NinjaOne PowerShell Toolkit

A collection of PowerShell scripts designed to be deployed through NinjaOne (NinjaRMM) on managed Windows endpoints. The two production scripts automate Veeam configuration backup off-siting and BitLocker enablement with recovery-key escrow; the remaining files are reusable building blocks (logging, PowerShell 7 bootstrap, secret vault setup) used by the main scripts.

Repository layout

Path	Purpose
Powershell/Backup_veeam.ps1	Main tool. Uploads the latest Veeam configuration backup to SharePoint, driven by NinjaOne.
Powershell/BitlockerFromNinja.ps1	Enables BitLocker and writes the recovery key to a NinjaOne custom field.
Powershell/Bitlocker.ps1	Standalone BitLocker enablement variant that posts recovery keys to a Teams webhook.
Powershell/Powershell_install_V1.ps1	Template: detects PowerShell 7, installs it from GitHub if missing, and relaunches the calling script under pwsh.
Powershell/New_LogMessage.ps1	Template: timestamped, leveled (INFO/WARN/ERROR) logging to console and file.
Powershell/Creation_vault.ps1, Powershell/Create_vault-pwsh7.ps1	Helpers that create a SecretManagement/SecretStore vault and seed SMTP and Microsoft 365 credentials.
Powershell/Bitlocker-test.ps1, Powershell/brainstorm.ps1, Powershell/Test_smtpmail.ps1	Work-in-progress drafts and test scaffolding. Not intended for deployment.
Python/, shell/	Unrelated one-off scripts (lab exploit demo, Linux rootfs helpers).

---

Main tool: Veeam configuration backup to SharePoint (Backup_veeam.ps1)

What it does

When run on a Veeam server by NinjaOne, the script:

1. Bootstraps PowerShell 7 — if the agent runs the script under Windows PowerShell 5.1, it downloads the latest PowerShell 7 x64 MSI from GitHub, installs it silently, and relaunches itself under pwsh with the same parameters.
2. Logs everything to C:\script\logs\BackupVeeam_log.txt (timestamped, leveled entries).
3. Checks for administrator rights (configurable, see parameters).
4. Installs required modules on first run: PnP.PowerShell 2.2.0, Microsoft.PowerShell.SecretManagement, Microsoft.PowerShell.SecretStore.
5. Builds a local secret vault and populates it with credentials pulled at runtime from NinjaOne secure custom fields (Ninja-Property-Get smtppassword and Ninja-Property-Get credential365), so no password is stored in the script itself.
6. Finds the newest Veeam configuration backup (*.bco) under C:\backup-conf-VEEAM\VeeamConfigBackup.
7. Uploads it to SharePoint with PnP.PowerShell, into a folder named after the NinjaOne organization ($env:NINJA_ORGANIZATION_NAME) inside the target document library. This gives you one folder per customer, automatically.
8. Sends an alert email over SMTP (port 587, STARTTLS via Send-MailKitMessage) if the upload fails.

Use case with NinjaOne

Veeam Backup & Replication can back up its own configuration locally, but that backup dies with the server. This script, scheduled from NinjaOne across all managed Veeam servers, centralizes every customer's Veeam configuration backup in a single SharePoint library — sorted per organization — with email alerting on failure. Credentials never leave the RMM: they are injected at runtime through NinjaOne secure custom fields.

Prerequisites

• Windows Server with the NinjaOne agent installed.
• Veeam configuration backup enabled and writing .bco files to C:\backup-conf-VEEAM\VeeamConfigBackup (adjust $Parameters365.BackupFolderPath if yours differs).
• Outbound internet access (GitHub for the PowerShell 7 MSI, PowerShell Gallery for modules, SharePoint Online, your SMTP relay).
• A Microsoft 365 account with write access to the target SharePoint site (legacy username/password auth — see Limitations).
• An SMTP account for failure notifications.
• Two NinjaOne secure custom fields readable by scripts:
  • smtppassword — password of the SMTP alert account.
  • credential365 — password of the Microsoft 365 upload account.

Deployment in NinjaOne

1. In NinjaOne, create the two secure custom fields above (Device or Organization scope) and set Script access to Read.
2. Fill in the field values for each organization/device that runs the script.
3. Add Backup_veeam.ps1 to your script library (Language: PowerShell, OS: Windows, Run as: System or a local administrator).
4. Edit the environment-specific values at the top of the script (see Configuration).
5. Schedule it (e.g. daily, shortly after the Veeam configuration backup window) on the relevant Veeam servers.

Parameters

Parameter	Default	Description
is_admin	"trued"	Set to "true" to enforce an administrator-rights check (any other value skips the check with a warning).
logFolderPath	C:\script\logs	Folder for the log file. Created if missing.
logFileName	BackupVeeam_log.txt	Log file name.
vaultname	VaultGSI	Name of the local SecretStore vault used to hold the runtime credentials.

Configuration (edit before deploying)

These values are currently hard-coded in the begin block and must be adapted to your tenant:

• $Parameters365.BackupFolderPath — where Veeam writes its .bco configuration backups.
• $Parameters365.URLSharepoint — the SharePoint site URL receiving the backups.
• $Parameters365.SharepointLibrary — target document library (default Shared Documents).
• $ParametersSmtp — SMTP server, port, sender, recipient, and subject for failure alerts.
• The two account usernames used when building the vault credentials (SMTP sender and Microsoft 365 upload account) inside New-MVault.

Example

Run manually on a server for testing (elevated Windows PowerShell or pwsh):

.\Backup_veeam.ps1 -is_admin "true" -vaultname "VaultGSI"

Typical NinjaOne usage: no parameters — schedule the script as-is and let the defaults apply. Check C:\script\logs\BackupVeeam_log.txt for the run history.

---

BitLocker enablement with key escrow (BitlockerFromNinja.ps1)

What it does

Designed as a NinjaOne script for Windows 10/11 Pro or Enterprise workstations:

• Skips Home editions (BitLocker unsupported).
• If the system drive is already encrypted and protected: saves the recovery key and exits.
• If encrypted but protection is off: decrypts, then re-encrypts with AES-256 (used space only) and a recovery password protector.
• If not encrypted: enables BitLocker (AES-256, used space only, -SkipHardwareTest).
• Escrows the recovery key three ways: a text file at C:\<COMPUTERNAME>.txt, the script output (visible in the NinjaOne activity log), and a NinjaOne custom field via Ninja-Property-Set.
• Attempts to back up the recovery protector to Active Directory / Entra ID when available.

Setup

1. Create a multi-line device custom field in NinjaOne with Script access set to Write.
2. Replace the placeholder field name Custom-Multi-Line-Device-Field in the script (three occurrences) with your field's machine name.
3. Deploy as: PowerShell, Windows, Run as System. A TPM should be present and enabled for a silent experience.

Security note

The recovery key is deliberately written to C:\<COMPUTERNAME>.txt and echoed to the activity log as a belt-and-braces measure. If your policy considers the NinjaOne custom field the single source of truth, remove the file write and the Write-Host of the key before deploying.

---

Supporting scripts

• Bitlocker.ps1 — richer standalone variant: checks/initializes the TPM, adds TPM + recovery-password protectors, resumes suspended protection, waits for encryption to finish, then posts all recovery keys to a Microsoft Teams incoming webhook (replace the hard-coded $WEBHOOKURL with your own).
• Powershell_install_V1.ps1 and New_LogMessage.ps1 — the reusable templates (PowerShell 7 bootstrap, logging, elevation check) that Backup_veeam.ps1 embeds. Useful starting points for new RMM scripts.
• Creation_vault.ps1 / Create_vault-pwsh7.ps1 — one-shot helpers to pre-provision the local secret vault outside the RMM flow. Replace the placeholder credentials before use; never commit real secrets.

Limitations

• Backup_veeam.ps1 authenticates to SharePoint with username/password (Connect-PnPOnline -Credentials). This requires legacy authentication to be allowed for that account and does not work with MFA. Migrating to an Entra ID app registration with a certificate (-ClientId/-Thumbprint) is the recommended hardening step.
• The local SecretStore vault is configured with -Authentication None so the script can run unattended; secrets are protected by DPAPI for the executing account only, not by a master password.
• On failure, Backup_veeam.ps1 sends an email but still exits with code 0, so the NinjaOne activity will not show as failed. Add a throw/exit 1 in the catch block of Save-ToSharepoint if you want RMM-level failure conditions.
• Paths, tenant URLs, and mail settings are hard-coded per environment (see Configuration) rather than exposed as parameters.
• Windows only; French log messages appear in places.

License

No license file is currently included. MIT is suggested for a script collection like this one: it allows other MSPs to reuse and adapt the scripts while disclaiming any warranty — relevant for tools that manipulate disk encryption and backups.

Disclaimer

These scripts change disk encryption state, install software, and handle credentials. Test on a non-production device or a pilot group in NinjaOne before any large-scale rollout.