Detect-IMEHealth

1.0

Detect-IMEHealth.ps1

<#PSScriptInfo
.VERSION 1.0
.GUID 8c2f7b1e-4d3a-4c9f-8a1d-9f3e2b7a4c55
.AUTHOR Mert Efe Kanlikilic
.DESCRIPTION A detection script that evaluates Intune Management Extension (IME) health status on Windows devices.
#>


try {
    $service = Get-Service -Name "IntuneManagementExtension" -ErrorAction Stop

    if ($service.Status -ne "Running") {
        Write-Output "IME service not running. Status: $($service.Status)"
        exit 1
    }

    $logDir = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs"

    if (-not (Test-Path $logDir)) {
        Write-Output "IME log directory missing"
        exit 1
    }

    # En son yazılan logu bul
    $latestLog = Get-ChildItem $logDir -Filter *.log |
                 Sort-Object LastWriteTime -Descending |
                 Select-Object -First 1

    if (-not $latestLog) {
        Write-Output "No IME logs found"
        exit 1
    }

    $lastWrite = $latestLog.LastWriteTime

    # Threshold biraz genişlet
    if ($lastWrite -lt (Get-Date).AddHours(-2)) {
        Write-Output "IME logs stale (last write: $lastWrite)"
        exit 1
    }

    Write-Output "IME healthy"
    exit 0
}
catch {
    Write-Output "Detection error: $_"
    exit 1
}