Azure AD Hybrid Join et GPO cloud¶

# Import the AAD Connect module (run on AAD Connect server or with AzureAD module)
Import-Module AzureAD

# Get your tenant ID
$tenantId = (Get-AzureADTenantDetail).ObjectId

# Build the AD configuration partition path
$configNC = (Get-ADRootDSE).configurationNamingContext

# Check if SCP already exists
$scp = Get-ADObject `
    -Filter { objectClass -eq "serviceConnectionPoint" -and name -eq "62a0ff2e-97b9-4513-943f-0d221bd30080" } `
    -SearchBase "CN=Device Registration Configuration,CN=Services,$configNC" `
    -Properties keywords -ErrorAction SilentlyContinue

if ($scp) {
    Write-Host "SCP found. Current keywords:" -ForegroundColor Cyan
    $scp.keywords
} else {
    Write-Host "SCP not found — creating..." -ForegroundColor Yellow

    # Create the SCP
    $scpDN = "CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,$configNC"
    New-ADObject -Name "62a0ff2e-97b9-4513-943f-0d221bd30080" `
        -Type "serviceConnectionPoint" `
        -Path "CN=Device Registration Configuration,CN=Services,$configNC" `
        -OtherAttributes @{
            keywords = @("azureADName:$((Get-AzureADDomain | Where-Object {$_.IsDefault}).Name)", "azureADId:$tenantId")
        }
    Write-Host "SCP created for tenant: $tenantId" -ForegroundColor Green
}

SCP found. Current keywords:
azureADName:contoso.onmicrosoft.com
azureADId:xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

# Run locally on the target machine (elevated not required for status check)
dsregcmd /status

# Run from a management workstation with RSAT and AzureAD module
$computers = Get-ADComputer -Filter {OperatingSystem -like "Windows 10*" -or OperatingSystem -like "Windows 11*"} `
    -Properties OperatingSystem, LastLogonDate |
    Where-Object { $_.LastLogonDate -gt (Get-Date).AddDays(-30) }

$results = foreach ($computer in $computers) {
    $session = New-PSSession -ComputerName $computer.Name -ErrorAction SilentlyContinue
    if ($session) {
        $status = Invoke-Command -Session $session -ScriptBlock {
            $raw = dsregcmd /status
            [PSCustomObject]@{
                AzureAdJoined = ($raw | Select-String "AzureAdJoined\s+:\s+(\w+)").Matches[0].Groups[1].Value
                DomainJoined  = ($raw | Select-String "DomainJoined\s+:\s+(\w+)").Matches[0].Groups[1].Value
                PRT           = ($raw | Select-String "AzureAdPrt\s+:\s+(\w+)").Matches[0].Groups[1].Value
            }
        }
        Remove-PSSession $session
        [PSCustomObject]@{
            Computer      = $computer.Name
            OS            = $computer.OperatingSystem
            HybridJoined  = $status.AzureAdJoined -eq "YES" -and $status.DomainJoined -eq "YES"
            PRTValid      = $status.PRT -eq "YES"
            LastLogon     = $computer.LastLogonDate
        }
    } else {
        [PSCustomObject]@{
            Computer     = $computer.Name
            OS           = $computer.OperatingSystem
            HybridJoined = "UNREACHABLE"
            PRTValid     = "UNREACHABLE"
            LastLogon    = $computer.LastLogonDate
        }
    }
}

$results | Sort-Object HybridJoined | Format-Table -AutoSize

# Check registry keys written by Cloud Policy (HKCU, per user)
$officePolicies = Get-ChildItem "HKCU:\SOFTWARE\Policies\Microsoft\Office" -Recurse -ErrorAction SilentlyContinue |
    Get-ItemProperty |
    Select-Object PSPath, * -ExcludeProperty PSPath, PSParentPath, PSChildName, PSDrive, PSProvider

$officePolicies | Where-Object { $_.PSPath -match "Office" } | Format-List

# Trigger MDM enrollment manually — useful after GPO push to validate
$enrollmentPath = "HKLM:\SOFTWARE\Microsoft\Enrollments"
$mdmTask = Get-ScheduledTask -TaskPath "\Microsoft\Windows\EnterpriseMgmt\*" |
    Where-Object { $_.TaskName -like "*Schedule*" } |
    Select-Object -First 1

if ($mdmTask) {
    Start-ScheduledTask -TaskPath $mdmTask.TaskPath -TaskName $mdmTask.TaskName
    Write-Host "MDM enrollment task triggered: $($mdmTask.TaskName)" -ForegroundColor Green
} else {
    Write-Host "No MDM enrollment scheduled task found — enrollment may not be configured" -ForegroundColor Yellow
    # Alternative: use DeviceEnroller directly
    & "$env:windir\system32\DeviceEnroller.exe" /c /AutoEnrollMDM
}

# Check enrollment status from the local machine
function Get-MDMEnrollmentStatus {
    $enrollmentKey = "HKLM:\SOFTWARE\Microsoft\Enrollments"
    $enrollments = Get-ChildItem $enrollmentKey -ErrorAction SilentlyContinue |
        Get-ItemProperty |
        Where-Object { $_.EnrollmentState -eq 1 } # 1 = enrolled

    if ($enrollments) {
        foreach ($e in $enrollments) {
            [PSCustomObject]@{
                EnrollmentId      = $e.PSChildName
                ProviderID        = $e.ProviderID
                UPN               = $e.UPN
                AADResourceID     = $e.AADResourceID
                EnrollmentState   = "Enrolled"
                LastSyncAttempt   = $e.LastSyncAttemptTime
            }
        }
    } else {
        Write-Warning "No active MDM enrollment found on this machine"
        Write-Host "Check: HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM\DisableMDMEnrollment" -ForegroundColor Cyan
    }
}

Get-MDMEnrollmentStatus

# Force an immediate MDM sync (useful after policy change)
$session = New-CimSession
Invoke-CimMethod -Namespace "root\cimv2\mdm\dmmap" `
    -ClassName "MDM_Client" `
    -MethodName "StartMDMEnrollmentCheckForUpdates" `
    -CimSession $session -ErrorAction Stop
Write-Host "MDM sync triggered" -ForegroundColor Green

# Run from a management workstation with RSAT + AzureAD module
# Identify AD computers with no corresponding AAD Device object

Import-Module AzureAD
Connect-AzureAD

# Get all AD computers (workstations, last logged on within 60 days)
$adComputers = Get-ADComputer -Filter {
    (OperatingSystem -like "Windows 10*" -or OperatingSystem -like "Windows 11*")
} -Properties LastLogonDate |
    Where-Object { $_.LastLogonDate -gt (Get-Date).AddDays(-60) }

# Get all AAD devices
$aadDevices = Get-AzureADDevice -All $true |
    Where-Object { $_.DeviceTrustType -eq "ServerAd" } # ServerAd = Hybrid Joined

$aadNames = $aadDevices.DisplayName | ForEach-Object { $_.ToLower() }

# Find AD computers not present in AAD
$notHybridJoined = $adComputers |
    Where-Object { $_.Name.ToLower() -notin $aadNames }

Write-Host "Machines in AD but NOT Hybrid Joined in AAD: $($notHybridJoined.Count)" -ForegroundColor Yellow
$notHybridJoined | Select-Object Name, OperatingSystem, LastLogonDate | Sort-Object LastLogonDate -Descending

# Force device registration — run on the affected machine
# Requires network access to both on-prem AD and Azure AD endpoints
dsregcmd /join

# Wait a few seconds, then verify
Start-Sleep -Seconds 10
dsregcmd /status | Select-String "(AzureAdJoined|DomainJoined|AzureAdPrt)"

# This script sets CDJ registry values directly — use as reference for GPO Preferences configuration
# In GPMC: Computer Config > Preferences > Windows Settings > Registry

$tenantId   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"  # Replace with your tenant GUID
$tenantName = "contoso.onmicrosoft.com"               # Replace with your tenant domain

$cdjPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD"

if (-not (Test-Path $cdjPath)) {
    New-Item -Path $cdjPath -Force | Out-Null
}

Set-ItemProperty -Path $cdjPath -Name "TenantId"   -Value $tenantId   -Type String
Set-ItemProperty -Path $cdjPath -Name "TenantName" -Value $tenantName -Type String

Write-Host "CDJ registry keys configured for tenant: $tenantName ($tenantId)" -ForegroundColor Green

# Run on a Domain Controller or machine with RSAT AD DS Tools
# Requires write access to the Configuration partition

$tenantId   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
$tenantName = "contoso.onmicrosoft.com"

$configNC = (Get-ADRootDSE).configurationNamingContext
$scpBaseDN = "CN=Device Registration Configuration,CN=Services,$configNC"

# Ensure the parent container exists
try {
    Get-ADObject -Identity $scpBaseDN | Out-Null
} catch {
    New-ADObject -Name "Device Registration Configuration" `
        -Type "container" `
        -Path "CN=Services,$configNC"
    Write-Host "Created parent container" -ForegroundColor Yellow
}

# Create the SCP object
$scpName = "62a0ff2e-97b9-4513-943f-0d221bd30080"
$existing = Get-ADObject -Filter { name -eq $scpName } -SearchBase $scpBaseDN -ErrorAction SilentlyContinue

if (-not $existing) {
    New-ADObject -Name $scpName `
        -Type "serviceConnectionPoint" `
        -Path $scpBaseDN `
        -OtherAttributes @{
            keywords = @("azureADName:$tenantName", "azureADId:$tenantId")
        }
    Write-Host "SCP created successfully" -ForegroundColor Green
} else {
    Set-ADObject -Identity $existing.DistinguishedName `
        -Replace @{ keywords = @("azureADName:$tenantName", "azureADId:$tenantId") }
    Write-Host "SCP updated for tenant: $tenantName" -ForegroundColor Cyan
}

SCP created successfully

# Run from management workstation — scans all Windows 10/11 machines
# Requires WinRM access to target machines

$computers = Get-ADComputer -Filter {
    OperatingSystem -like "Windows 10*" -or OperatingSystem -like "Windows 11*"
} -Properties LastLogonDate |
    Where-Object { $_.LastLogonDate -gt (Get-Date).AddDays(-30) }

$mdmKey    = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM"
$valueName = "DisableMDMEnrollment"

$results = foreach ($computer in $computers) {
    $session = New-PSSession -ComputerName $computer.Name -ErrorAction SilentlyContinue
    if ($session) {
        $status = Invoke-Command -Session $session -ScriptBlock {
            param($key, $val)
            $v = Get-ItemProperty -Path $key -Name $val -ErrorAction SilentlyContinue
            [PSCustomObject]@{
                KeyExists   = (Test-Path $key)
                ValueExists = ($null -ne $v)
                Value       = if ($v) { $v.$val } else { "NOT SET" }
                Blocked     = ($v -and $v.$val -eq 1)
            }
        } -ArgumentList $mdmKey, $valueName
        Remove-PSSession $session

        [PSCustomObject]@{
            Computer    = $computer.Name
            OS          = $computer.OperatingSystem
            KeyPresent  = $status.KeyExists
            ValueSet    = $status.ValueExists
            CurrentValue = $status.Value
            MDMBlocked  = $status.Blocked
        }
    } else {
        [PSCustomObject]@{
            Computer    = $computer.Name
            OS          = $computer.OperatingSystem
            KeyPresent  = "UNREACHABLE"
            ValueSet    = "UNREACHABLE"
            CurrentValue = "UNREACHABLE"
            MDMBlocked  = "UNREACHABLE"
        }
    }
}

# Report
$blocked = $results | Where-Object { $_.MDMBlocked -eq $true }
Write-Host "`nMachines with MDM enrollment BLOCKED: $($blocked.Count)" -ForegroundColor Red
$blocked | Format-Table Computer, OS, CurrentValue -AutoSize

$results | Export-Csv -Path "$env:TEMP\MDMEnrollmentAudit_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation -Encoding UTF8
Write-Host "Full report exported to: $env:TEMP\MDMEnrollmentAudit_$(Get-Date -Format yyyyMMdd).csv" -ForegroundColor Cyan

# Run elevated on the affected machine
# Use this for immediate unblocking — then deploy the fix via GPO

$mdmKeyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM"

if (Test-Path $mdmKeyPath) {
    $currentValue = Get-ItemProperty -Path $mdmKeyPath -Name "DisableMDMEnrollment" -ErrorAction SilentlyContinue

    if ($currentValue -and $currentValue.DisableMDMEnrollment -eq 1) {
        Set-ItemProperty -Path $mdmKeyPath -Name "DisableMDMEnrollment" -Value 0 -Type DWord
        Write-Host "DisableMDMEnrollment set to 0 — MDM enrollment re-enabled" -ForegroundColor Green

        # Trigger enrollment
        Write-Host "Triggering MDM enrollment..." -ForegroundColor Cyan
        & "$env:windir\system32\DeviceEnroller.exe" /c /AutoEnrollMDM
    } else {
        Write-Host "DisableMDMEnrollment is not set to 1 — no action needed" -ForegroundColor Green
    }
} else {
    Write-Host "MDM policy key does not exist — enrollment should be possible" -ForegroundColor Green
}

Write-Host "=== MDM ENROLLMENT VERIFICATION ===" -ForegroundColor Cyan

# 1. Check registry
$mdmKey = Get-ItemProperty `
    -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM" `
    -ErrorAction SilentlyContinue
Write-Host "`n[1] DisableMDMEnrollment:" -ForegroundColor Yellow
if ($mdmKey -and $mdmKey.DisableMDMEnrollment -eq 1) {
    Write-Host "    BLOCKED (value = 1)" -ForegroundColor Red
} else {
    Write-Host "    OK (value = 0 or not set)" -ForegroundColor Green
}

# 2. Check Hybrid Join status
Write-Host "`n[2] Hybrid Join status:" -ForegroundColor Yellow
$dsreg = dsregcmd /status
$azJoined = ($dsreg | Select-String "AzureAdJoined\s+:\s+(\w+)").Matches[0].Groups[1].Value
$domJoined = ($dsreg | Select-String "DomainJoined\s+:\s+(\w+)").Matches[0].Groups[1].Value
Write-Host "    AzureAdJoined : $azJoined" -ForegroundColor $(if ($azJoined -eq "YES") {"Green"} else {"Red"})
Write-Host "    DomainJoined  : $domJoined" -ForegroundColor $(if ($domJoined -eq "YES") {"Green"} else {"Red"})

# 3. Check MDM enrollment
Write-Host "`n[3] Active MDM enrollments:" -ForegroundColor Yellow
$enrollments = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" -ErrorAction SilentlyContinue |
    Get-ItemProperty | Where-Object { $_.EnrollmentState -eq 1 }
if ($enrollments) {
    $enrollments | ForEach-Object {
        Write-Host "    Enrolled — Provider: $($_.ProviderID), UPN: $($_.UPN)" -ForegroundColor Green
    }
} else {
    Write-Host "    No active enrollment found" -ForegroundColor Red
    Write-Host "    Wait 5-10 min after enabling enrollment, then re-run this check" -ForegroundColor Yellow
}

Write-Host "`n=== END VERIFICATION ===" -ForegroundColor Cyan

function Invoke-HybridJoinValidation {
    param(
        [string]$ComputerName = $env:COMPUTERNAME
    )

    Write-Host "`n===== HYBRID JOIN VALIDATION : $ComputerName =====" -ForegroundColor Cyan
    $score = 0
    $maxScore = 7

    # Test 1: Domain joined
    $domain = (Get-WmiObject Win32_ComputerSystem).Domain
    $isDomainJoined = $domain -ne "WORKGROUP" -and $domain -ne $env:COMPUTERNAME
    Write-Host "[$(if($isDomainJoined){'PASS'}else{'FAIL'})] Domain joined: $domain" `
        -ForegroundColor $(if($isDomainJoined){'Green'}else{'Red'})
    if ($isDomainJoined) { $score++ }

    # Test 2: Azure AD joined
    $dsreg = dsregcmd /status
    $aadJoined = ($dsreg | Select-String "AzureAdJoined\s+:\s+YES").Count -gt 0
    Write-Host "[$(if($aadJoined){'PASS'}else{'FAIL'})] Azure AD Joined" `
        -ForegroundColor $(if($aadJoined){'Green'}else{'Red'})
    if ($aadJoined) { $score++ }

    # Test 3: PRT valid
    $prtValid = ($dsreg | Select-String "AzureAdPrt\s+:\s+YES").Count -gt 0
    Write-Host "[$(if($prtValid){'PASS'}else{'FAIL'})] Primary Refresh Token valid" `
        -ForegroundColor $(if($prtValid){'Green'}else{'Red'})
    if ($prtValid) { $score++ }

    # Test 4: MDM enrollment not blocked
    $mdmKey = Get-ItemProperty `
        -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM" `
        -ErrorAction SilentlyContinue
    $mdmNotBlocked = -not ($mdmKey -and $mdmKey.DisableMDMEnrollment -eq 1)
    Write-Host "[$(if($mdmNotBlocked){'PASS'}else{'FAIL'})] MDM enrollment not blocked" `
        -ForegroundColor $(if($mdmNotBlocked){'Green'}else{'Red'})
    if ($mdmNotBlocked) { $score++ }

    # Test 5: MDM enrolled
    $enrolled = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" -ErrorAction SilentlyContinue |
        Get-ItemProperty | Where-Object { $_.EnrollmentState -eq 1 }
    $isEnrolled = $null -ne $enrolled
    Write-Host "[$(if($isEnrolled){'PASS'}else{'WARN'})] Active MDM enrollment: $(if($isEnrolled){$enrolled.ProviderID}else{'None'})" `
        -ForegroundColor $(if($isEnrolled){'Green'}else{'Yellow'})
    if ($isEnrolled) { $score++ }

    # Test 6: CDJ keys present
    $cdjPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD"
    $cdjPresent = Test-Path $cdjPath
    Write-Host "[$(if($cdjPresent){'PASS'}else{'WARN'})] CDJ registry keys present" `
        -ForegroundColor $(if($cdjPresent){'Green'}else{'Yellow'})
    if ($cdjPresent) { $score++ }

    # Test 7: Azure AD reachable
    try {
        $null = Invoke-WebRequest "https://login.microsoftonline.com" -UseBasicParsing -TimeoutSec 5
        $aadReachable = $true
    } catch { $aadReachable = $false }
    Write-Host "[$(if($aadReachable){'PASS'}else{'FAIL'})] Azure AD endpoints reachable" `
        -ForegroundColor $(if($aadReachable){'Green'}else{'Red'})
    if ($aadReachable) { $score++ }

    # Summary
    Write-Host "`nScore: $score / $maxScore" -ForegroundColor $(if($score -ge 6){'Green'}elseif($score -ge 4){'Yellow'}else{'Red'})
    Write-Host "==============================`n" -ForegroundColor Cyan
}

Invoke-HybridJoinValidation