Get-UserDeviceRegistrationEvents.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74

<#PSScriptInfo
 
.VERSION 1.3
 
.GUID 28a1b634-1267-415c-891d-4afb3a72e217
 
.AUTHOR Iain Borghoff
 
.COMPANYNAME
 
.COPYRIGHT
 
.TAGS Windows Autopilot
 
.LICENSEURI
 
.PROJECTURI
 
.ICONURI
 
.EXTERNALMODULEDEPENDENCIES
 
.REQUIREDSCRIPTS
 
.EXTERNALSCRIPTDEPENDENCIES
 
.RELEASENOTES
Version 1.0: Initial publish.
Version 1.1: Fixed script exiting after installing required module.
Version 1.2: Fixed previous fix in 1.1.
Version 1.3: Removed the export to XLSX. The file will now be generated as a CSV.
 
#>


<#
.DESCRIPTION
 Retrieves the User Device Registration events from the device and saves them as a log file to C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\[deviceserialnumber_udre.log]. This allows easy collection of the log file using the 'Collect Diagnostics' action from Endpoint. Be sure to change the extension on the log file to .csv before opening it. Alternatively, specify a file name and path to save it locally as a CSV file.
 
 .PARAMETER outputfile
The filename and path if saving as a CSV locally
 
.EXAMPLE
.\Get-UserDeviceRegistrationEvents.ps1
 
.EXAMPLE
.\Get-UserDeviceRegistrationEvents.ps1 -logfile C:\temp\udre.csv
#>


[CmdletBinding()]
param (
    $logfile
)

# Get device serial number
$serialnumber = (Get-WmiObject Win32_BIOS | Select-Object SerialNumber).Serialnumber
# Check if serial number is blank and if it is, get the baseboard serial number
if ($serialnumber.Trim() -eq "") {
    $serialnumber = (Get-WmiObject Win32_BaseBoard).SerialNumber
}

# Generate log or CSV of events
Write-Host 'Getting events...' -ForegroundColor Cyan

$events = Get-WinEvent -LogName 'Microsoft-Windows-User Device Registration/Admin' -Oldest | Where-Object { $_.ID -like '4096' -or $_.ID -like '304' -or $_.ID -like '306' -or $_.ID -like '334' -or $_.ID -like '335' } | Select-Object TimeCreated, ID, ProviderName, LevelDisplayName, Message

if ($logfile) {
    $events | Export-Csv -Path "$logfile" -NoTypeInformation
    Write-Host "CSV file generated - $logfile" -ForegroundColor Green
}
else {
    $events | Export-SV -Path "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\$($serialnumber)_udre.log" -NoTypeInformation
    Write-Host "Log generated - C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\$($serialnumber)_udre.log" -ForegroundColor Green
}