Enabled
                }
                $AllTasks += New-Object PSObject -Property $HashTable
            }
        }
    }

    End {
        Return $AllTasks
    }
}

$Tasks = @()

ForEach ($Computer in ( Get-ADComputer -Filter { (name -notlike "AC*") -and (name -notlike "WIFI*") -and (name -notlike "DON*") -and (Enabled -eq "True") } | Select-Object -ExpandProperty DNSHostName | Sort-Object)){
#ForEach ($Computer in $Computers[355..543]) {
    $Connection = Connect-TaskScheduler -ComputerName $Computer -Verbose
    Get-AllScheduledTasks -Session $Connection -Recurse | Export-CSV c:\users\gbadmin\desktop\tasks.csv -NoTypeInformation -Append
}