Group Policy ile AnyDesk Uninstall Etmek

Merhaba, malumunuz AnyDesk hack’lendi ve parolalar dahil bir çok kullanıcı verileri çalındı bunu yanınıda codesign sertifikaları ve kaynak kodlarıda çalınmış durumda. Bu nedenle organizasyonlarınızda AnyDesk kullanmak büyük risk taşıyor. Bildiğiniz üzeri AnyDesk kullanmayayan kurum neredeyse yok gibi. Eminim bir çoğunuz firewall ve diğer güvenlik yazılımlarınız ile AnyDesk erişimlerini engellediğiniz ancak bu yeterli değil, sistemleriniz üzerinde de kaldırmanız gerekiyor. Bu makalede Active Directory ortamlarında GPO kullanarak AnyDesk’i nasıl ortamdan tamamen kaldırabiliriz bunu inceleyeceğiz.

Hadi hemen başlıyalım!

İlk olarak bazı scriptlere ihtiyacımız var. Bu nedenle bu adresten “https://github.com/PSAppDeployToolkit/PSAppDeployToolkit/releases/download/3.8.4/PSAppDeployToolkit_v3.8.4.zip” scriptlerin olduğu zip file’i indiriyoruz.

İkinic olarak aşağıdaki powershell script dosyasını “Uninstall-AnyDesk.ps1” olarak kaydediyoruz.

<#
.SYNOPSIS
    This script performs the uninstallation of AnyDesk.
    # LICENSE #
    PowerShell App Deployment Toolkit - Provides a set of functions to perform common application deployment tasks on Windows.
    Copyright (C) 2017 - Sean Lillis, Dan Cunningham, Muhammad Mashwani, Aman Motazedian.
    This program is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
    You should have received a copy of the GNU Lesser General Public License along with this program. If not, see <http://www.gnu.org/licenses/>.
.DESCRIPTION
    The script is provided as a template to perform an install or uninstall of an application(s).
    The script either performs an "Install" deployment type or an "Uninstall" deployment type.
    The install deployment type is broken down into 3 main sections/phases: Pre-Install, Install, and Post-Install.
    The script dot-sources the AppDeployToolkitMain.ps1 script which contains the logic and functions required to install or uninstall an application.
.PARAMETER DeploymentType
    The type of deployment to perform. Default is: Install.
.PARAMETER DeployMode
    Specifies whether the installation should be run in Interactive, Silent, or NonInteractive mode. Default is: Interactive. Options: Interactive = Shows dialogs, Silent = No dialogs, NonInteractive = Very silent, i.e. no blocking apps. NonInteractive mode is automatically set if it is detected that the process is not user interactive.
.PARAMETER AllowRebootPassThru
    Allows the 3010 return code (requires restart) to be passed back to the parent process (e.g. SCCM) if detected from an installation. If 3010 is passed back to SCCM, a reboot prompt will be triggered.
.PARAMETER TerminalServerMode
    Changes to "user install mode" and back to "user execute mode" for installing/uninstalling applications for Remote Destkop Session Hosts/Citrix servers.
.PARAMETER DisableLogging
    Disables logging to file for the script. Default is: $false.
.EXAMPLE
    PowerShell.exe .\Uninstall-AnyDesk.ps1 -DeploymentType "Uninstall" -DeployMode "NonInteractive"
.EXAMPLE
    PowerShell.exe .\Uninstall-AnyDesk.ps1 -DeploymentType "Uninstall" -DeployMode "Silent"
.EXAMPLE
    PowerShell.exe .\Uninstall-AnyDesk.ps1 -DeploymentType "Uninstall" -DeployMode "Interactive"
.NOTES
    Toolkit Exit Code Ranges:
    60000 - 68999: Reserved for built-in exit codes in Deploy-Application.ps1, Deploy-Application.exe, and AppDeployToolkitMain.ps1
    69000 - 69999: Recommended for user customized exit codes in Deploy-Application.ps1
    70000 - 79999: Recommended for user customized exit codes in AppDeployToolkitExtensions.ps1
.LINK
    http://psappdeploytoolkit.com
#>
[CmdletBinding()]Param (
    [Parameter(Mandatory=$false)]    [ValidateSet('Install','Uninstall','Repair')]    [string]$DeploymentType = 'Install',
    [Parameter(Mandatory=$false)]    [ValidateSet('Interactive','Silent','NonInteractive')]    [string]$DeployMode = 'Interactive',
    [Parameter(Mandatory=$false)]    [switch]$AllowRebootPassThru = $false,
    [Parameter(Mandatory=$false)]    [switch]$TerminalServerMode = $false,
    [Parameter(Mandatory=$false)]    [switch]$DisableLogging = $false
)

Try {
    ## Set the script execution policy for this process
    Try { Set-ExecutionPolicy -ExecutionPolicy 'ByPass' -Scope 'Process' -Force -ErrorAction 'Stop' } Catch {}

    ##*===============================================
    ##* VARIABLE DECLARATION
    ##*===============================================
    ## Variables: Application
    [string]$appVendor = ''
    [string]$appName = 'AnyDesk Uninstall'
    [string]$appVersion = ''
    [string]$appArch = ''
    [string]$appLang = ''
    [string]$appRevision = ''
    [string]$appScriptVersion = '1.0.0'
    [string]$appScriptDate = 'XX/XX/20XX'
    [string]$appScriptAuthor = 'Jason Bergner'
    ##*===============================================
    ## Variables: Install Titles (Only set here to override defaults set by the toolkit)
    [string]$installName = ''
    [string]$installTitle = 'AnyDesk Uninstall'

    ##* Do not modify section below
    #region DoNotModify

    ## Variables: Exit Code
    [int32]$mainExitCode = 0

    ## Variables: Script
    [string]$deployAppScriptFriendlyName = 'Deploy Application'
    [version]$deployAppScriptVersion = [version]'3.8.4'
    [string]$deployAppScriptDate = '26/01/2021'
    [hashtable]$deployAppScriptParameters = $psBoundParameters

    ## Variables: Environment
    If (Test-Path -LiteralPath 'variable:HostInvocation') { $InvocationInfo = $HostInvocation } Else { $InvocationInfo = $MyInvocation }
    [string]$scriptDirectory = Split-Path -Path $InvocationInfo.MyCommand.Definition -Parent

    ## Dot source the required App Deploy Toolkit Functions
    Try {
        [string]$moduleAppDeployToolkitMain = "$scriptDirectory\AppDeployToolkit\AppDeployToolkitMain.ps1"
        If (-not (Test-Path -LiteralPath $moduleAppDeployToolkitMain -PathType 'Leaf')) { Throw "Module does not exist at the specified location [$moduleAppDeployToolkitMain]." }
        If ($DisableLogging) { . $moduleAppDeployToolkitMain -DisableLogging } Else { . $moduleAppDeployToolkitMain }
    }
    Catch {
        If ($mainExitCode -eq 0){ [int32]$mainExitCode = 60008 }
        Write-Error -Message "Module [$moduleAppDeployToolkitMain] failed to load: `n$($_.Exception.Message)`n `n$($_.InvocationInfo.PositionMessage)" -ErrorAction 'Continue'
        ## Exit the script, returning the exit code to SCCM
        If (Test-Path -LiteralPath 'variable:HostInvocation') { $script:ExitCode = $mainExitCode; Exit } Else { Exit $mainExitCode }
    }

    #endregion
    ##* Do not modify section above
    ##*===============================================
    ##* END VARIABLE DECLARATION
    ##*===============================================

    If ($deploymentType -ine 'Uninstall' -and $deploymentType -ine 'Repair') {
        ##*===============================================
        ##* PRE-INSTALLATION
        ##*===============================================
        [string]$installPhase = 'Pre-Installation'
   
        ##*===============================================
        ##* INSTALLATION
        ##*===============================================
        [string]$installPhase = 'Installation'
       
        ##*===============================================
        ##* POST-INSTALLATION
        ##*===============================================
        [string]$installPhase = 'Post-Installation'

    }
    ElseIf ($deploymentType -ieq 'Uninstall')
    {
        ##*===============================================
        ##* PRE-UNINSTALLATION
        ##*===============================================
        [string]$installPhase = 'Pre-Uninstallation'

        ## Show Welcome Message, Close AnyDesk With a 60 Second Countdown Before Automatically Closing
        Show-InstallationWelcome -CloseApps 'AnyDeskMSI,AnyDesk' -CloseAppsCountdown 60

        ## Show Progress Message (With a Message to Indicate the Application is Being Uninstalled)
        Show-InstallationProgress -StatusMessage "Uninstalling Any Existing Versions of AnyDesk. Please Wait..."

        ##*===============================================
        ##* UNINSTALLATION
        ##*===============================================
        [string]$installPhase = 'Uninstallation'

        ## Remove Any Existing AnyDesk Portable EXE or MSI Installer
        $FileName = @("AnyDesk.exe","AnyDesk.msi"); Get-ChildItem -Path "C:\Users" -Include $FileName -Recurse | Remove-Item -Force -ErrorAction SilentlyContinue

        ## Uninstall Any Existing Versions of AnyDesk (MSI)
        Remove-MSIApplications -Name "AnyDesk MSI"

        ## Uninstall Any Existing Version of AnyDesk (EXE)
        $AppList = Get-InstalledApplication -Name 'AnyDesk'        
        ForEach ($App in $AppList)
        {
        If($App.UninstallString)
        {
        $InstallDir = $App.InstallLocation
        $UninstPath = $($App.UninstallString).Replace('"','').Replace('--uninstall','')        
        If(Test-Path -Path $UninstPath)
        {
        Write-Log -Message "Found $($App.DisplayName) $($App.DisplayVersion) and a valid uninstall string, now attempting to uninstall AnyDesk."
        Execute-Process -Path $UninstPath -Parameters '--silent --remove' -WindowStyle Hidden
        Get-Process -Name "AnyDesk" -ErrorAction SilentlyContinue | Wait-Process
        Remove-Item -Path "$InstallDir" -Force -Recurse -ErrorAction SilentlyContinue
        }
        }
        }

        ##*===============================================
        ##* POST-UNINSTALLATION
        ##*===============================================
        [string]$installPhase = 'Post-Uninstallation'


    }
    ElseIf ($deploymentType -ieq 'Repair')
    {
        ##*===============================================
        ##* PRE-REPAIR
        ##*===============================================
        [string]$installPhase = 'Pre-Repair'

        ##*===============================================
        ##* REPAIR
        ##*===============================================
        [string]$installPhase = 'Repair'


        ##*===============================================
        ##* POST-REPAIR
        ##*===============================================
        [string]$installPhase = 'Post-Repair'


    }
    ##*===============================================
    ##* END SCRIPT BODY
    ##*===============================================

    ## Call the Exit-Script function to perform final cleanup operations
    Exit-Script -ExitCode $mainExitCode
}
Catch {
    [int32]$mainExitCode = 60001
    [string]$mainErrorMessage = "$(Resolve-Error)"
    Write-Log -Message $mainErrorMessage -Severity 3 -Source $deployAppScriptFriendlyName
    Show-DialogBox -Text $mainErrorMessage -Icon 'Stop'
    Exit-Script -ExitCode $mainExitCode
}

Sonrasında aşağıdaki kod dosyalarını “anydeskuninstall.bat” olarak kaydediyoruz.

@ECHO OFF

if not exist "C:\anydesk" md "C:\anydesk"
COPY /Y "%~dp0PSAppDeployToolkit_v3.8.4.zip" C:\anydesk
COPY /Y "%~dp0Uninstall-AnyDesk.ps1" C:\anydesk
COPY /Y "%~dp0action.ps1" C:\anydesk

powershell.exe -ExecutionPolicy Bypass -Command "c:\anydesk\action.ps1"

Son bir ps script dosyası daha oluşturup “action.ps1” olarak kaydediyoruz.

Unblock-File -Path c:\anydesk\PSAppDeployToolkit_v3.8.4.zip
Expand-Archive -Path c:\anydesk\PSAppDeployToolkit_v3.8.4.zip -DestinationPath c:\anydesk\PADT
Copy-Item -Path "c:\anydesk\PADT\Toolkit\AppDeployToolkit" -Destination "c:\anydesk\Uninstall-AnyDesk\AppDeployToolkit" -Recurse
Move-Item C:\anydesk\Uninstall-AnyDesk.ps1 -Destination c:\anydesk\Uninstall-AnyDesk\
Powershell.exe -ExecutionPolicy Bypass  "C:\anydesk\Uninstall-AnyDesk\Uninstall-AnyDesk.ps1" -DeploymentType "Uninstall" -DeployMode "Silent"
Start-Sleep -Seconds 20
Remove-Item -Path C:\anydesk -Recurse

Hazırladığımız tüm dosyaların son görünümü aşağıdaki gibi oluyor.

Şimdi yeni bir GPO oluşturuyoruz ve script olarak ekliyoruz.

Gelen ekranda “Show Files“‘a tıklayarak tüm oluşturduğumuz dosyaları “startup“‘ kopyalıyoruz.

Şimdi “Add” butonuna tıklayarak “anydeskuninstall.bat” dosyasını gösteriyoruz.

Son olarak hangi OU’lara uygulanmasını istiyorsak GPO’u linkliyoruz.

Bu adımdan sonra bilgisayar her açılısında aşağıdaki adımları sırayla ugulayacak.

• “C” dizi altına “anydesk” adında bir klasör oluşturulacak.
• Tüm gerekli dosyalar bu dizin altına kopyalacak.
• “PSAppDeployToolkit_v3.8.4.zip” dosyası extract edilerek “Uninstall-AnyDesk” adında bir klasör oluşturacak. Sonrasında “AppleDeployToolKit” ve “Uninstall-Anydesk.ps1” adında klasör ve scrpti bu klasör altında taşıyacak.

Bu aşamdan sonra “action.ps1” adında script çalışacak ve “Uninstall-Anydesk.ps1“‘i çalıştırarak sistem üzerindeki “AnyDesk“‘e ait ne varsa kaldırayacak sonrasında 20sn bekleyerek oluşturduğu herşeyi silecek.

Bu işlem kullanıcıların yada saldırganların sisteme yeniden AnyDesk’i kurma çabalarının önüne geçecek.

Faydalı olması dileği ile kolaylıklar.

Kaynak: https://silentinstallhq.com/anydesk-silent-uninstall-powershell/?expand_article=1