51 lines
1.6 KiB
PowerShell
51 lines
1.6 KiB
PowerShell
[CmdletBinding()]
|
|
param(
|
|
[ValidateSet("daily", "burst")]
|
|
[string]$Kind = "daily"
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
|
|
$monitorScript = Join-Path $scriptDir "run-ocsentinel-monitor.ps1"
|
|
$secretPath = "C:\ProgramData\OCSentinel\secrets\ocsentinel-upload-secret.dat"
|
|
$mutexName = "Global\OfficeComSentinelScan"
|
|
|
|
function Get-NinjaBurstEnabled {
|
|
if (Get-Command -Name "Get-NinjaProperty" -ErrorAction SilentlyContinue) {
|
|
return [bool](Get-NinjaProperty -Name "ocsentinelburst" -Type "Checkbox")
|
|
}
|
|
|
|
if (Get-Command -Name "Ninja-Property-Get" -ErrorAction SilentlyContinue) {
|
|
$value = Ninja-Property-Get -Name "ocsentinelburst"
|
|
return [string]$value -match "^(1|true|yes)$"
|
|
}
|
|
|
|
Write-Warning "Ninja custom-field reader is unavailable; burst scan skipped."
|
|
return $false
|
|
}
|
|
|
|
if ($Kind -eq "burst" -and -not (Get-NinjaBurstEnabled)) {
|
|
Write-Host "OfficeCom Sentinel burst check: disabled."
|
|
exit 0
|
|
}
|
|
|
|
$createdNew = $false
|
|
$mutex = [Threading.Mutex]::new($false, $mutexName, [ref]$createdNew)
|
|
try {
|
|
if (-not $mutex.WaitOne(0)) {
|
|
Write-Host "OfficeCom Sentinel scan skipped: another scan is already running."
|
|
exit 0
|
|
}
|
|
|
|
Write-Host "OfficeCom Sentinel scheduled $Kind scan started."
|
|
& powershell.exe -NoProfile -ExecutionPolicy Bypass -File $monitorScript -Mode status -UploadMode required -SecretPath $secretPath -SuppressTriggerExit
|
|
exit $LASTEXITCODE
|
|
}
|
|
finally {
|
|
if ($null -ne $mutex) {
|
|
try { $mutex.ReleaseMutex() } catch { }
|
|
$mutex.Dispose()
|
|
}
|
|
}
|