Create a Custom Detection Script for Acronis Ransomware Protection (PowerShell)

Microsoft Endpoint Manager Configuration Manager (MEMCM / SCCM) and Microsoft Intune use Detection Rules to determine the presence of Applications & Win32 Apps. The detection rules ensure that application installations only begin to run if the application is not already installed on the device. This article will serve as an informative guide and give you a clear understanding of how to create an updated custom detection script for each new version of Acronis Ransomware Protection using PowerShell.

How to Create a Custom Detection Script for Acronis Ransomware Protection

Acronis Ransomware Protection (File Detection Method)

## Check for Acronis Ransomware Protection (File Detection Method)
$AcronisProtectionExe = (Get-ChildItem -Path "C:\Program Files\Acronis\Ransomware Protection\ARPTray.exe","C:\Program Files (x86)\Acronis\Ransomware Protection\ARPTray.exe" -ErrorAction SilentlyContinue)
$AcronisProtectionExe.FullName
$AcronisProtectionPath = $($AcronisProtectionExe.FullName).Replace("C:\Program Files\","").Replace("C:\Program Files (x86)\","")
$FileVersion = (Get-Item -Path "$($AcronisProtectionExe.FullName)" -ErrorAction SilentlyContinue).VersionInfo.FileVersion

## Create Text File with Acronis Ransomware Protection File Detection Method
$FilePath = "C:\Windows\Temp\Acronis_Ransomware_Protection_Detection_Method.txt"
New-Item -Path "$FilePath" -Force
Set-Content -Path "$FilePath" -Value "If([String](Get-Item -Path `"`$Env:ProgramFiles\$AcronisProtectionPath`",`"`${Env:ProgramFiles(x86)}\$AcronisProtectionPath`" -ErrorAction SilentlyContinue).VersionInfo.FileVersion -ge `"$FileVersion`"){"
Add-Content -Path "$FilePath" -Value "Write-Host `"Installed`""
Add-Content -Path "$FilePath" -Value "Exit 0"
Add-Content -Path "$FilePath" -Value "}"
Add-Content -Path "$FilePath" -Value "else {"
Add-Content -Path "$FilePath" -Value "Exit 1"
Add-Content -Path "$FilePath" -Value "}"
Invoke-Item $FilePath
  • Click Run Script (F5)
  • A text file will open with the Acronis Ransomware Protection Detection Method script required to detect the current version of Acronis Ransomware Protection that is installed on the device you are running the script from.

Example:

If([String](Get-Item -Path "$Env:ProgramFiles\Acronis\Ransomware Protection\ARPTray.exe","${Env:ProgramFiles(x86)}\Acronis\Ransomware Protection\ARPTray.exe" -ErrorAction SilentlyContinue).VersionInfo.FileVersion -ge "2.1.1700"){
Write-Host "Installed"
Exit 0
}
else {
Exit 1
}

Acronis Ransomware Protection (Registry Detection Method)

## Check for Acronis Ransomware Protection (Registry Detection Method)
$AcronisProtection = Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall","HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall" | Get-ItemProperty | Where-Object {$_.DisplayName -match 'Acronis Ransomware Protection' -and $_.UninstallString -notlike 'MsiExec.exe*' } | Select-Object -Property DisplayName, DisplayVersion, PSChildName
$AcronisProtection.DisplayVersion
$AcronisProtection.PSChildName

## Create Text File with Acronis Ransomware Protection Registry Detection Method
$FilePath = "C:\Windows\Temp\Acronis_Ransomware_Protection_Detection_Method.txt"
New-Item -Path "$FilePath" -Force
Set-Content -Path "$FilePath" -Value "If([Version](Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$($AcronisProtection.PSChildName)','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\$($AcronisProtection.PSChildName)' -Name DisplayVersion -ea SilentlyContinue) -ge '$($AcronisProtection.DisplayVersion)') {"
Add-Content -Path "$FilePath" -Value "Write-Host `"Installed`""
Add-Content -Path "$FilePath" -Value "Exit 0"
Add-Content -Path "$FilePath" -Value "}"
Add-Content -Path "$FilePath" -Value "else {"
Add-Content -Path "$FilePath" -Value "Exit 1"
Add-Content -Path "$FilePath" -Value "}"
Invoke-Item $FilePath
  • Click Run Script (F5)
  • A text file will open with the Acronis Ransomware Protection Detection Method script required to detect the current version of Acronis Ransomware Protection that is installed on the device you are running the script from.

Example:

If([Version](Get-ItemPropertyValue -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{da11fa98-c6d4-4216-88a5-afa576a353cd}','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{da11fa98-c6d4-4216-88a5-afa576a353cd}' -Name DisplayVersion -ea SilentlyContinue) -ge '2.1.1700.0') {
Write-Host "Installed"
Exit 0
}
else {
Exit 1
}

Always make sure to test everything in a development environment prior to implementing anything into production. The information in this article is provided “As Is” without warranty of any kind.

Jason Bergner

I am an accomplished Software Engineer at Patch My PC, leveraging more than 18 years of hands-on experience in Configuration Manager administration and application packaging. I am driven by a genuine passion for solving complex problems and consistently strive to discover innovative and effective solutions. Sharing my extensive knowledge of application deployments is a true joy for me, and I am honored to contribute to the community here at Silent Install HQ.

Recent Posts