Cookies on ScriptPreflight

We use strictly necessary storage to sign you in, take payments and keep the site secure. With your permission we also count visits, without cookies, to see which pages help. We don't run marketing tags. Cookie policy

Use case · MSPs

One script, forty clients. Know the blast radius first.

RMM agents run as SYSTEM or root on every client. Review the script once before it reaches all of them.

Run a free preflightSee a sample report

No card required. Your script is never executed.

Supply-chain context: in 2021, one RMM-pushed script reached 800–1,500 businesses. Source(opens in a new tab)That was an attack on the RMM platform itself, not something a pre-run review would block. It shows how far one script travels once an RMM sends it.

Three patterns we flag

  • Recursive delete of every user profile

    Get-ChildItem C:\Users -Recurse | Remove-Item -Recurse -Force

  • Downloads and runs code you never saw

    Invoke-Expression (New-Object Net.WebClient).DownloadString($url)

  • Turns off protection on every device

    Set-MpPreference -DisableRealtimeMonitoring $true

Sample: cleanup-temp.ps1

Real pattern, synthetic script. Recursive delete of a system or user-profile root.

Try this sample in the free checker

What we check

  • Recursive and wildcard deletes
  • Remote content and Invoke-Expression
  • Security setting changes
  • Registry writes under HKLM

What we can't know

  • · How many objects match in your environment when it runs
  • · The current state of your environment
  • · Which permissions the account running it actually holds

The script is never run and we never connect to your environment, so every report states what it could not determine.

Check the next script before it runs.

Run a free preflightSee a sample report