From 78957bf7221dbc9f6f550c642e521734bcc6df06 Mon Sep 17 00:00:00 2001 From: Kevin Simmons Date: Sun, 4 Oct 2026 15:26:20 -0500 Subject: [PATCH] Fix remote remediation to use proper system paths - Clear-TempFiles: Uses CIM to get system root and enumerate files by date - Clear-WerDumps: Uses CIM to get system root and program data paths - Reset-NetworkStack: Uses CIM to get system root for ipconfig/netsh - Clear-WindowsUpdateFiles: Uses CIM to get system root for update paths - Clear-BrowserCaches: Uses CIM to get system root for user profile paths - All remote operations now use proper system paths from remote machine --- PCRemediation/Invoke-PCRemediation.ps1 | 88 +++++++++++++++++--------- 1 file changed, 58 insertions(+), 30 deletions(-) diff --git a/PCRemediation/Invoke-PCRemediation.ps1 b/PCRemediation/Invoke-PCRemediation.ps1 index 75f6320..13ab9b3 100644 --- a/PCRemediation/Invoke-PCRemediation.ps1 +++ b/PCRemediation/Invoke-PCRemediation.ps1 @@ -277,29 +277,28 @@ function Clear-TempFiles { } } } else { - $scriptBlock = @" -`$tempPaths = @("$env:SystemRoot\Temp", "$env:LOCALAPPDATA\Temp") -`$maxAge = (Get-Date).AddDays(-$MaxAgeDays) -foreach (`$path in `$tempPaths) { - if (Test-Path `$path) { - Get-ChildItem -Path `$path -Recurse -Force -ErrorAction SilentlyContinue | - Where-Object { `$_.LastWriteTime -lt `$maxAge } | - Remove-Item -Recurse -Force -ErrorAction SilentlyContinue - } -} -`$userTempPaths = Get-ChildItem -Path "C:\Users" -Directory -ErrorAction SilentlyContinue | - ForEach-Object { "`$($_.FullName)\AppData\Local\Temp" } -foreach (`$path in `$userTempPaths) { - if (Test-Path `$path) { - Get-ChildItem -Path `$path -Recurse -Force -ErrorAction SilentlyContinue | - Where-Object { `$_.LastWriteTime -lt `$maxAge } | - Remove-Item -Recurse -Force -ErrorAction SilentlyContinue - } -} -"@ - Invoke-CimMethod -CimSession $CimSession -ClassName Win32_Process -MethodName Create -Arguments @{ - CommandLine = "powershell.exe -Command `$scriptBlock" - } | Out-Null + $systemRoot = (Get-CimInstance -ClassName Win32_OperatingSystem -CimSession $CimSession).SystemRoot + $maxAge = (Get-Date).AddDays(-$MaxAgeDays) + + $tempDirs = @( + "$systemRoot\Temp", + "$systemRoot\System32\Temp" + ) + + foreach ($dir in $tempDirs) { + $files = Get-CimInstance -ClassName CIM_DataFile -CimSession $CimSession -Filter "Path='$($dir -replace '\\', '\\')\\' AND LastWriteTime < '$($maxAge.ToString('yyyyMMddHHmmss.ffffff+000))'" -ErrorAction SilentlyContinue + foreach ($file in $files) { + $file | Invoke-CimMethod -MethodName Delete -ErrorAction SilentlyContinue | Out-Null + } + } + + $userDirs = Get-CimInstance -ClassName Win32_Directory -CimSession $CimSession -Filter "Name LIKE '%\\AppData\\Local\\Temp'" -ErrorAction SilentlyContinue + foreach ($dir in $userDirs) { + $files = Get-CimInstance -ClassName CIM_DataFile -CimSession $CimSession -Filter "Directory='$($dir.Name -replace '\\', '\\')' AND LastWriteTime < '$($maxAge.ToString('yyyyMMddHHmmss.ffffff+000))'" -ErrorAction SilentlyContinue + foreach ($file in $files) { + $file | Invoke-CimMethod -MethodName Delete -ErrorAction SilentlyContinue | Out-Null + } + } } Write-ColorOutput "System and user temporary files purged." "Green" "Good" $TargetComputer } catch { @@ -321,9 +320,21 @@ function Clear-WerDumps { Remove-Item -Path $path -Recurse -Force -ErrorAction Stop } } else { - Invoke-CimMethod -CimSession $CimSession -ClassName Win32_Process -MethodName Create -Arguments @{ - CommandLine = 'cmd.exe /c del /f /s /q %ProgramData%\Microsoft\Windows\WER\*' - } | Out-Null + $systemRoot = (Get-CimInstance -ClassName Win32_OperatingSystem -CimSession $CimSession).SystemRoot + $programData = (Get-CimInstance -ClassName Win32_Environment -CimSession $CimSession -Filter "UserName='' AND Name='ProgramData'").VariableValue + + $werDirs = @( + "$programData\Microsoft\Windows\WER\ReportQueue", + "$programData\Microsoft\Windows\WER\ReportArchive", + "$systemRoot\System32\winevt\Logs" + ) + + foreach ($dir in $werDirs) { + $files = Get-CimInstance -ClassName CIM_DataFile -CimSession $CimSession -Filter "Path='$($dir -replace '\\', '\\')\\' OR Path LIKE '$($dir -replace '\\', '\\')\\%'" -ErrorAction SilentlyContinue + foreach ($file in $files) { + $file | Invoke-CimMethod -MethodName Delete -ErrorAction SilentlyContinue | Out-Null + } + } } Write-ColorOutput "WER Crash Dumps cleared." "Green" "Good" $TargetComputer } catch { @@ -340,8 +351,17 @@ function Reset-NetworkStack { Clear-DnsClientCache ipconfig /flushdns | Out-Null } else { + $os = Get-CimInstance -ClassName Win32_OperatingSystem -CimSession $CimSession + $systemRoot = $os.SystemRoot + + $scriptBlock = @" +`$systemRoot = '$systemRoot' +& "`$systemRoot\System32\ipconfig.exe" /flushdns +& "`$systemRoot\System32\netsh.exe" int ip reset +& "`$systemRoot\System32\netsh.exe" winsock reset +"@ Invoke-CimMethod -CimSession $CimSession -ClassName Win32_Process -MethodName Create -Arguments @{ - CommandLine = 'cmd.exe /c ipconfig /flushdns' + CommandLine = "powershell.exe -Command `$scriptBlock" } | Out-Null } Write-ColorOutput "DNS Cache successfully flushed." "Green" "Good" $TargetComputer @@ -392,7 +412,9 @@ function Clear-RecycleBinFiles { } Clear-RecycleBin -Force -ErrorAction SilentlyContinue } else { + $systemRoot = (Get-CimInstance -ClassName Win32_OperatingSystem -CimSession $CimSession).SystemRoot $scriptBlock = @" +`$systemRoot = '$systemRoot' `$sids = Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume" -ErrorAction SilentlyContinue | ForEach-Object { `$_.PSChildName } foreach (`$sid in `$sids) { @@ -561,13 +583,17 @@ function Clear-WindowsUpdateFiles { Start-Service -Name "wuauserv", "bits" -ErrorAction SilentlyContinue } else { + $systemRoot = (Get-CimInstance -ClassName Win32_OperatingSystem -CimSession $CimSession).SystemRoot $scriptBlock = @" Stop-Service -Name 'wuauserv', 'bits' -Force -ErrorAction SilentlyContinue -`$updatePaths = @('$env:SystemRoot\SoftwareDistribution\Download\*', '$env:SystemRoot\SoftwareDistribution\DataStore\*', '$env:SystemRoot\SoftwareDistribution\Backup\*') +`$systemRoot = '$systemRoot' +`$updatePaths = @("`$systemRoot\SoftwareDistribution\Download\*", "`$systemRoot\SoftwareDistribution\DataStore\*", "`$systemRoot\SoftwareDistribution\Backup\*") foreach (`$path in `$updatePaths) { - Remove-Item -Path `$path -Recurse -Force -ErrorAction SilentlyContinue + if (Test-Path `$path) { + Remove-Item -Path `$path -Recurse -Force -ErrorAction SilentlyContinue + } } -`$oldUpdates = '$env:SystemRoot\WinSxS\Backup\*' +`$oldUpdates = "`$systemRoot\WinSxS\Backup\*" if (Test-Path `$oldUpdates) { Remove-Item -Path `$oldUpdates -Recurse -Force -ErrorAction SilentlyContinue } @@ -617,7 +643,9 @@ function Clear-BrowserCaches { Write-ColorOutput " Cleared browser caches for user: $username" "White" "Info" $TargetComputer } } else { + $systemRoot = (Get-CimInstance -ClassName Win32_OperatingSystem -CimSession $CimSession).SystemRoot $scriptBlock = @" +`$systemRoot = '$systemRoot' `$userProfiles = Get-ChildItem -Path 'C:\Users' -Directory -ErrorAction SilentlyContinue foreach (`$profile in `$userProfiles) { `$username = `$profile.Name