Kaseya VSA script examples: ten agent procedures with code, and how to import them

The most useful Kaseya VSA script examples are short PowerShell files wrapped in a three-step agent procedure: find a safe working folder, write the script there, run it and capture the output. Below are ten that cover routine work, each with the code in full. Each one is explained step by step, followed by how to import, schedule and pilot them safely, whether the machines belong to clients or to your own company.

The pattern every procedure here uses

Code dumps on GitHub tend to skip this part, which is why imported procedures so often fail on the first run. Every procedure below has the same skeleton:

1. getVariable: Secure Agent Working Directory Path, into #wd#. According to Kaseya VSA 9 Help - getVariable(), getVariable defines a new agent variable and assigns it a value fetched from the managed machine's agent when the step runs. This option points to the agent's locked-down System folder.
2. writeFile: copy the .ps1 from the VSA file store to #wd#\script.ps1. Upload each script once under Shared Files and reference it here.
3. executePowerShell: run #wd#\script.ps1 as System, saving output to a variable. Then use getVariable with the last command output, or writeScriptLogEntry, so the result lands in the procedure log.

The working folder matters. Kaseya VSA 9 Help - executePowershell() warns that scripts run as System or an administrator should run from a folder with locked-down ACLs to avoid privilege escalation. Running from C:\Temp is a privilege escalation waiting for a user with write access.

Ten Kaseya VSA script examples with code

1. Disk cleanup

Clears temp folders and trims the component store. Schedule weekly.

Remove-Item "$env:windir\Temp\*","C:\Users\*\AppData\Local\Temp\*" -Recurse -Force -ErrorAction SilentlyContinue; Dism.exe /Online /Cleanup-Image /StartComponentCleanup /Quiet; "Free GB: " + [math]::Round((Get-PSDrive C).Free/1GB,1)

2. Windows Update status check

Returns the count of missing updates, useful as an audit field.

$s = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher(); "Missing updates: " + $s.Search('IsInstalled=0 and IsHidden=0').Updates.Count

3. Local administrator audit

Lists everyone in the local Administrators group. Compare against what the client approved.

Get-LocalGroupMember -Group 'Administrators' | ForEach-Object { $_.Name + ' (' + $_.PrincipalSource + ')' }

4. Software install via executeShellCommand

This is the one batch file in the set. Kaseya VSA 9 Help - executeShellCommand() notes the step opens a visible command prompt, and recommends putting the commands in a batch file sent with writeFile so users are not confused. So: writeFile the MSI and install.bat to #wd#, then executeShellCommand on #wd#\install.bat as System.

@echo off
msiexec /i "%~dp0app.msi" /qn /norestart /l*v "%~dp0install.log"
echo Exit code %ERRORLEVEL%

5. Service restart with alert

Restarts a stopped service and reports it. In VSA, add an IF step: checkVar #output# contains RESTARTED, then sendAlert.

$n = 'Spooler'; $s = Get-Service $n; if ($s.Status -ne 'Running') { Start-Service $n; 'RESTARTED ' + $n } else { 'OK' }

6. BitLocker status

Reports protection and encryption state of the system drive.

Get-BitLockerVolume -MountPoint $env:SystemDrive | ForEach-Object { 'Protection: ' + $_.ProtectionStatus + ', Encrypted: ' + $_.EncryptionPercentage + '%' }

7. Pending reboot detection

Checks the three registry locations Windows uses to flag a pending restart.

$p = (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending') -or (Test-Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired') -or ((Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager' -Name PendingFileRenameOperations -EA SilentlyContinue) -ne $null); 'PendingReboot=' + $p

8. Event log export

Exports seven days of the System log, then a getFile step pulls it back to the VSA server.

wevtutil epl System "$env:windir\Temp\System7d.evtx" /q:"*[System[TimeCreated[timediff(@SystemTime) <= 604800000]]]" /ow:true

Point the output at #wd# rather than Temp if you pass the path in as a parameter.

9. Uninstall an application

Finds the uninstall string by display name and removes MSI-based installs silently. Change the name to suit.

$name = '*7-Zip*'; Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object DisplayName -like $name | ForEach-Object { if ($_.PSChildName -match '^\{') { Start-Process msiexec.exe "/x $($_.PSChildName) /qn /norestart" -Wait; 'Removed ' + $_.DisplayName } else { 'Non-MSI, review: ' + $_.UninstallString } }

10. Post-2021 indicator check

In July 2021 attackers exploited a VSA zero-day tracked as CVE-2021-30116, as Cybernews reported. SentinelOne described a fake update called 'Kaseya VSA Agent Hot-fix' that dropped agent.crt, decoded with the legitimate certutil.exe into agent.exe. BleepingComputer covered the 9.5.7a fix and the detection scripts that looked for those two files. The same idea, as a recurring hygiene check:

$hits = Get-ChildItem "$env:SystemDrive\","$env:windir\Temp","$env:ProgramData" -Include agent.crt,agent.exe -Recurse -Depth 3 -Force -EA SilentlyContinue; if ($hits) { 'ALERT ' + ($hits.FullName -join ';') } else { 'CLEAN' }

Pair it with an IF step that alerts on ALERT. It is a narrow check for one known incident, not a substitute for endpoint detection.

Importing, scheduling and piloting

• Import: save each script as a .ps1 or .bat, upload it to Shared Files, then build the procedure in the editor or import an exported XML via Agent Procedures, Import. Keep your own Git repository of the files so each change is reviewable.
• The pilot test: create a machine group of five to ten varied machines, including one server and one awkward laptop. Run each procedure manually, read the procedure log, then schedule it for that group only for a week.
• Schedule: widen to production with a distribution window so hundreds of machines do not hit the network at once. Skip the pilot and your first bug report comes from a client.

Securing procedures: approval and credentials

Procedures that run as System are the most powerful thing in your RMM, which is exactly why attackers went after one. Require a second person to approve new or edited procedures, restrict editing rights by role, and never hard-code passwords in a script. Where a credential is needed, use VSA's managed credentials and reference them at run time rather than writing them into a file that sits on disk.

That portability is worth protecting deliberately. If you are weighing a move, our plan for leaving Kaseya VSA around a multi-year contract covers the timing, and our explainer on what VSA agent procedures can and cannot do covers the limits.

Where this fits with Helios

Helios runs PowerShell directly on managed devices, so scripts like these drop in with no wrapper steps to rebuild. Its built-in AI technician, Helio, can investigate an alert, run a diagnostic such as the pending reboot check, apply a fix and confirm it held, within plain-English rules your technicians set. Most of this article is discipline, though: a pilot group, an approval step and a repository of your own scripts matter on any platform, including the one you use today.

Common questions about Kaseya VSA scripts

Should I use executePowerShell or executeShellCommand in Kaseya VSA?

Use executePowerShell for anything that queries or changes Windows, because it handles output cleanly and runs from the secure working folder. Keep executeShellCommand for installers and legacy batch logic, and per Kaseya's guidance wrap those commands in a batch file sent with writeFile so no command prompt window appears in front of users.

Can I run Kaseya VSA agent procedures on Mac or Linux?

Kaseya VSA agent procedures can target Mac and Linux machines, but the ten scripts here are written for Windows. On other operating systems you would replace the PowerShell with shell scripts and use the equivalent shell execution step, keeping the same pattern of a locked-down working folder, a written file and captured output for the procedure log.

Researched and written with Helio SEO, our AI writer for business blogs.