Microsoft Intune¶

# The OMA-URI:
# ./Device/Vendor/MSFT/Policy/Config/System/AllowTelemetry
# Maps to this registry key:
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection"
$valueName = "AllowTelemetry"

# Verify the setting was applied
$val = Get-ItemProperty -Path $regPath -Name $valueName -ErrorAction SilentlyContinue
Write-Output "AllowTelemetry = $($val.$valueName)"

# Verify custom OMA-URI was applied
$path = "HKLM:\SOFTWARE\CustomApp\Settings"
$val = (Get-ItemProperty -Path $path -Name "EnableFeature" -ErrorAction SilentlyContinue).EnableFeature
Write-Output "EnableFeature = $val"

# List all policies applied via MDM (Intune)
$policyPath = "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device"
Get-ChildItem $policyPath -ErrorAction SilentlyContinue |
    Select-Object PSChildName | Sort-Object PSChildName

# Explore Update policies applied via Intune
$updatePath = "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Update"
Get-ItemProperty -Path $updatePath -ErrorAction SilentlyContinue |
    Select-Object ActiveHoursStart, ActiveHoursEnd, DeferFeatureUpdatesPeriodInDays,
        DeferQualityUpdatesPeriodInDays

# Check which provider set a specific policy
$provPath = "HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers"
Get-ChildItem $provPath -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.PSChildName -eq "Update" } |
    ForEach-Object { Get-ItemProperty $_.PSPath } |
    Select-Object ActiveHoursStart, ActiveHoursEnd

# Simulate what Intune checks for a Win32 app detection
$keyPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7-Zip"
$valueName = "DisplayVersion"
$expectedVersion = "23.01"

if (Test-Path $keyPath) {
    $actual = (Get-ItemProperty -Path $keyPath -Name $valueName -ErrorAction SilentlyContinue).$valueName
    if ($actual -and [version]$actual -ge [version]$expectedVersion) {
        Write-Output "DETECTE : $valueName = $actual (>= $expectedVersion)"
    } else {
        Write-Output "NON DETECTE : $valueName = $actual (< $expectedVersion)"
    }
} else {
    Write-Output "NON DETECTE : cle inexistante"
}

# Check both registry paths for 32-bit and 64-bit
$guid = "{23170F69-40C1-2702-2408-000001000000}"
$paths = @{
    "64-bit" = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$guid"
    "32-bit" = "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\$guid"
}

foreach ($arch in $paths.Keys) {
    $exists = Test-Path $paths[$arch]
    Write-Output "${arch} : $exists"
}

# Compliance discovery script — checks if BitLocker policy is correctly applied
$results = @{}

# Check 1: BitLocker encryption method
$blPath = "HKLM:\SOFTWARE\Policies\Microsoft\FVE"
$encMethod = (Get-ItemProperty -Path $blPath -Name "EncryptionMethodWithXtsOs" `
    -ErrorAction SilentlyContinue).EncryptionMethodWithXtsOs
$results["BitLockerEncryption"] = if ($encMethod -eq 7) { "Compliant" } else { "NonCompliant" }

# Check 2: Windows Defender real-time protection
$defPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection"
$rtProtect = (Get-ItemProperty -Path $defPath -Name "DisableRealtimeMonitoring" `
    -ErrorAction SilentlyContinue).DisableRealtimeMonitoring
$results["DefenderRealtime"] = if ($rtProtect -ne 1) { "Compliant" } else { "NonCompliant" }

# Output JSON for Intune compliance engine
$results | ConvertTo-Json -Compress

# Structured compliance output for Intune Custom Compliance
$compliancePayload = @(
    @{
        SettingName = "BitLockerEncryptionMethod"
        Operator    = "IsEquals"
        DataType    = "Int64"
        Operand     = 7
        MoreInfoUrl = "https://learn.microsoft.com/windows/security/operating-system-security/data-protection/bitlocker/"
        RemediationStrings = @(
            @{
                Language = "en_US"
                Title    = "BitLocker must use AES-256-XTS"
                Description = "Configure BitLocker to use XTS-AES 256-bit encryption."
            }
        )
    }
)

$compliancePayload | ConvertTo-Json -Depth 5

# List all MDM enrollments on the device
$enrollPath = "HKLM:\SOFTWARE\Microsoft\Enrollments"
Get-ChildItem $enrollPath -ErrorAction SilentlyContinue |
    ForEach-Object {
        $props = Get-ItemProperty $_.PSPath
        [PSCustomObject]@{
            EnrollmentID = $_.PSChildName
            ProviderID   = $props.ProviderId
            UPN          = $props.UPN
            EnrollType   = $props.EnrollmentType
        }
    } | Format-Table -AutoSize

# Check MDM authority
$mdmPath = "HKLM:\SOFTWARE\Microsoft\Enrollments\*"
$enrollments = Get-ChildItem $mdmPath -ErrorAction SilentlyContinue |
    Where-Object {
        (Get-ItemProperty $_.PSPath -Name "ProviderId" -ErrorAction SilentlyContinue).ProviderId -eq "MS DM Server"
    }

if ($enrollments) {
    $props = Get-ItemProperty $enrollments[0].PSPath
    Write-Output "Autorite MDM    : Intune (MS DM Server)"
    Write-Output "UPN             : $($props.UPN)"
    Write-Output "Tenant ID       : $($props.AADTenantID)"
    Write-Output "Type enrollment : $($props.EnrollmentType)"
} else {
    Write-Output "ATTENTION : aucun enrollment Intune detecte sur ce poste."
}

# Check co-management status
$coMgmtPath = "HKLM:\SOFTWARE\Microsoft\CCM\CoManagementHandler"
$props = Get-ItemProperty -Path $coMgmtPath -ErrorAction SilentlyContinue

if ($props) {
    Write-Output "Co-management actif : Oui"
    Write-Output "Authority workloads : $($props.Authority)"
    Write-Output "Capabilities        : $($props.CoManagementFlags)"
} else {
    Write-Output "Co-management : Non configure"
}

$paths = @(
    "HKLM:\SOFTWARE\Microsoft\CCM\CoManagementHandler",
    "HKLM:\SOFTWARE\Microsoft\DeviceManageabilityCSP"
)

foreach ($path in $paths) {
    Get-ItemProperty -Path $path -ErrorAction SilentlyContinue |
        Select-Object PSPath, Authority, CoManagementFlags, EnrollmentID
}

# Check IME installation and status
$imePath = "HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension"
$props = Get-ItemProperty -Path $imePath -ErrorAction SilentlyContinue

Write-Output "Version IME : $($props.Version)"

# Check the IME service
$svc = Get-Service IntuneManagementExtension -ErrorAction SilentlyContinue
Write-Output "Service IME : $($svc.Status)"

# Check script execution results
$scriptPath = "HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension\Policies"
Get-ChildItem $scriptPath -ErrorAction SilentlyContinue |
    ForEach-Object {
        $p = Get-ItemProperty $_.PSPath
        [PSCustomObject]@{
            PolicyId = $_.PSChildName
            Result   = $p.Result
            LastExec = $p.LastExecution
        }
    } | Format-Table -AutoSize

# Search for recent errors in IME logs
$logPath = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log"
if (Test-Path $logPath) {
    Get-Content $logPath -Tail 50 |
        Select-String -Pattern "Error|Failed|Exception"
}

# Force IME to re-sync with Intune
Restart-Service IntuneManagementExtension -Force

# Clear cached policy results to force re-evaluation
$cachePath = "HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension\Policies"
Get-ChildItem $cachePath -ErrorAction SilentlyContinue |
    ForEach-Object {
        Remove-ItemProperty $_.PSPath -Name "Result" -ErrorAction SilentlyContinue
        Remove-ItemProperty $_.PSPath -Name "LastExecution" -ErrorAction SilentlyContinue
    }

Write-Output "Cache IME nettoye. Re-synchronisation en cours..."

# Detection script: check if SMBv1 is disabled
$path = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"
$val = (Get-ItemProperty -Path $path -Name "SMB1" -ErrorAction SilentlyContinue).SMB1

if ($val -eq 0) {
    Write-Output "SMBv1 is disabled. Compliant."
    exit 0
} else {
    Write-Output "SMBv1 is NOT disabled. Remediation needed."
    exit 1
}

# Remediation script: disable SMBv1
$path = "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters"

try {
    Set-ItemProperty -Path $path -Name "SMB1" -Value 0 -Type DWord -Force
    Write-Output "SMBv1 disabled successfully."
    exit 0
} catch {
    Write-Output "Failed to disable SMBv1: $_"
    exit 1
}

# Check remediation execution history
$remPath = "HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension\SideCarPolicies\Scripts\Execution"
Get-ChildItem $remPath -Recurse -ErrorAction SilentlyContinue |
    Where-Object { $_.PSChildName -match "^\d+$" } |
    ForEach-Object {
        $p = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
        [PSCustomObject]@{
            PolicyGuid  = $_.PSParentPath.Split('\')[-1]
            RunIndex    = $_.PSChildName
            ExitCode    = $p.ExitCode
            ResultType  = $p.ResultType
        }
    } | Format-Table -AutoSize

# Detection script: verify Windows Update settings
$wuPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"
$autoUpdate = (Get-ItemProperty -Path $wuPath -Name "NoAutoUpdate" `
    -ErrorAction SilentlyContinue).NoAutoUpdate

if ($autoUpdate -eq 0 -or $null -eq $autoUpdate) {
    Write-Output "Windows Update automatic updates enabled. Compliant."
    exit 0
} else {
    Write-Output "Windows Update automatic updates DISABLED. Non-compliant."
    exit 1
}

# Remediation script: re-enable automatic updates
$wuPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU"

try {
    if (-not (Test-Path $wuPath)) {
        New-Item -Path $wuPath -Force | Out-Null
    }
    Set-ItemProperty -Path $wuPath -Name "NoAutoUpdate" -Value 0 -Type DWord -Force
    Write-Output "Automatic updates re-enabled successfully."
    exit 0
} catch {
    Write-Output "Failed to re-enable automatic updates: $_"
    exit 1
}

# The registry key that disables Windows Script Host
$path = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings"
$valueName = "Enabled"
$valueData = 0

# Check current state
$current = (Get-ItemProperty -Path $path -Name $valueName -ErrorAction SilentlyContinue).$valueName
Write-Output "Etat actuel de Windows Script Host : $(if($current -eq 0){'Desactive'}else{'Actif'})"

# Compliance detection script for WSH disabled
$path = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings"
$enabled = (Get-ItemProperty -Path $path -Name "Enabled" -ErrorAction SilentlyContinue).Enabled

if ($enabled -eq 0) {
    Write-Output "Windows Script Host is disabled. Compliant."
    exit 0
} else {
    Write-Output "Windows Script Host is ENABLED. Non-compliant."
    exit 1
}

# Full verification after Intune sync
Write-Output "=== Verification OMA-URI ==="

# Check 1: Registry value
$path = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings"
$val = (Get-ItemProperty -Path $path -Name "Enabled" -ErrorAction SilentlyContinue).Enabled
Write-Output "1. Registre WSH Enabled = $val (attendu: 0)"

# Check 2: MDM policy trace
$mdmPath = "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device"
Write-Output "2. PolicyManager accessible : $(Test-Path $mdmPath)"

# Check 3: Functional test — try to run a VBS script
$testVbs = "$env:TEMP\test-wsh.vbs"
Set-Content -Path $testVbs -Value 'WScript.Echo "test"'
$result = Start-Process wscript.exe -ArgumentList $testVbs -Wait -PassThru -ErrorAction SilentlyContinue
$exitCode = $result.ExitCode
Remove-Item $testVbs -Force
Write-Output "3. Execution VBS bloquee : $(if($exitCode -ne 0){'Oui'}else{'Non'})"

# Check 4: Intune enrollment active
$enrollments = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" -ErrorAction SilentlyContinue |
    Where-Object {
        (Get-ItemProperty $_.PSPath -Name "ProviderId" -ErrorAction SilentlyContinue).ProviderId -eq "MS DM Server"
    }
Write-Output "4. Enrollment Intune actif : $(if($enrollments){'Oui'}else{'Non'})"

# Remediation script: force WSH disable if OMA-URI failed
$path = "HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings"

if (-not (Test-Path $path)) {
    New-Item -Path $path -Force | Out-Null
}

Set-ItemProperty -Path $path -Name "Enabled" -Value 0 -Type DWord -Force

# Verify
$val = (Get-ItemProperty -Path $path -Name "Enabled").Enabled
if ($val -eq 0) {
    Write-Output "WSH desactive avec succes par remediation."
    exit 0
} else {
    Write-Output "Echec de la remediation WSH."
    exit 1
}