Introduction

This solution consists of a 'Setup' script executed on the Golden Image prior to cloning and a 'Startup' script that runs on each cloned virtual machine during system startup. The primary objective of these scripts is to ensure the proper configuration of the service while reducing manual intervention.

Setup Script

Setup Script Description

 The first script, 'Setup', is executed on the Golden Image before cloning it. It has to be manually executed just one time. Its main purpose is to establish initial configurations that will allow the following script to function correctly on the cloned virtual machines. These configurations include:

• Changing the Cisco AMP service startup to manual to avoid auto-start.
• Creating a scheduled task that executes the following script (Startup) at system startup with highest privileges.
• Creating a system environment variable called "AMP_GOLD_HOST" that stores the hostname of the Golden Image. That would be use by the Startup script to verify if we have to revert the changes

After execute the Setup Script we can verify that the configuration changes has been succesfully deployed

Since we performed this action in the golden image all the new instances will have this configuration and will execute the Startup Script at startup.

Setup script code

rem Turn AMP to manual start
sc config CiscoAMP start=demand

rem Add host name to a system variable that we can check on startup
setx -m AMP_GOLD_HOST %COMPUTERNAME%

rem Add the startup script to the startup scripts
rem /rp password when there is a password
schtasks /create /tn "Startamp" /tr "C:\Users\chmilbur\Desktop\VMWareHorizonAMPStartup.bat" /sc onstart /rl highest /np

The Setup script code is quite straightforward:

Line 2: Changes the startup type of the malware protection service to manual.

Line 5: Creates a new environment variable called "AMP_GOLD_HOST" and saves the current computer's hostname in it.

Line 9: Creates a scheduled task named "Startamp" that runs the specified 'Startup' script during system startup with the highest privileges, without needing a password.

Startup Script

Startup Script Description

The second script, 'Startup', runs on each system startup on the cloned virtual machines. Its main purpose is to check if the current machine has the hostname of the 'Golden Image':

• If the current machine is the Golden image, no action is taken and the script ends. AMP will continue running at system startup since we maintain the scheduled task.

• If the current machine is NOT the 'Golden' image, the changes made by the first script are reset:
  • Changing the Cisco AMP service startup configuration to automatic.
  • Starting the Cisco AMP service.
  • Removing the "AMP_GOLD_HOST" environment variable.
  • Deleting the scheduled task that executes the startup script and deleting the script itself.

Setup script code

echo "Current hostname: %COMPUTERNAME% vs %AMP_GOLD_HOST%"

if "%COMPUTERNAME%" == "%AMP_GOLD_HOST%" ( goto same ) else ( goto notsame )

:same
rem Do nothing as we are still the golden image name
goto exit

:notsame
rem Turn AMP to autostart 
sc config CiscoAMP start=auto

rem Turn on AMP
sc start CiscoAMP

rem Remove environment variable
REG delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /F /V AMP_GOLD_HOST
schtasks /delete /tn Startamp

goto exit
:exit

Line 2: Compares the current hostname with the stored "AMP_GOLD_HOST" value; if they are the same, the script jumps to the "same" label, otherwise, it jumps to the "notsame" label.

Line 4-6: When the "same" label is reached, the script does nothing since it is still the Golden Image and proceeds to the "exit" label.

Line 8-16: If the "notsame" label is reached, the script performs the following actions:

• Changes the startup type of the malware protection service to automatic.
• Starts the malware protection service.
• Removes the "AMP_GOLD_HOST" environment variable.
• Deletes the scheduled task named "Startamp"

Conclusion

These two scripts allow the Cisco AMP service startup in cloned virtual machine environments. By properly configuring the Golden image and using the startup scripts, it ensures that the Cisco AMP  runs on all cloned virtual machines with the correct configuration