Can a Worklet's Evaluation Code make changes to a Device?

Answer: 

Yes. Automox does not prevent PowerShell or Bash commands in the Evaluation Code from making changes to a device.

However, Evaluation Code should only inspect the device and determine whether remediation is required. Any commands that install software, modify files or registry values, restart services, or otherwise change the device should be placed in the Remediation Code.

Evaluation Code runs during a device scan, regardless of whether the Worklet is currently scheduled to remediate. Because of this, any changes included in Evaluation Code could be applied repeatedly whenever the device is scanned.

The Evaluation Code should return:

• Exit 0 when the device is compliant and no remediation is required.
• A nonzero exit code, typically Exit 1, when the device requires remediation.

Example

The following Evaluation Code checks whether a registry value is configured but does not modify it:

$path = "HKLM:\SOFTWARE\Example"
$name = "Enabled"

if ((Get-ItemProperty -Path $path -Name $name -ErrorAction SilentlyContinue).$name -eq 1) {
    Write-Output "The required registry value is configured."
    Exit 0
}

Write-Output "The required registry value is missing or incorrect."
Exit 1

The corresponding Remediation Code makes the required change:

$path = "HKLM:\SOFTWARE\Example"

if (-not (Test-Path $path)) {
    New-Item -Path $path -Force | Out-Null
}

New-ItemProperty -Path $path -Name "Enabled" -Value 1 -PropertyType DWord -Force | Out-Null

Avoid placing commands such as Set-ItemProperty, New-Item, software installation commands, service restarts, or file deletion in Evaluation Code.

NOTE: Remember that Evaluation code is run during a Device Scan, regardless of whether or not the Worklet is scheduled.