some of my co-workers in the company are running an executable from a network share. Since we implemented Defender ASR this file is being blocked.
Our ISO told us we need to run that file from a local source anyway so I am trying to find a solution for it.
My idea is the following:
Create a script that copies the .EXE from the network source to a local folder that is not triggering ASR and then run it. Since the executable is updated regularly from the administrator, it needs to be done every time before the user runs it, so it cant simply be copied once.
To make things easier for the customer I am trying this approach so the user does not have to copy the file themselve every now and then.
What I would do is create a powershell to copy the file then have a 10 second timeout to make sure the file is copied and run it, but this is only what I can do with my minimum powershell knowledge.
Are there any other options this could be done simple and easy and maybe have some feedback for the user so he ca see whats goin gon?
Thanks and best regards,
Stefan
Of course, what you describe could work. Just make e shortcut with the code below, and it will copy the file from the network share and after it run the program.
This solution will use the native windows progress bar. If the file exist there users need to accept the overwrite.
#region change these
$networkShare = "\\random.file.core.windows.net\filesharename"
$fileFolder = "random-folder"
$fileName = "random.exe"
$localFolder = "C:\Temp"
#endregion
$FOF_CREATEPROGRESSDLG = "&H0&"
$objShell = New-Object -ComObject "Shell.Application"
$objFolder = $objShell.NameSpace($localFolder)
$objFolder.CopyHere("$networkShare\$fileFolder", $FOF_CREATEPROGRESSDLG)
#Use the call operator to start the exe (&)
& "$localFolder\$fileFolder\$fileName"
Reference for copy progress bar: Progress during large file copy (Copy-Item & Write-Progress?)
You can check it too: CopyHere method.
If you have question feel free to ask. If it was helpful just accept the answer.