Last active
May 2, 2023 14:23
-
-
Save adamgell/630eb2ccb9826d7509b5175c21422b72 to your computer and use it in GitHub Desktop.
Fix intune enrollment
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <#PSScriptInfo | |
| .VERSION 0.11 | |
| .GUID 715a6707-796c-445f-9e8a-8a0fffd778a4 | |
| .AUTHOR Rudy Ooms | |
| .COMPANYNAME | |
| .COPYRIGHT | |
| .TAGS Windows, AutoPilot, Powershell | |
| .LICENSEURI | |
| .PROJECTURI https://www.github.com | |
| .ICONURI | |
| .EXTERNALMODULEDEPENDENCIES | |
| .REQUIREDSCRIPTS | |
| .RELEASENOTES | |
| Version 0.1: Initial Release. | |
| version 0.2: added way more checks and fixes | |
| version 0.3: added the mdmurls check | |
| version 0.8: added the IME service check and reinstall functionality and improved some error handling | |
| Adam Gell - edits the comments and expanded the encoded code. | |
| .PRIVATEDATA | |
| #> | |
| <# | |
| .DESCRIPTION | |
| .SYNOPSIS | |
| GUI to fix intune sync issues. | |
| MIT LICENSE | |
| Copyright (c) 2022 Rudy Ooms | |
| Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: | |
| The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. | |
| THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. | |
| .DESCRIPTION | |
| The goal of this script is to help with the troubleshooting of Attestation issues when enrolling your device with Autopilot for Pre-Provisioned deployments | |
| .EXAMPLE | |
| Blog post with examples and explanations @call4cloud.nl | |
| .LINK | |
| Online version: https://call4cloud.nl/ | |
| #> | |
| function test-intunesyncerrors { | |
| ######## | |
| ### Version 0.8 | This tool will check for missing Intune certificates, if the Certificate is in the wrong certificate store, and if the certificate has been expired | |
| ####### | |
| ################################# | |
| #defining some functions first### | |
| ################################### | |
| function fix-wrongstore { | |
| $title = 'Fixing missing Certificate in the System Store' | |
| $question = 'Are you sure you want to proceed?' | |
| $choices = '&Yes', '&No' | |
| $decision = $Host.UI.PromptForChoice($title, $question, $choices, 1) | |
| if ($decision -eq 0) { | |
| $progressPreference = 'silentlyContinue' | |
| write-host "Exporting and Importing the Intune certificate to the proper Certificate Store" -foregroundcolor yellow | |
| Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/PSTools.zip' -OutFile 'pstools.zip' | |
| Expand-Archive -Path 'pstools.zip' -DestinationPath "$env:TEMP\pstools" -force | |
| #Move-Item -Path "$env:TEMP\pstools\psexec.exe" -force | |
| reg.exe ADD HKCU\Software\Sysinternals /v EulaAccepted /t REG_DWORD /d 1 /f | out-null | |
| <# the encoded command below does the following... | |
| $RegistryKeys = "HKLM:\SOFTWARE\Microsoft\Enrollments", "HKLM:\SOFTWARE\Microsoft\Enrollments\Status","HKLM:\SOFTWARE\Microsoft\EnterpriseResourceManager\Tracked", "HKLM:\SOFTWARE\Microsoft\PolicyManager\AdmxInstalled", "HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers","HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts", "HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Logger", "HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Sessions" | |
| $IntuneCert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { | |
| $_.Issuer -match "Intune MDM" | |
| } | Remove-Item | |
| $EnrollmentID = Get-ScheduledTask | Where-Object {$_.TaskPath -like "*Microsoft*Windows*EnterpriseMgmt*"} | Select-Object -ExpandProperty TaskPath -Unique | Where-Object {$_ -like "*-*-*"} | Split-Path -Leaf | |
| Get-ScheduledTask | Where-Object {$_.Taskpath -match $EnrollmentID} | Unregister-ScheduledTask -Confirm:$false | |
| foreach ($Key in $RegistryKeys) { | |
| if (Test-Path -Path $Key) { | |
| get-ChildItem -Path $Key | Where-Object {$_.Name -match $EnrollmentID} | Remove-Item -Recurse -Force -Confirm:$false -ErrorAction SilentlyContinue | |
| } | |
| foreach ($enrollment in $enrollmentid){ | |
| Get-ScheduledTask | Where-Object {$_.Taskpath -match $Enrollment} | Unregister-ScheduledTask -Confirm:$false | |
| } | |
| } | |
| Start-Sleep -Seconds 5 | |
| $EnrollmentProcess = Start-Process -FilePath "C:\Windows\System32\DeviceEnroller.exe" -ArgumentList "/C /AutoenrollMDM" -NoNewWindow -Wait -PassThru | |
| #> | |
| Start-Process -windowstyle hidden -FilePath "$env:TEMP\pstools\psexec.exe" -ArgumentList '-s cmd /c "powershell.exe -ExecutionPolicy Bypass -encodedcommand JABjAGUAcgB0AGkAZgBpAGMAYQB0AGUAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgAEMAZQByAHQAOgBcAEMAdQByAHIAZQBuAHQAdQBzAGUAcgBcAE0AeQBcAAoAJABwAGEAcwBzAHcAbwByAGQAPQAgACIAcwBlAGMAcgBlAHQAIgAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBBAHMAUABsAGEAaQBuAFQAZQB4AHQAIAAtAEYAbwByAGMAZQAKAEUAeABwAG8AcgB0AC0AUABmAHgAQwBlAHIAdABpAGYAaQBjAGEAdABlACAALQBDAGUAcgB0ACAAJABjAGUAcgB0AGkAZgBpAGMAYQB0AGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgAGMAOgBcAGkAbgB0AHUAbgBlAC4AcABmAHgAIAAtAFAAYQBzAHMAdwBvAHIAZAAgACQAcABhAHMAcwB3AG8AcgBkAAoASQBtAHAAbwByAHQALQBQAGYAeABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIAAtAEUAeABwAG8AcgB0AGEAYgBsAGUAIAAtAFAAYQBzAHMAdwBvAHIAZAAgACQAcABhAHMAcwB3AG8AcgBkACAALQBDAGUAcgB0AFMAdABvAHIAZQBMAG8AYwBhAHQAaQBvAG4AIABDAGUAcgB0ADoAXABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQBcAE0AeQAgAC0ARgBpAGwAZQBQAGEAdABoACAAYwA6AFwAaQBuAHQAdQBuAGUALgBwAGYAeAA="' | |
| } | |
| else { | |
| Write-Host 'Exiting...' -foregroundcolor red | |
| read-Host -prompt "Press any key to continue..." | |
| exit | |
| } | |
| } | |
| function check-certdate { | |
| Write-Host "Checking If the Certificate hasn't expired" -foregroundcolor yellow | |
| if ((Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq $thumbprint -and $_.NotAfter -lt (Get-Date) }) -eq $null) { | |
| Write-Host "The Intune Device Certificate is not expired." -foregroundcolor green | |
| } | |
| else { | |
| Write-Host "The Intune Device Certificate is EXPIRED!" -foregroundcolor red | |
| fix-certificate | |
| } | |
| } | |
| function check-intunecert { | |
| if (Get-ChildItem Cert:\LocalMachine\My\ | where { $_.issuer -like "*Microsoft Intune MDM Device CA*" }) { | |
| write-Host "Intune Device Certificate is in installed in the Local Machine Certificate store" -foregroundcolor green | |
| } | |
| else { | |
| Write-Host "Intune device Certificate still seems to be missing... sorry!" -foregroundcolor red | |
| } | |
| } | |
| function fix-certificate { | |
| $title = 'Fixing the Intune Enrollment' | |
| $question = 'Are you 100% sure you want to proceed?' | |
| $choices = '&Yes', '&No' | |
| $decision = $Host.UI.PromptForChoice($title, $question, $choices, 1) | |
| if ($decision -eq 0) { | |
| $progressPreference = 'silentlyContinue' | |
| write-host "Trying to enroll your device into Intune or something else..." -foregroundcolor yellow | |
| fix-mdmurls | |
| Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/PSTools.zip' -OutFile 'pstools.zip' | |
| Expand-Archive -Path 'pstools.zip' -DestinationPath "$env:TEMP\pstools" -force | |
| #Move-Item -Path "$env:TEMP\pstools\psexec.exe" -force | |
| reg.exe ADD HKCU\Software\Sysinternals /v EulaAccepted /t REG_DWORD /d 1 /f | out-null | |
| <# the encoded command below does the following... | |
| $RegistryKeys = "HKLM:\SOFTWARE\Microsoft\Enrollments", "HKLM:\SOFTWARE\Microsoft\Enrollments\Status","HKLM:\SOFTWARE\Microsoft\EnterpriseResourceManager\Tracked", "HKLM:\SOFTWARE\Microsoft\PolicyManager\AdmxInstalled", "HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers","HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts", "HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Logger", "HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Sessions" | |
| $IntuneCert = Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { | |
| $_.Issuer -match "Intune MDM" | |
| } | Remove-Item | |
| $EnrollmentID = Get-ScheduledTask | Where-Object {$_.TaskPath -like "*Microsoft*Windows*EnterpriseMgmt*"} | Select-Object -ExpandProperty TaskPath -Unique | Where-Object {$_ -like "*-*-*"} | Split-Path -Leaf | |
| Get-ScheduledTask | Where-Object {$_.Taskpath -match $EnrollmentID} | Unregister-ScheduledTask -Confirm:$false | |
| foreach ($Key in $RegistryKeys) { | |
| if (Test-Path -Path $Key) { | |
| get-ChildItem -Path $Key | Where-Object {$_.Name -match $EnrollmentID} | Remove-Item -Recurse -Force -Confirm:$false -ErrorAction SilentlyContinue | |
| } | |
| foreach ($enrollment in $enrollmentid){ | |
| Get-ScheduledTask | Where-Object {$_.Taskpath -match $Enrollment} | Unregister-ScheduledTask -Confirm:$false | |
| } | |
| } | |
| Start-Sleep -Seconds 5 | |
| $EnrollmentProcess = Start-Process -FilePath "C:\Windows\System32\DeviceEnroller.exe" -ArgumentList "/C /AutoenrollMDM" -NoNewWindow -Wait -PassThru | |
| #> | |
| $enroll = Start-Process -windowstyle hidden -FilePath "$env:TEMP\pstools\psexec.exe" -ArgumentList '-s cmd /c "powershell.exe -ExecutionPolicy Bypass -encodedcommand JABSAGUAZwBpAHMAdAByAHkASwBlAHkAcwAgAD0AIAAiAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBuAHIAbwBsAGwAbQBlAG4AdABzACIALAAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABFAG4AcgBvAGwAbABtAGUAbgB0AHMAXABTAHQAYQB0AHUAcwAiACwAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEUAbgB0AGUAcgBwAHIAaQBzAGUAUgBlAHMAbwB1AHIAYwBlAE0AYQBuAGEAZwBlAHIAXABUAHIAYQBjAGsAZQBkACIALAAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABQAG8AbABpAGMAeQBNAGEAbgBhAGcAZQByAFwAQQBkAG0AeABJAG4AcwB0AGEAbABsAGUAZAAiACwAIAAiAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAUABvAGwAaQBjAHkATQBhAG4AYQBnAGUAcgBcAFAAcgBvAHYAaQBkAGUAcgBzACIALAAiAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAUAByAG8AdgBpAHMAaQBvAG4AaQBuAGcAXABPAE0AQQBEAE0AXABBAGMAYwBvAHUAbgB0AHMAIgAsACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFAAcgBvAHYAaQBzAGkAbwBuAGkAbgBnAFwATwBNAEEARABNAFwATABvAGcAZwBlAHIAIgAsACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFAAcgBvAHYAaQBzAGkAbwBuAGkAbgBnAFwATwBNAEEARABNAFwAUwBlAHMAcwBpAG8AbgBzACIACgAkAEkAbgB0AHUAbgBlAEMAZQByAHQAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgAEMAZQByAHQAOgBcAEwAbwBjAGEAbABNAGEAYwBoAGkAbgBlAFwATQB5ACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAKAAkACQAkAF8ALgBJAHMAcwB1AGUAcgAgAC0AbQBhAHQAYwBoACAAIgBJAG4AdAB1AG4AZQAgAE0ARABNACIAIAAKAAkAfQAgAHwAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0ACgAkAEUAbgByAG8AbABsAG0AZQBuAHQASQBEACAAPQAgAEcAZQB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAJABfAC4AVABhAHMAawBQAGEAdABoACAALQBsAGkAawBlACAAIgAqAE0AaQBjAHIAbwBzAG8AZgB0ACoAVwBpAG4AZABvAHcAcwAqAEUAbgB0AGUAcgBwAHIAaQBzAGUATQBnAG0AdAAqACIAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABUAGEAcwBrAFAAYQB0AGgAIAAtAFUAbgBpAHEAdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAkAF8AIAAtAGwAaQBrAGUAIAAiACoALQAqAC0AKgAiAH0AIAB8ACAAUwBwAGwAaQB0AC0AUABhAHQAaAAgAC0ATABlAGEAZgAKAEcAZQB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAJABfAC4AVABhAHMAawBwAGEAdABoACAALQBtAGEAdABjAGgAIAAkAEUAbgByAG8AbABsAG0AZQBuAHQASQBEAH0AIAB8ACAAVQBuAHIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAKAAkACQAJAGYAbwByAGUAYQBjAGgAIAAoACQASwBlAHkAIABpAG4AIAAkAFIAZQBnAGkAcwB0AHIAeQBLAGUAeQBzACkAIAB7AAoACQAJAAkACQBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABLAGUAeQApACAAewAKAAkACQAJAAkACQBnAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBQAGEAdABoACAAJABLAGUAeQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAJABfAC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJABFAG4AcgBvAGwAbABtAGUAbgB0AEkARAB9ACAAfAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlACAALQBDAG8AbgBmAGkAcgBtADoAJABmAGEAbABzAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAJAH0ACgBmAG8AcgBlAGEAYwBoACAAKAAkAGUAbgByAG8AbABsAG0AZQBuAHQAIABpAG4AIAAkAGUAbgByAG8AbABsAG0AZQBuAHQAaQBkACkAewAKAEcAZQB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAJABfAC4AVABhAHMAawBwAGEAdABoACAALQBtAGEAdABjAGgAIAAkAEUAbgByAG8AbABsAG0AZQBuAHQAfQAgAHwAIABVAG4AcgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQwBvAG4AZgBpAHIAbQA6ACQAZgBhAGwAcwBlAAoAfQAgAAkACgAJAAkACQB9AAoACQAJAAkAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAKACQARQBuAHIAbwBsAGwAbQBlAG4AdABQAHIAbwBjAGUAcwBzACAAPQAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAEQAZQB2AGkAYwBlAEUAbgByAG8AbABsAGUAcgAuAGUAeABlACIAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgAvAEMAIAAvAEEAdQB0AG8AZQBuAHIAbwBsAGwATQBEAE0AIgAgAC0ATgBvAE4AZQB3AFcAaQBuAGQAbwB3ACAALQBXAGEAaQB0ACAALQBQAGEAcwBzAFQAaAByAHUA"' | |
| $enroll | |
| write-host "`n" | |
| write-host "Please give the OMA DM client some time (about 20 seconds)to sync and get your device enrolled into Intune" -foregroundcolor yellow | |
| write-host "`n" | |
| start-sleep -seconds 20 | |
| write-host "Checking the Intune Certificate Again!." -foregroundcolor yellow | |
| check-intunecert | |
| check-dmwapservice | |
| Get-ScheduledTask | ? { $_.TaskName -eq 'Schedule #1 created by enrollment client' } | Start-ScheduledTask | |
| start-sleep -seconds 10 | |
| $Shell = New-Object -ComObject Shell.Application | |
| $Shell.open("intunemanagementextension://syncapp") | |
| check-dmpcert | |
| start-sleep -seconds 5 | |
| get-schedule1 | |
| read-Host -prompt "Press any key to continue..." | |
| exit | |
| } | |
| else { | |
| write-host "`n" | |
| Write-Host 'You dont like me fixing it...? Fine...exiting now' -foregroundcolor red | |
| exit 1 | |
| } | |
| } | |
| function fix-privatekey { | |
| $title = 'Intune Private Key' | |
| $question = 'Are you sure you want to fix the private key missing??' | |
| $choices = '&Yes', '&No' | |
| $decision = $Host.UI.PromptForChoice($title, $question, $choices, 1) | |
| if ($decision -eq 0) { | |
| Write-Host "List certificates without private key: " -NoNewline | |
| $certsWithoutKey = Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.HasPrivateKey -eq $false } | |
| if ($certsWithoutKey) { | |
| Write-Host "V" -ForegroundColor Green | |
| $Choice = $certsWithoutKey | Select-Object Subject, Issuer, NotAfter, ThumbPrint | Out-Gridview -Passthru | |
| if ($Choice) { | |
| Write-Host "Search private key for $($Choice.Thumbprint): " -NoNewline | |
| $Output = certutil -repairstore my "$($Choice.Thumbprint)" | |
| $Result = [regex]::match($output, "CertUtil: (.*)").Groups[1].Value | |
| if ($Result -eq '-repairstore command completed successfully.') { | |
| Write-Host "V" -ForegroundColor Green | |
| } | |
| else { | |
| Write-Host $Result -ForegroundColor Red | |
| } | |
| } | |
| else { | |
| Write-Host "No choice was made." -ForegroundColor DarkYellow | |
| } | |
| } | |
| else { | |
| Write-Host "There were no certificates found without private key." -ForegroundColor DarkYellow | |
| } | |
| } | |
| else { | |
| Write-Host 'You cancelled the fix... why?' -foregroundcolor red | |
| Write-Host "Press any key to continue..." | |
| $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") | |
| exit 1 | |
| } | |
| } | |
| function get-privatekey { | |
| if ((Get-ChildItem Cert:\LocalMachine\My | where { $_.Thumbprint -match $thumbprint }).HasPrivateKey) { | |
| Write-Host "Nice.. your Intune Device Certificate still has its private key" -foregroundcolor green | |
| } | |
| else { | |
| Write-Host "I guess we need to fix something because the certificate is missing its private key" -foregroundcolor red | |
| fix-privatekey | |
| } | |
| } | |
| function check-mdmlog { | |
| Write-Host "Hold on a moment... Initializing a sync and checking the MDM logs for sync errors!" -foregroundcolor yellow | |
| $Shell = New-Object -ComObject Shell.Application | |
| $Shell.open("intunemanagementextension://syncapp") | |
| start-sleep -seconds 5 | |
| Remove-Item -Path $env:TEMP\diag\* -Force -ErrorAction SilentlyContinue | |
| Start-Process MdmDiagnosticsTool.exe -Wait -ArgumentList "-out $env:TEMP\diag\" -NoNewWindow | |
| $checkmdmlog = Select-String -Path $env:TEMP\diag\MDMDiagReport.html -Pattern "The last sync failed" | |
| if ($checkmdmlog -eq $null) { | |
| Write-Host "Not detecting any sync errors in the MDM log" -foregroundcolor green | |
| } | |
| else { | |
| Write-Host "It's a good thing you are running this script because you do have some Intune sync issues going on" -foregroundcolor red | |
| } | |
| } | |
| function check-imelog { | |
| $path = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log" | |
| If (Test-Path $path) { | |
| $checklog = Select-String -Path 'C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log' -Pattern "Set MdmDeviceCertificate : $thumbprint" | |
| if ($checklog -ne $null) { | |
| Write-Host "The proper Intune certificate with $thumbprint is also mentioned in the IME" -foregroundcolor green | |
| } | |
| else { | |
| $checklogzero = Select-String -Path 'C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log' -Pattern "Find 0 MDM certificates" | |
| $firstline = $checklogzero | select-object -first 1 | |
| Write-Host "this is could not be a good thing... $firstline" -foregroundcolor red | |
| } | |
| } | |
| Else { Write-Host "the log is missing... it seems the IME is not installed" -foregroundcolor red } | |
| check-imeservice | |
| } | |
| function check-dmpcert { | |
| write-host "`n" | |
| write-host "Determing if the certificate mentioned in the SSLClientCertreference is also configured in the Enrollments part of the registry " -foregroundcolor yellow | |
| try { | |
| $ProviderRegistryPath = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments" | |
| $ProviderPropertyName = "ProviderID" | |
| $ProviderPropertyValue = "MS DM Server" | |
| $GUID = (Get-ChildItem -Path Registry::$ProviderRegistryPath -Recurse -ErrorAction SilentlyContinue | ForEach-Object { if ((Get-ItemProperty -Name $ProviderPropertyName -Path $_.PSPath -ErrorAction SilentlyContinue | Get-ItemPropertyValue -Name $ProviderPropertyName -ErrorAction SilentlyContinue) -match $ProviderPropertyValue) { $_ } }).PSChildName | |
| $cert = (Get-ChildItem Cert:\LocalMachine\My\ | where { $_.issuer -like "*Microsoft Intune MDM Device CA*" }) | |
| $certthumbprint = $cert.thumbprint | |
| $certsubject = $cert.subject | |
| $subject = $certsubject -replace "CN=", "" | |
| } | |
| catch { | |
| Write-host "Failed to get guid for enrollment from registry, device doesnt seem enrolled?" -foregroundcolor red | |
| } | |
| if ((Get-ItemProperty -Path "HKLM:SOFTWARE\Microsoft\Enrollments\$guid").DMPCertThumbPrint -eq $certthumbprint) { | |
| Write-Host "Great!!! The Intune Device Certificate with the Thumbprint $certthumbprint is configured in the registry Enrollments" -foregroundcolor green | |
| } | |
| else { | |
| Write-Host "Intune Device Certificate is not configured in the Registry Enrollments" -foregroundcolor red | |
| } | |
| } | |
| function get-sslclientcertreference { | |
| try { | |
| $ProviderRegistryPath = "HKLM:SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\" | |
| $ProviderPropertyName = "ServerVer" | |
| $ProviderPropertyValue = "4.0" | |
| $GUID = (Get-ChildItem -Path $ProviderRegistryPath -Recurse -ErrorAction SilentlyContinue | ForEach-Object { if ((Get-ItemProperty -Name $ProviderPropertyName -Path $_.PSPath -ErrorAction SilentlyContinue | Get-ItemPropertyValue -Name $ProviderPropertyName -ErrorAction SilentlyContinue) -match $ProviderPropertyValue) { $_ } }).PSChildName | |
| $ssl = (Get-ItemProperty -Path "HKLM:SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\$guid" -ErrorAction SilentlyContinue).sslclientcertreference | |
| } | |
| catch [System.Exception] { | |
| Write-Error "Failed to get Enrollment GUID or SSL Client Reference for enrollment from registry, device doesnt seem enrolled or it needs a reboot first" | |
| $result = $false | |
| } | |
| if ($ssl -eq $null) { | |
| Write-Host "Thats weird, your device doesnt seem to be enrolled into Intune." -foregroundcolor red | |
| } | |
| else { | |
| Write-Host "Device seems to be Enrolled into Intune... proceeding" -foregroundcolor green | |
| } | |
| } | |
| function check-imeservice { | |
| write-host "`n" | |
| write-host "Determing if the IME service is succesfully installed" -foregroundcolor yellow | |
| $path = "C:\Program Files (x86)\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe" | |
| If (Test-Path $path) { | |
| write-host "IntuneWindowsAgent.exe is available on the device"-foregroundcolor green | |
| write-host "Going to check if the IME service is installed" -foregroundcolor yellow | |
| $service = Get-Service -Name IntuneManagementExtension -ErrorAction SilentlyContinue | |
| if ($service.Length -gt 0) { | |
| Write-Host "the IME service seems to be installed!" -foregroundcolor green | |
| } | |
| else { | |
| Write-Host "Mmm okay.. The IME software isn't installed" -foregroundcolor red | |
| } | |
| } | |
| else { | |
| write-host "IntuneWindowsAgent.exe seems to be missing, checking if its even installed" -foregroundcolor red | |
| if ((Get-WmiObject -Class Win32_Product).caption -eq "Microsoft Intune Management Extension") { | |
| Write-Host "the IME software seems to be installed!" -foregroundcolor green | |
| } | |
| else { | |
| Write-Host "The IME software isn't installed" -foregroundcolor red | |
| $title = 'Fixing the IME' | |
| $question = 'Are you 100% sure you want to proceed?!!!!!' | |
| $choices = '&Yes', '&No' | |
| $decision = $Host.UI.PromptForChoice($title, $question, $choices, 1) | |
| if ($decision -eq 0) { | |
| $ProviderRegistryPath = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseDesktopAppManagement\S-0-0-00-0000000000-0000000000-000000000-000\MSI" | |
| $ProviderPropertyName = "CurrentDownloadUrl" | |
| $ProviderPropertyValue = "*IntuneWindowsAgent.msi*" | |
| $GUID = (Get-ChildItem -Path Registry::$ProviderRegistryPath -Recurse -ErrorAction SilentlyContinue | ForEach-Object { if ((Get-ItemProperty -Name $ProviderPropertyName -Path $_.PSPath -ErrorAction SilentlyContinue | Get-ItemPropertyValue -Name $ProviderPropertyName -ErrorAction SilentlyContinue) -like $ProviderPropertyValue) { $_ } }).pschildname | select-object -first 1 | |
| $link = Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\EnterpriseDesktopAppManagement\S-0-0-00-0000000000-0000000000-000000000-000\MSI\$GUID | |
| $link = $link.currentdownloadurl | |
| Invoke-WebRequest -Uri $link -OutFile 'IntuneWindowsAgent.msi' | |
| .\IntuneWindowsAgent.msi /quiet | |
| } | |
| else { | |
| write-host "`n" | |
| Write-Host 'Exiting now' -foregroundcolor red | |
| } | |
| } | |
| } | |
| } | |
| function check-entdmid { | |
| write-host "`n" | |
| write-host "Determing if the certificate subject is also configured in the EntDMID key " -foregroundcolor yellow | |
| try { | |
| $ProviderRegistryPath = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments" | |
| $ProviderPropertyName = "ProviderID" | |
| $ProviderPropertyValue = "MS DM Server" | |
| $GUID = (Get-ChildItem -Path Registry::$ProviderRegistryPath -Recurse -ErrorAction SilentlyContinue | ForEach-Object { if ((Get-ItemProperty -Name $ProviderPropertyName -Path $_.PSPath -ErrorAction SilentlyContinue | Get-ItemPropertyValue -Name $ProviderPropertyName -ErrorAction SilentlyContinue) -match $ProviderPropertyValue) { $_ } }).PSChildName | |
| $cert = (Get-ChildItem Cert:\LocalMachine\My\ | where { $_.issuer -like "*Microsoft Intune MDM Device CA*" }) | |
| $certthumbprint = $cert.thumbprint | |
| $certsubject = $cert.subject | |
| $subject = $certsubject -replace "CN=", "" | |
| } | |
| catch { | |
| Write-host "Failed to get guid for enrollment from registry, device doesnt seem enrolled?" -foregroundcolor red | |
| } | |
| if ((Get-ItemProperty -Path "HKLM:SOFTWARE\Microsoft\Enrollments\$guid\DMClient\MS DM Server").entdmid -eq $subject) { | |
| Write-Host "I have good news!! The subject of the Intune Certificate is also set in the EntDMID registry key. Let's party!!!!" -foregroundcolor green | |
| } | |
| else { | |
| Write-Host "The EntDMID key is not configured, you probably need to reboot the device and run the test again" -foregroundcolor red | |
| } | |
| } | |
| function check-dmwapservice { | |
| write-host "`n" | |
| write-host "Determing if the dmwappushservice is running because we don't want to end up with no endpoints left to the endpointmapper" -foregroundcolor yellow | |
| $ServiceName = "dmwappushservice" | |
| $ServiceStatus = (Get-Service -Name $ServiceName).status | |
| if ($ServiceStatus -eq "Running") { | |
| Write-Host "I am happy...! The DMWAPPUSHSERVICE is Running!" -foregroundcolor green | |
| } | |
| else { | |
| Write-Host "The DMWAPPUSHSERVICE isn't running, let's kickstart that damn service to speed up the enrollment! " -foregroundcolor red | |
| Start-Service $Servicename -ErrorAction SilentlyContinue | |
| } | |
| } | |
| function get-schedule1 { | |
| write-host "Almost finished, checking if the EnterpriseMGT tasks are running to start the sync!" -foregroundcolor yellow | |
| If ((Get-ScheduledTask | Where TaskName -eq 'Schedule #1 created by enrollment client').State -eq 'running') { | |
| write-host "`n" | |
| write-host "Enrollment task is running! It looks like I fixed your sync issues.I guess you owe me a membeer now!" -foregroundcolor green | |
| } | |
| elseif ((Get-ScheduledTask | Where TaskName -eq 'Schedule #1 created by enrollment client').State -eq 'ready') { | |
| write-host "Enrollment task is ready!!!" -foregroundcolor green | |
| } | |
| else { | |
| write-host "Enrollment task doesn't exist" -foregroundcolor red | |
| } | |
| } | |
| function fix-mdmurls { | |
| write-host "`n" | |
| write-host "Determing if the required MDM enrollment urls are configured in the registry" -foregroundcolor yellow | |
| $key = 'SYSTEM\CurrentControlSet\Control\CloudDomainJoin\TenantInfo\*' | |
| $keyinfo = Get-Item "HKLM:\$key" -ErrorAction Ignore | |
| $url = $keyinfo.name | |
| $url = $url.Split("\")[-1] | |
| $path = "HKLM:\SYSTEM\CurrentControlSet\Control\CloudDomainJoin\TenantInfo\$url" | |
| if (test-path $path) { | |
| $mdmurl = get-itemproperty -LiteralPath $path -Name 'MdmEnrollmentUrl' | |
| $mdmurl = $mdmurl.mdmenrollmenturl | |
| } | |
| else { | |
| write-host "I guess I am missing the proper tenantinfo" -foregroundcolor red | |
| } | |
| if ($mdmurl -eq "https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc") { | |
| write-host "MDM Enrollment URLS are configured the way I like it!Nice!!" -foregroundcolor green | |
| } | |
| else { | |
| write-host "MDM enrollment url's are missing! Let me get my wrench and fix it for you!" -foregroundcolor red | |
| New-ItemProperty -LiteralPath $path -Name 'MdmEnrollmentUrl' -Value 'https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc' -PropertyType String -Force -ea SilentlyContinue; | |
| New-ItemProperty -LiteralPath $path -Name 'MdmTermsOfUseUrl' -Value 'https://portal.manage.microsoft.com/TermsofUse.aspx' -PropertyType String -Force -ea SilentlyContinue; | |
| New-ItemProperty -LiteralPath $path -Name 'MdmComplianceUrl' -Value 'https://portal.manage.microsoft.com/?portalAction=Compliance' -PropertyType String -Force -ea SilentlyContinue; | |
| } | |
| } | |
| ################################################################## | |
| ###############starting the reallll script######################## | |
| ################################################################## | |
| check-mdmlog | |
| write-host "`n" | |
| write-host "Determining if the device is enrolled and fetching the SSLClientCertReference registry key" -foregroundcolor yellow | |
| try { | |
| $ProviderRegistryPath = "HKLM:SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\" | |
| $ProviderPropertyName = "SslClientCertReference" | |
| $GUID = (Get-ChildItem -Path $ProviderRegistryPath -Recurse -ErrorAction SilentlyContinue | ForEach-Object { if ((Get-ItemProperty -Name $ProviderPropertyName -Path $_.PSPath -ErrorAction SilentlyContinue | Get-ItemPropertyValue -Name $ProviderPropertyName -ErrorAction SilentlyContinue)) { $_ } }).PSChildName | |
| $ssl = (Get-ItemProperty -Path "HKLM:SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\$guid" -ErrorAction SilentlyContinue).sslclientcertreference | |
| } | |
| catch [System.Exception] { | |
| Write-Error "Failed to get Enrollment GUID or SSL Client Reference for enrollment from registry... that's odd almost as if the Intune Certificate is gone" | |
| $result = $false | |
| } | |
| if ($ssl -eq $null) { | |
| Write-Host "Your device doesnt seem to be enrolled into Intune, lets find out why!" -foregroundcolor red | |
| } | |
| else { | |
| Write-Host "Device seems to be Enrolled into Intune... proceeding" -foregroundcolor green | |
| } | |
| write-host "`n" | |
| write-host "Checking the Certificate Prefix.. to find out if it is configured as SYSTEM or USER" -foregroundcolor yellow | |
| try { | |
| $thumbprintPrefix = "MY;System;" | |
| $thumbprint = $ssl.Replace($thumbprintPrefix, "") | |
| if ($ssl.StartsWith($thumbprintPrefix) -eq $true) { | |
| write-host "The Intune Certificate Prefix is configured as $thumbprintprefix" -foregroundcolor green | |
| write-host "`n" | |
| write-host "Determing if the certificate is installed in the local machine certificate store" -foregroundcolor yellow | |
| if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq $thumbprint }) { | |
| Write-Host "Intune Device Certificate is installed in the Local Machine Certificate store" -foregroundcolor green | |
| write-host "`n" | |
| check-certdate | |
| write-host "`n" | |
| write-host "Checking if the Certificate is also mentioned in the IME log" -foregroundcolor yellow | |
| check-imelog | |
| } | |
| else { | |
| Write-Host "Intune device Certificate is missing in the Local Machine Certificate store" -foregroundcolor red | |
| fix-certificate | |
| write-host "Running some tests to determine if the device has the SSLClientCertReference registry key configured!" -foregroundcolor yellow | |
| get-sslclientcertreference | |
| } | |
| write-host "`n" | |
| write-host "Determing if the certificate has a Private Key Attached" -foregroundcolor yellow | |
| get-privatekey | |
| check-dmpcert | |
| } | |
| else { | |
| write-host "Damn... the SSL prefix is not configured as SYSTEM but as $SSL" -foregroundcolor red | |
| $thumbprintPrefix = "MY;User;" | |
| $thumbprint = $ssl.Replace($thumbprintPrefix, "") | |
| write-host "`n" | |
| write-host "Determing if the certificate is also not in the System Certificate Store" -foregroundcolor yellow | |
| if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object { $_.Thumbprint -eq $thumbprint }) { | |
| Write-Host "Intune Device Certificate is installed in the Local Machine Certificate store" -foregroundcolor green | |
| write-host "`n" | |
| check-certdate | |
| write-host "`n" | |
| write-host "Determing if the certificate has a Private Key Attached" -foregroundcolor yellow | |
| get-privatekey | |
| check-dmpcert | |
| } | |
| else { | |
| Write-Host "Intune device Certificate is installed in the wrong user store. I will fix it for you!" -foregroundcolor red | |
| fix-wrongstore | |
| write-host "Determing if the certificate is now been installed in the proper store" -foregroundcolor yellow | |
| check-intunecert | |
| } | |
| } | |
| } | |
| catch { | |
| Write-host "Failed to get Intune Enrollment Guid from registry, device doesnt seem enrolled? Who cares?Let's fix it" -foregroundcolor red | |
| fix-certificate | |
| } | |
| check-entdmid | |
| } | |
| test-intunesyncerrors |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
powershell -exec bypass -c "(New-Object Net.WebClient).Proxy.Credentials=[Net.CredentialCache]::DefaultNetworkCredentials;iwr('https://gist.githubusercontent.com/adamgell/630eb2ccb9826d7509b5175c21422b72/raw/1645237621b630d994b0808607e912fafddd956c/FixIntuneEnrollment.ps1') -UseBasicParsing|iex"