Migration GPO vers Intune¶

# Export a single GPO to XML for Group Policy Analytics import
Import-Module GroupPolicy

$gpoName    = "Baseline-Securite-Postes"
$outputPath = "C:\GPO_Export\$gpoName.xml"

Get-GPOReport -Name $gpoName -ReportType XML -Path $outputPath

Write-Host "Exported: $outputPath"

# Batch export all GPOs to XML for Group Policy Analytics bulk import
Import-Module GroupPolicy

$exportRoot = "C:\GPO_Export\$(Get-Date -Format 'yyyy-MM-dd')"
New-Item -ItemType Directory -Path $exportRoot -Force | Out-Null

$allGPOs = Get-GPO -All
$total   = $allGPOs.Count
$current = 0

foreach ($gpo in $allGPOs) {
    $current++
    # Sanitize GPO display name for use as filename
    $safeName   = $gpo.DisplayName -replace '[\\/:*?"<>|]', '_'
    $outputFile = Join-Path $exportRoot "$safeName.xml"

    try {
        Get-GPOReport -Guid $gpo.Id -ReportType XML -Path $outputFile
        Write-Host "[$current/$total] OK : $($gpo.DisplayName)"
    }
    catch {
        Write-Warning "[$current/$total] FAILED : $($gpo.DisplayName) — $($_.Exception.Message)"
    }
}

Write-Host "`nExport complete. Files saved to: $exportRoot"

[1/247] OK : Baseline-Securite-Postes
[2/247] OK : Config-Chrome-Entreprise
[3/247] OK : Redirect-Dossiers-Utilisateurs
...
[247/247] OK : Legacy-IE-Compat-Intranet

Export complete. Files saved to: C:\GPO_Export\2025-06-12

# Parse exported GPA CSV to identify not-supported settings by GPO
$gpaCsvPath = "C:\GPO_Export\GPA_Report_Export.csv"

$report = Import-Csv -Path $gpaCsvPath

# Group by GPO name and count supported vs not-supported
$summary = $report | Group-Object -Property 'GPO Name' | ForEach-Object {
    $settings        = $_.Group
    $supported       = ($settings | Where-Object { $_.MDMSupport -eq 'Supported' }).Count
    $notSupported    = ($settings | Where-Object { $_.MDMSupport -eq 'Not supported' }).Count
    $deprecated      = ($settings | Where-Object { $_.MDMSupport -eq 'Deprecated' }).Count
    $total           = $settings.Count
    $coveragePct     = if ($total -gt 0) { [math]::Round(($supported / $total) * 100, 1) } else { 0 }

    [PSCustomObject]@{
        GPOName      = $_.Name
        Total        = $total
        Supported    = $supported
        NotSupported = $notSupported
        Deprecated   = $deprecated
        Coverage_Pct = $coveragePct
    }
}

$summary | Sort-Object Coverage_Pct -Descending | Format-Table -AutoSize

# Verify that an MDM policy has been applied on a list of pilot machines
# Requires WinRM access and the MDM Diagnostics module

$pilotMachines = @("PC-PILOT-001", "PC-PILOT-002", "PC-PILOT-003")
# CSP path to check — adapt to the policy being migrated
$cspPath       = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
$valueName     = "WUServer"

foreach ($computer in $pilotMachines) {
    try {
        $result = Invoke-Command -ComputerName $computer -ScriptBlock {
            param($path, $val)
            $reg = Get-ItemProperty -Path $path -Name $val -ErrorAction SilentlyContinue
            [PSCustomObject]@{
                Computer   = $env:COMPUTERNAME
                ValueFound = ($null -ne $reg)
                Value      = $reg.$val
                # Check if value was set by MDM (written under SOFTWARE\Policies by MDM bridge)
                Source     = if (Test-Path "HKLM:\SOFTWARE\Microsoft\Enrollments") { "MDM-enrolled" } else { "Not enrolled" }
            }
        } -ArgumentList $cspPath, $valueName
        $result
    }
    catch {
        Write-Warning "Cannot reach $computer : $($_.Exception.Message)"
    }
}

Computer      ValueFound Value                         Source
--------      ---------- -----                         ------
PC-PILOT-001  True       https://wsus.corp.local:8530  MDM-enrolled
PC-PILOT-002  True       https://wsus.corp.local:8530  MDM-enrolled
PC-PILOT-003  True       https://wsus.corp.local:8530  MDM-enrolled

# Detection script: check if the registry value expected from the legacy startup script is present
$expectedKey   = "HKLM:\SOFTWARE\Corp\StartupConfig"
$expectedValue = "Configured"
$expectedData  = "v2.1"

try {
    $actual = Get-ItemPropertyValue -Path $expectedKey -Name $expectedValue -ErrorAction Stop
    if ($actual -eq $expectedData) {
        # Compliant — no remediation needed
        exit 0
    }
    else {
        # Value exists but wrong data
        exit 1
    }
}
catch {
    # Key or value missing
    exit 1
}

# Remediation script: apply what the legacy GPO startup script used to do
$targetKey   = "HKLM:\SOFTWARE\Corp\StartupConfig"
$targetValue = "Configured"
$targetData  = "v2.1"

try {
    if (-not (Test-Path $targetKey)) {
        New-Item -Path $targetKey -Force | Out-Null
    }
    Set-ItemProperty -Path $targetKey -Name $targetValue -Value $targetData -Type String
    Write-Host "Remediation applied successfully."
    exit 0
}
catch {
    Write-Error "Remediation failed: $($_.Exception.Message)"
    exit 1
}

# Compare GPO-managed vs MDM-managed registry values on a set of machines
# to detect potential write conflicts during co-management
$machines = @("PC-001", "PC-002", "PC-003", "PC-004", "PC-005",
              "PC-006", "PC-007", "PC-008", "PC-009", "PC-010")

# Define key paths to check — adapt to your workload
$checks = @(
    @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"; Value = "WUServer" },
    @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender";      Value = "DisableAntiSpyware" },
    @{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge";                  Value = "HomepageLocation" }
)

$results = foreach ($machine in $machines) {
    foreach ($check in $checks) {
        try {
            $data = Invoke-Command -ComputerName $machine -ScriptBlock {
                param($p, $v)
                $val = Get-ItemProperty -Path $p -Name $v -ErrorAction SilentlyContinue
                # Check MDM bridge enrollment
                $mdmEnrolled = (Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" -ErrorAction SilentlyContinue).Count -gt 0

                # GPO last write time from RSOP (approx — check GPO policy source)
                $gpResult = (& gpresult /scope computer /fo csv 2>$null) -join "`n"

                [PSCustomObject]@{
                    Machine    = $env:COMPUTERNAME
                    RegPath    = $p
                    RegValue   = $v
                    Data       = $val.$v
                    MDMActive  = $mdmEnrolled
                }
            } -ArgumentList $check.Path, $check.Value
            $data
        }
        catch {
            [PSCustomObject]@{
                Machine   = $machine
                RegPath   = $check.Path
                RegValue  = $check.Value
                Data      = "UNREACHABLE"
                MDMActive = $false
            }
        }
    }
}

$results | Format-Table -AutoSize
$results | Export-Csv -Path "C:\GPO_Export\ConflictCheck_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

# Download the latest Chrome ADMX bundle from Google
# Adapt the URL to the version you need — check https://chromeenterprise.google/browser/download/
$chromeAdmxUrl = "https://dl.google.com/dl/edgedl/chrome/policy/policy_templates.zip"
$destZip       = "C:\ADMX_Import\chrome_policy_templates.zip"
$destExtract   = "C:\ADMX_Import\chrome"

New-Item -ItemType Directory -Path "C:\ADMX_Import" -Force | Out-Null

Invoke-WebRequest -Uri $chromeAdmxUrl -OutFile $destZip
Expand-Archive -Path $destZip -DestinationPath $destExtract -Force

# ADMX files are in the windows\admx subfolder
$admxFiles = Get-ChildItem -Path "$destExtract\windows\admx" -Filter "*.admx"
Write-Host "Found ADMX files:"
$admxFiles | Select-Object Name

# Verify that an ADMX-backed Intune policy has written the expected registry value
# Run locally on the target machine or via Invoke-Command

$checks = @(
    @{
        Description = "Chrome Homepage via Intune ADMX"
        Path        = "HKLM:\SOFTWARE\Policies\Google\Chrome"
        Value       = "HomepageLocation"
        Expected    = "https://intranet.corp.local"
    },
    @{
        Description = "Firefox default browser check disabled"
        Path        = "HKLM:\SOFTWARE\Policies\Mozilla\Firefox"
        Value       = "DontCheckDefaultBrowser"
        Expected    = 1
    }
)

foreach ($check in $checks) {
    $actual = Get-ItemProperty -Path $check.Path -Name $check.Value -ErrorAction SilentlyContinue
    $status = if ($actual -and ($actual.($check.Value) -eq $check.Expected)) { "OK" } else { "MISSING/WRONG" }
    Write-Host "[$status] $($check.Description) — Expected: $($check.Expected) / Got: $($actual.($check.Value))"
}

[OK] Chrome Homepage via Intune ADMX — Expected: https://intranet.corp.local / Got: https://intranet.corp.local
[OK] Firefox default browser check disabled — Expected: 1 / Got: 1

# Validate MDM policy application on N machines before deleting the source GPO
# Run this script 24h after enabling the Intune profile, then again after 2 weeks

param(
    [string[]] $Computers   = @("PC-001","PC-002","PC-003","PC-004","PC-005",
                                "PC-006","PC-007","PC-008","PC-009","PC-010"),
    [string]   $RegPath     = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate",
    [string]   $RegValue    = "WUServer",
    [string]   $ExpectedVal = "https://wsus.corp.local:8530",
    [string]   $GPOName     = "Config-WSUS-Postes"
)

$results = foreach ($computer in $Computers) {
    try {
        Invoke-Command -ComputerName $computer -ScriptBlock {
            param($path, $val, $expected, $gpoName)

            # Read current registry value
            $current = (Get-ItemProperty -Path $path -Name $val -ErrorAction SilentlyContinue).$val

            # Check MDM enrollment status
            $enrollments = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" -ErrorAction SilentlyContinue
            $mdmEnrolled = $enrollments.Count -gt 0

            # Check last MDM sync time
            $syncLog = Get-WinEvent -LogName "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" `
                -MaxEvents 1 -ErrorAction SilentlyContinue
            $lastSync = if ($syncLog) { $syncLog.TimeCreated } else { "Unknown" }

            [PSCustomObject]@{
                Computer    = $env:COMPUTERNAME
                RegValue    = $current
                ValueMatch  = ($current -eq $expected)
                MDMEnrolled = $mdmEnrolled
                LastMDMSync = $lastSync
                ReadyForGPODelete = ($current -eq $expected) -and $mdmEnrolled
            }
        } -ArgumentList $RegPath, $RegValue, $ExpectedVal, $GPOName
    }
    catch {
        [PSCustomObject]@{
            Computer          = $computer
            RegValue          = "UNREACHABLE"
            ValueMatch        = $false
            MDMEnrolled       = $false
            LastMDMSync       = "N/A"
            ReadyForGPODelete = $false
        }
    }
}

$results | Format-Table -AutoSize

$notReady = $results | Where-Object { -not $_.ReadyForGPODelete }
if ($notReady.Count -gt 0) {
    Write-Warning "$($notReady.Count) machine(s) NOT ready. Do NOT delete GPO '$GPOName' yet."
    $notReady | Select-Object Computer, RegValue, MDMEnrolled, LastMDMSync | Format-Table -AutoSize
}
else {
    Write-Host "All $($results.Count) machines validated. Safe to proceed with GPO deletion." -ForegroundColor Green
}

Computer    RegValue                      ValueMatch MDMEnrolled LastMDMSync           ReadyForGPODelete
--------    --------                      ---------- ----------- -----------           -----------------
PC-001      https://wsus.corp.local:8530  True       True        04/06/2025 08:32:11   True
PC-002      https://wsus.corp.local:8530  True       True        04/06/2025 09:14:55   True
...
PC-010      https://wsus.corp.local:8530  True       True        04/06/2025 07:58:02   True

All 10 machines validated. Safe to proceed with GPO deletion.

PC-007      UNREACHABLE                   False      False       N/A                   False
PC-009      https://old-wsus:8530         False      True        03/06/2025 22:11:40   False

WARNING: 2 machine(s) NOT ready. Do NOT delete GPO 'Config-WSUS-Postes' yet.

# Post-migration audit: verify Intune policy is active and no GPO remnants remain
# Run from a management machine with WinRM access to targets

param(
    [string[]] $Computers = @("PC-001","PC-002","PC-003"),
    [string]   $DeletedGPOName = "Config-WSUS-Postes"
)

foreach ($computer in $Computers) {
    Write-Host "`n=== $computer ===" -ForegroundColor Cyan
    try {
        Invoke-Command -ComputerName $computer -ScriptBlock {
            param($gpoName)

            # 1. Check GPO is no longer in applied policies
            $rsopApplied = & gpresult /scope computer /fo csv 2>$null |
                ConvertFrom-Csv |
                Where-Object { $_.'Applied GPOs' -like "*$gpoName*" }

            if ($rsopApplied) {
                Write-Warning "  GPO '$gpoName' still appears in gpresult output!"
            }
            else {
                Write-Host "  [OK] GPO not found in applied policies"
            }

            # 2. Check MDM enrollment
            $mdmEnrolled = (Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" -ErrorAction SilentlyContinue).Count -gt 0
            Write-Host "  [$(if ($mdmEnrolled) { 'OK' } else { 'FAIL' })] MDM enrollment: $mdmEnrolled"

            # 3. Check last MDM sync
            $lastSync = (Get-WinEvent -LogName "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" `
                -MaxEvents 1 -ErrorAction SilentlyContinue)?.TimeCreated
            Write-Host "  [INFO] Last MDM sync: $lastSync"

            # 4. Check compliance status via MDM bridge
            $complianceKey = "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device"
            $complianceExists = Test-Path $complianceKey
            Write-Host "  [$(if ($complianceExists) { 'OK' } else { 'WARN' })] MDM PolicyManager active: $complianceExists"

        } -ArgumentList $DeletedGPOName
    }
    catch {
        Write-Warning "  Cannot reach $computer"
    }
}