Get-UserDeviceRegistrationEvents.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

<#PSScriptInfo
 
.VERSION 1.1
 
.GUID 28a1b634-1267-415c-891d-4afb3a72e217
 
.AUTHOR Iain Borghoff
 
.COMPANYNAME
 
.COPYRIGHT
 
.TAGS Windows Autopilot
 
.LICENSEURI
 
.PROJECTURI
 
.ICONURI
 
.EXTERNALMODULEDEPENDENCIES
 
.REQUIREDSCRIPTS
 
.EXTERNALSCRIPTDEPENDENCIES
 
.RELEASENOTES
Version 1.0: Initial publish.
Version 1.1: Fixed script exiting after installing required module.
 
#>


<#
.DESCRIPTION
 Retrieves the User Device Registration events from the device and either save them as a log file to C:\ProgramData\Microsoft\IntuneManagementExtension\Logs (which will be included with the logs files collected with Collect Diagnostics from Endpoint), or specify a file name and path. Be sure to set/update the file extension to xlsx before opening the resulting file.
 
 .PARAMETER outputfile
The name and path of the log file
 
.EXAMPLE
.\Get-UserDeviceRegistrationEvents.ps1 -logfile C:\temp\udre.xlsx
#>


[CmdletBinding()]
param (
    $logfile
)

if (!(Get-InstalledModule | Where-Object { $_.Name -like 'ImportExcel' })) {
    try {
        Write-Host 'Installing ImportExcel module' -ForegroundColor Cyan
        Install-Module -Name ImportExcel -Force -ErrorAction SilentlyContinue
        Write-Host 'Module installed' -ForegroundColor Cyan

        Import-Module -Name ImportExcel

        # Get serial number
        $serialnumber = (Get-WmiObject Win32_BIOS | Select-Object SerialNumber).Serialnumber
        # Check if serial number is blank and if it is, get the baseboard serial number
        if ($serialnumber.Trim() -eq "") {
            $serialnumber = (Get-WmiObject Win32_BaseBoard).SerialNumber
        }

        Write-Host 'Getting events and generating report...' -ForegroundColor Cyan
    
        $events = Get-WinEvent -LogName 'Microsoft-Windows-User Device Registration/Admin' -Oldest | Where-Object { $_.ID -like '4096' -or $_.ID -like '304' -or $_.ID -like '306' -or $_.ID -like '334' -or $_.ID -like '335' } | Select-Object TimeCreated, ID, ProviderName, LevelDisplayName, Message
    
        if ($logfile) {
            $events | Export-Excel -path "$logfile"
        }
        else {
            $events | Export-Excel -path "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\$($serialnumber)_udre.log"
        }

        Write-Host 'Report generated' -ForegroundColor Green
    }
    catch {
        Write-Warning -message 'Module failed to install'
        Exit 1
    }
}