IntuneSyncDebugTool.psm1

<#PSScriptInfo
.VERSION 0.12
.GUID 715a6707-796c-445f-9e8a-8a0fffd778a4
.AUTHOR Rudy Ooms
.COMPANYNAME
.COPYRIGHT
.TAGS Windows, AutoPilot, Powershell
.LICENSEURI
.PROJECTURI https://www.github.com
.ICONURI
.EXTERNALMODULEDEPENDENCIES
.REQUIREDSCRIPTS
.RELEASENOTES
Version 0.1: Initial Release.
version 0.2: added way more checks and fixes
version 0.3: added the mdmurls check
version 0.8: added the IME service check and reinstall functionality and improved some error handling
version 0.12: added a failsafe when your device is missing the enrollmentid
version 0.18: MMPC broke the script....
.PRIVATEDATA
#>

<#
.DESCRIPTION
.SYNOPSIS
GUI to fix intune sync issues.
MIT LICENSE
Copyright (c) 2022 Rudy Ooms
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
.DESCRIPTION
The goal of this script is to help with the troubleshooting of Attestation issues when enrolling your device with Autopilot for Pre-Provisioned deployments
.EXAMPLE
Blog post with examples and explanations @call4cloud.nl
.LINK
Online version: https://call4cloud.nl/
#>

function test-intunesyncerrors {

########
### Version 0.17 | This tool will check for missing Intune certificates, if the Certificate is in the wrong certificate store, and if the certificate has been expired
#######

# downloading gif if enrollment succeeds #

$path = "C:\temp"
if (!(Test-Path $path))
{
New-Item -Path $path -ItemType Directory -Force -Confirm:$false
}
$img = Invoke-WebRequest -Uri "https://call4cloud.nl/wp-content/uploads/2022/09/487ba55465e8cf5ff78ea5bf8cf06e4a.gif" -OutFile "$path\membeer.gif" -ErrorAction:Stop

Add-Type -AssemblyName System.Windows.Forms
$Form = New-Object System.Windows.Forms.Form
$Form.AutoSize = $true
$Form.StartPosition = "CenterScreen"

$Form.Text = "Membeer Player"
$Label = New-Object System.Windows.Forms.Label
$Label.Location = New-Object System.Drawing.Size(0,0)
$Label.AutoSize = $true
$Label.Font = New-Object System.Drawing.Font ("Comic Sans MS",20, [System.Drawing.Fontstyle]::Bold)
$Label.Text = "MDE Successful!"
$Form.Controls.Add($Label)

$gifBox = New-Object Windows.Forms.picturebox
$gifLink= (Get-Item -Path 'C:\temp\membeer.gif')
$img = [System.Drawing.Image]::fromfile($gifLink)
$gifBox.AutoSize = $true
$gifBox.Image = $img
$Form.Controls.Add($gifbox)


#################################
#defining some functions first###
###################################

function fix-wrongstore { 
                $title    = 'Fixing missing Certificate in the System Store'
                $question = 'Are you sure you want to proceed?'
                $choices  = '&Yes', '&No'
                $decision = $Host.UI.PromptForChoice($title, $question, $choices, 1)
                
                if ($decision -eq 0) 
                {        
                        $progressPreference = 'silentlyContinue'
                            write-host "Exporting and Importing the Intune certificate to the proper Certificate Store" -foregroundcolor yellow
                            Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/PSTools.zip' -OutFile 'pstools.zip'
                        Expand-Archive -Path 'pstools.zip' -DestinationPath "$env:TEMP\pstools" -force
                        #Move-Item -Path "$env:TEMP\pstools\psexec.exe" -force
                        reg.exe ADD HKCU\Software\Sysinternals /v EulaAccepted /t REG_DWORD /d 1 /f | out-null
                        Start-Process -windowstyle hidden -FilePath "$env:TEMP\pstools\psexec.exe" -ArgumentList '-s cmd /c "powershell.exe -ExecutionPolicy Bypass -encodedcommand JABjAGUAcgB0AGkAZgBpAGMAYQB0AGUAIAA9ACAARwBlAHQALQBDAGgAaQBsAGQASQB0AGUAbQAgAC0AUABhAHQAaAAgAEMAZQByAHQAOgBcAEMAdQByAHIAZQBuAHQAdQBzAGUAcgBcAE0AeQBcAAoAJABwAGEAcwBzAHcAbwByAGQAPQAgACIAcwBlAGMAcgBlAHQAIgAgAHwAIABDAG8AbgB2AGUAcgB0AFQAbwAtAFMAZQBjAHUAcgBlAFMAdAByAGkAbgBnACAALQBBAHMAUABsAGEAaQBuAFQAZQB4AHQAIAAtAEYAbwByAGMAZQAKAEUAeABwAG8AcgB0AC0AUABmAHgAQwBlAHIAdABpAGYAaQBjAGEAdABlACAALQBDAGUAcgB0ACAAJABjAGUAcgB0AGkAZgBpAGMAYQB0AGUAIAAtAEYAaQBsAGUAUABhAHQAaAAgAGMAOgBcAGkAbgB0AHUAbgBlAC4AcABmAHgAIAAtAFAAYQBzAHMAdwBvAHIAZAAgACQAcABhAHMAcwB3AG8AcgBkAAoASQBtAHAAbwByAHQALQBQAGYAeABDAGUAcgB0AGkAZgBpAGMAYQB0AGUAIAAtAEUAeABwAG8AcgB0AGEAYgBsAGUAIAAtAFAAYQBzAHMAdwBvAHIAZAAgACQAcABhAHMAcwB3AG8AcgBkACAALQBDAGUAcgB0AFMAdABvAHIAZQBMAG8AYwBhAHQAaQBvAG4AIABDAGUAcgB0ADoAXABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQBcAE0AeQAgAC0ARgBpAGwAZQBQAGEAdABoACAAYwA6AFwAaQBuAHQAdQBuAGUALgBwAGYAeAA="'
                }else{
                        Write-Host 'You dont like me fixing it...?Fine...exiting now' -foregroundcolor red
                    read-Host -prompt "Press any key to continue..."
                    exit
                }
}    

function check-certdate {
            Write-Host "Checking If the Certificate hasn't expired" -foregroundcolor yellow
            if ((Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Thumbprint -eq $thumbprint -and $_.NotAfter -lt (Get-Date)}) -eq $null)
            {
                Write-Host "Great!!! The Intune Device Certificate is not expired!! WOOP WOOP" -foregroundcolor green
            }else{
                Write-Host "Is this a shitstorm? because the Intune Device Certificate is EXPIRED!" -foregroundcolor red
                fix-certificate
            }
}



function check-intunecert{
                if (Get-ChildItem Cert:\LocalMachine\My\ | where{$_.issuer -like "*Microsoft Intune MDM Device CA*"}){
                write-Host "Intune Device Certificate is in installed in the Local Machine Certificate store" -foregroundcolor green
                }else{
                Write-Host "Intune device Certificate still seems to be missing... sorry!" -foregroundcolor red    
                }
}


function fix-certificate { 
                $title    = 'Fixing the Intune Enrollment'
                $question = 'Are you 100% sure you want to proceed? Because I will break everything...or not!!!!!'
                $choices  = '&Yes', '&No'
                $decision = $Host.UI.PromptForChoice($title, $question, $choices, 1)
                
                if ($decision -eq 0){
                        $progressPreference = 'silentlyContinue'
                            write-host "Trying to enroll your device into Intune or something else..." -foregroundcolor yellow
                        fix-mdmurls
                        Invoke-WebRequest -Uri 'https://download.sysinternals.com/files/PSTools.zip' -OutFile 'pstools.zip'
                        Expand-Archive -Path 'pstools.zip' -DestinationPath "$env:TEMP\pstools" -force
                        #Move-Item -Path "$env:TEMP\pstools\psexec.exe" -force
                        reg.exe ADD HKCU\Software\Sysinternals /v EulaAccepted /t REG_DWORD /d 1 /f | out-null
                        $enroll = Start-Process -windowstyle hidden -FilePath "$env:TEMP\pstools\psexec.exe" -ArgumentList '-s cmd /c "powershell.exe -ExecutionPolicy Bypass -encodedcommand JABSAGUAZwBpAHMAdAByAHkASwBlAHkAcwAgAD0AIAAiAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwARQBuAHIAbwBsAGwAbQBlAG4AdABzACIALAAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABFAG4AcgBvAGwAbABtAGUAbgB0AHMAXABTAHQAYQB0AHUAcwAiACwAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAEUAbgB0AGUAcgBwAHIAaQBzAGUAUgBlAHMAbwB1AHIAYwBlAE0AYQBuAGEAZwBlAHIAXABUAHIAYQBjAGsAZQBkACIALAAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABQAG8AbABpAGMAeQBNAGEAbgBhAGcAZQByAFwAQQBkAG0AeABJAG4AcwB0AGEAbABsAGUAZAAiACwAIAAiAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAUABvAGwAaQBjAHkATQBhAG4AYQBnAGUAcgBcAFAAcgBvAHYAaQBkAGUAcgBzACIALAAiAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAUAByAG8AdgBpAHMAaQBvAG4AaQBuAGcAXABPAE0AQQBEAE0AXABBAGMAYwBvAHUAbgB0AHMAIgAsACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFAAcgBvAHYAaQBzAGkAbwBuAGkAbgBnAFwATwBNAEEARABNAFwATABvAGcAZwBlAHIAIgAsACAAIgBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFAAcgBvAHYAaQBzAGkAbwBuAGkAbgBnAFwATwBNAEEARABNAFwAUwBlAHMAcwBpAG8AbgBzACIACgAKACQARQBuAHIAbwBsAGwAbQBlAG4AdABJAEQAIAA9ACAARwBlAHQALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQB0AGEAcwBrAG4AYQBtAGUAIAAnAFAAdQBzAGgATABhAHUAbgBjAGgAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAJABfAC4AVABhAHMAawBQAGEAdABoACAALQBsAGkAawBlACAAIgAqAE0AaQBjAHIAbwBzAG8AZgB0ACoAVwBpAG4AZABvAHcAcwAqAEUAbgB0AGUAcgBwAHIAaQBzAGUATQBnAG0AdAAqACIAfQAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABUAGEAcwBrAFAAYQB0AGgAIAAtAFUAbgBpAHEAdQBlACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAkAF8AIAAtAGwAaQBrAGUAIAAiACoALQAqAC0AKgAiAH0AIAB8ACAAUwBwAGwAaQB0AC0AUABhAHQAaAAgAC0ATABlAGEAZgAKAAoACQAJAGYAbwByAGUAYQBjAGgAIAAoACQASwBlAHkAIABpAG4AIAAkAFIAZQBnAGkAcwB0AHIAeQBLAGUAeQBzACkAIAB7AAoACQAJAAkACQBpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAALQBQAGEAdABoACAAJABLAGUAeQApACAAewAKAAkACQAJAAkACQBnAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBQAGEAdABoACAAJABLAGUAeQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAJABfAC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJABFAG4AcgBvAGwAbABtAGUAbgB0AEkARAB9ACAAfAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARgBvAHIAYwBlACAALQBDAG8AbgBmAGkAcgBtADoAJABmAGEAbABzAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAJAH0ACgB9AAoAJABJAG4AdAB1AG4AZQBDAGUAcgB0ACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDAGUAcgB0ADoAXABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQBcAE0AeQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsACgAJAAkAJABfAC4ASQBzAHMAdQBlAHIAIAAtAG0AYQB0AGMAaAAgACIASQBuAHQAdQBuAGUAIABNAEQATQAiACAACgAJAH0AIAB8ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtAAoAaQBmACAAKAAkAEUAbgByAG8AbABsAG0AZQBuAHQASQBEACAALQBuAGUAIAAkAG4AdQBsAGwAKQAgAHsAIAAKAAkAZgBvAHIAZQBhAGMAaAAgACgAJABlAG4AcgBvAGwAbABtAGUAbgB0ACAAaQBuACAAJABlAG4AcgBvAGwAbABtAGUAbgB0AGkAZAApAHsACgAJAAkACQBHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACQAXwAuAFQAYQBzAGsAcABhAHQAaAAgAC0AbQBhAHQAYwBoACAAJABFAG4AcgBvAGwAbABtAGUAbgB0AH0AIAB8ACAAVQBuAHIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAKAAkACQAJACQAcwBjAGgAZQBkAHUAbABlAE8AYgBqAGUAYwB0ACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAcwBjAGgAZQBkAHUAbABlAC4AcwBlAHIAdgBpAGMAZQAKAAkACQAJACQAcwBjAGgAZQBkAHUAbABlAE8AYgBqAGUAYwB0AC4AYwBvAG4AbgBlAGMAdAAoACkACgAJAAkACQAkAHIAbwBvAHQARgBvAGwAZABlAHIAIAA9ACAAJABzAGMAaABlAGQAdQBsAGUATwBiAGoAZQBjAHQALgBHAGUAdABGAG8AbABkAGUAcgAoACIAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABFAG4AdABlAHIAcAByAGkAcwBlAE0AZwBtAHQAIgApAAoACQAJAAkAJAByAG8AbwB0AEYAbwBsAGQAZQByAC4ARABlAGwAZQB0AGUARgBvAGwAZABlAHIAKAAkAEUAbgByAG8AbABsAG0AZQBuAHQALAAkAG4AdQBsAGwAKQAKAH0AIAAKAH0AIAAKAAoAJABFAG4AcgBvAGwAbABtAGUAbgB0AEkARABNAEQATQAgAD0AIABHAGUAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAB8ACAAVwBoAGUAcgBlAC0ATwBiAGoAZQBjAHQAIAB7ACQAXwAuAFQAYQBzAGsAUABhAHQAaAAgAC0AbABpAGsAZQAgACIAKgBNAGkAYwByAG8AcwBvAGYAdAAqAFcAaQBuAGQAbwB3AHMAKgBFAG4AdABlAHIAcAByAGkAcwBlAE0AZwBtAHQAKgAiAH0AIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAC0ARQB4AHAAYQBuAGQAUAByAG8AcABlAHIAdAB5ACAAVABhAHMAawBQAGEAdABoACAALQBVAG4AaQBxAHUAZQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAJABfACAALQBsAGkAawBlACAAIgAqAC0AKgAtACoAIgB9ACAAfAAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAtAEwAZQBhAGYACgAJAAkAZgBvAHIAZQBhAGMAaAAgACgAJABLAGUAeQAgAGkAbgAgACQAUgBlAGcAaQBzAHQAcgB5AEsAZQB5AHMAKQAgAHsACgAJAAkACQAJAGkAZgAgACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAEsAZQB5ACkAIAB7AAoACQAJAAkACQAJAGcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAEsAZQB5ACAAfAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBOAGEAbQBlACAALQBtAGEAdABjAGgAIAAkAEUAbgByAG8AbABsAG0AZQBuAHQASQBEAE0ARABNAH0AIAB8ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAEMAbwBuAGYAaQByAG0AOgAkAGYAYQBsAHMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAKAAkAfQAKAH0ACgBpAGYAIAAoACQARQBuAHIAbwBsAGwAbQBlAG4AdABJAEQATQBEAE0AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAAoACQBmAG8AcgBlAGEAYwBoACAAKAAkAGUAbgByAG8AbABsAG0AZQBuAHQAIABpAG4AIAAkAGUAbgByAG8AbABsAG0AZQBuAHQAaQBkAE0ARABNACkAewAKAAkACQAJAEcAZQB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsAJABfAC4AVABhAHMAawBwAGEAdABoACAALQBtAGEAdABjAGgAIAAkAEUAbgByAG8AbABsAG0AZQBuAHQAfQAgAHwAIABVAG4AcgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQwBvAG4AZgBpAHIAbQA6ACQAZgBhAGwAcwBlAAoACQAJAAkAJABzAGMAaABlAGQAdQBsAGUATwBiAGoAZQBjAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABzAGMAaABlAGQAdQBsAGUALgBzAGUAcgB2AGkAYwBlAAoACQAJAAkAJABzAGMAaABlAGQAdQBsAGUATwBiAGoAZQBjAHQALgBjAG8AbgBuAGUAYwB0ACgAKQAKAAkACQAJACQAcgBvAG8AdABGAG8AbABkAGUAcgAgAD0AIAAkAHMAYwBoAGUAZAB1AGwAZQBPAGIAagBlAGMAdAAuAEcAZQB0AEYAbwBsAGQAZQByACgAIgBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEUAbgB0AGUAcgBwAHIAaQBzAGUATQBnAG0AdAAiACkACgAJAAkACQAkAHIAbwBvAHQARgBvAGwAZABlAHIALgBEAGUAbABlAHQAZQBGAG8AbABkAGUAcgAoACQARQBuAHIAbwBsAGwAbQBlAG4AdAAsACQAbgB1AGwAbAApAAoAfQAgAAoAJABJAG4AdAB1AG4AZQBDAGUAcgB0ACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIABDAGUAcgB0ADoAXABMAG8AYwBhAGwATQBhAGMAaABpAG4AZQBcAE0AeQAgAHwAIABXAGgAZQByAGUALQBPAGIAagBlAGMAdAAgAHsACgAJAAkAJABfAC4ASQBzAHMAdQBlAHIAIAAtAG0AYQB0AGMAaAAgACIATQBpAGMAcgBvAHMAbwBmAHQAIABEAGUAdgBpAGMAZQAgAE0AYQBuAGEAZwBlAG0AZQBuAHQAIABEAGUAdgBpAGMAZQAgAEMAQQAiACAACgAJAH0AIAB8ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtAAoAfQAJAAoAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAKACQARQBuAHIAbwBsAGwAbQBlAG4AdABQAHIAbwBjAGUAcwBzACAAPQAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgACIAQwA6AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtADMAMgBcAEQAZQB2AGkAYwBlAEUAbgByAG8AbABsAGUAcgAuAGUAeABlACIAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgAvAEMAIAAvAEEAdQB0AG8AZQBuAHIAbwBsAGwATQBEAE0AIgAgAC0ATgBvAE4AZQB3AFcAaQBuAGQAbwB3ACAALQBXAGEAaQB0ACAALQBQAGEAcwBzAFQAaAByAHUACgA="' 
                        $enroll
                        write-host "`n"

                        write-host "Please give the OMA DM client some time (about 30 seconds)to sync and get your device enrolled into Intune" -foregroundcolor yellow
                        write-host "`n"
                        start-sleep -seconds 30
                        write-host "Checking the Intune Certificate Again!." -foregroundcolor yellow
                        check-intunecert
                        check-dmwapservice
                        Get-ScheduledTask | ? {$_.TaskName -eq 'Schedule #1 created by enrollment client'} | Start-ScheduledTask
                        start-sleep -seconds 10
                        $Shell = New-Object -ComObject Shell.Application
                        $Shell.open("intunemanagementextension://syncapp")
                        check-dmpcert
                        start-sleep -seconds 5
                        get-schedule1
                        read-Host -prompt "Press any key to continue..."
                        exit    
                        }else{
                            write-host "`n"
                                Write-Host 'You dont like me fixing it...? Fine...exiting now' -fo1:48 AM 3/22/2023regroundcolor red
                            exit 1
                             }
}



function fix-privatekey {                 
                $title    = 'Intune Private Key'
                $question = 'Are you sure you want to fix the private key missing??'
                $choices  = '&Yes', '&No'
                $decision = $Host.UI.PromptForChoice($title, $question, $choices, 1)
                
                if ($decision -eq 0) {
                                Write-Host "List certificates without private key: " -NoNewline
                            $certsWithoutKey = Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.HasPrivateKey -eq $false}
                            
                            if($certsWithoutKey) {
                                    Write-Host "V" -ForegroundColor Green
                                    $Choice = $certsWithoutKey | Select-Object Subject, Issuer, NotAfter, ThumbPrint | Out-Gridview -Passthru
                                    
                                if($Choice){
                                        Write-Host "Search private key for $($Choice.Thumbprint): " -NoNewline
                                        $Output = certutil -repairstore my "$($Choice.Thumbprint)"
                                        $Result = [regex]::match($output, "CertUtil: (.*)").Groups[1].Value
                                        
                                    if($Result -eq '-repairstore command completed successfully.') {
                                               Write-Host "V" -ForegroundColor Green
                                       }else{
                                            Write-Host $Result -ForegroundColor Red
                                        }
                                       }else{
                                    Write-Host "No choice was made." -ForegroundColor DarkYellow
                                    }
                            }else{
                               Write-Host "There were no certificates found without private key." -ForegroundColor DarkYellow
                            }
                        }else{
                               Write-Host 'You cancelled the fix... why?' -foregroundcolor red
                            Write-Host "Press any key to continue..."
                            $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
                            exit 1
                        }
}


function get-privatekey{ 
                if ((Get-ChildItem Cert:\LocalMachine\My | where {$_.Thumbprint -match $thumbprint}).HasPrivateKey){
                 Write-Host "Nice.. your Intune Device Certificate still has its private key" -foregroundcolor green
                }else{
                Write-Host "I guess we need to fix something because the certificate is missing its private key"  -foregroundcolor red 
                fix-privatekey
                }
}


function check-mdmlog{
Write-Host "Hold on a moment... Initializing a sync and checking the MDM logs for sync errors!"  -foregroundcolor yellow
$Shell = New-Object -ComObject Shell.Application
$Shell.open("intunemanagementextension://syncapp")
start-sleep -seconds 5

Remove-Item -Path $env:TEMP\diag\* -Force -ErrorAction SilentlyContinue 
Start-Process MdmDiagnosticsTool.exe -Wait -ArgumentList "-out $env:TEMP\diag\" -NoNewWindow

$checkmdmlog = Select-String -Path $env:TEMP\diag\MDMDiagReport.html -Pattern "The last sync failed"
    if($checkmdmlog -eq $null){
                        Write-Host "Not detecting any sync errors in the MDM log" -foregroundcolor green
                    }else{
                         Write-Host "It's a good thing you are running this script because you do have some Intune sync issues going on"  -foregroundcolor red 
                        }
}


function check-imelog{ 
                $path = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log"
                 If(Test-Path $path) 
                    { 
                        $checklog = Select-String -Path 'C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log' -Pattern "Set MdmDeviceCertificate : $thumbprint"
                            if ($checklog -ne $null){
                               Write-Host "I guess you need to quit your job and go to the casino as the proper Intune certificate with $thumbprint is also mentioned in the IME" -foregroundcolor green
                            }else{
                                $checklogzero = Select-String -Path 'C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log' -Pattern "Find 0 MDM certificates"
                                $firstline = $checklogzero | select-object -first 1         
                                Write-Host "Ow my.. this is could not be a good thing... $firstline"  -foregroundcolor red 
                            }
                    } Else { Write-Host "Uhhhhh... the log is missing... it seems the IME is not installed"  -foregroundcolor red}
                    check-imeservice
}
 


function check-dmpcert{
                write-host "`n"
                write-host "Determing if the certificate mentioned in the SSLClientCertreference is also configured in the Enrollments part of the registry " -foregroundcolor yellow
                    try{     
                    $ProviderRegistryPath = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments"
                    $ProviderPropertyName = "ProviderID"
                    $ProviderPropertyValue = "MS DM Server"
                    $GUID = (Get-ChildItem -Path Registry::$ProviderRegistryPath -Recurse -ErrorAction SilentlyContinue | ForEach-Object { if((Get-ItemProperty -Name $ProviderPropertyName -Path $_.PSPath -ErrorAction SilentlyContinue | Get-ItemPropertyValue -Name $ProviderPropertyName -ErrorAction SilentlyContinue) -match $ProviderPropertyValue) { $_ } }).PSChildName
                    $cert = (Get-ChildItem Cert:\LocalMachine\My\ | where{$_.issuer -like "*Microsoft Intune MDM Device CA*"})
                    $certthumbprint = $cert.thumbprint
                    $certsubject = $cert.subject
                    $subject = $certsubject -replace "CN=",""
                     }
                catch {
                     Write-host "Failed to get guid for enrollment from registry, device doesnt seem enrolled?" -foregroundcolor red
                    } 

if((Get-ItemProperty -Path "HKLM:SOFTWARE\Microsoft\Enrollments\$guid").DMPCertThumbPrint -eq $certthumbprint){
        Write-Host "Great!!! The Intune Device Certificate with the Thumbprint $certthumbprint is configured in the registry Enrollments" -foregroundcolor green
    }else{
        Write-Host "Intune Device Certificate is not configured in the Registry Enrollments" -foregroundcolor red
        }
}


function get-sslclientcertreference{
                    try{ 
                        $ProviderRegistryPath = "HKLM:SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\"
                        $ProviderPropertyName = "ServerVer"
                        $ProviderPropertyValue = "4.0"
                        $GUID = (Get-ChildItem -Path $ProviderRegistryPath -Recurse -ErrorAction SilentlyContinue | ForEach-Object { if((Get-ItemProperty -Name $ProviderPropertyName -Path $_.PSPath -ErrorAction SilentlyContinue | Get-ItemPropertyValue -Name $ProviderPropertyName -ErrorAction SilentlyContinue) -match $ProviderPropertyValue) { $_ } }).PSChildName
                        $ssl = (Get-ItemProperty -Path "HKLM:SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\$guid" -ErrorAction SilentlyContinue).sslclientcertreference
                        } 
                    catch [System.Exception] {
                                      Write-Error "Failed to get Enrollment GUID or SSL Client Reference for enrollment from registry, device doesnt seem enrolled or it needs a reboot first" 
                                      $result = $false
                        }

                        if ($ssl -eq $null){
                                    Write-Host "Thats weird, your device doesnt seem to be enrolled into Intune, lets find out why!.. hold my beer!" -foregroundcolor red
                        }else{
                                    Write-Host "Device seems to be Enrolled into Intune... proceeding" -foregroundcolor green
                    }                        
}



function check-imeservice{
                write-host "`n"
                write-host "Determing if the IME service is succesfully installed" -foregroundcolor yellow
$path = "C:\Program Files (x86)\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe"
If(Test-Path $path) { 
                write-host "IntuneWindowsAgent.exe is available on the device"-foregroundcolor green
                write-host "Going to check if the IME service is installed" -foregroundcolor yellow
                $service = Get-Service -Name IntuneManagementExtension -ErrorAction SilentlyContinue
                if ($service.Length -gt 0) {
                    Write-Host "jippie ka yee, the IME service seems to be installed!" -foregroundcolor green
                    }else{
                                    Write-Host "Mmm okay.. The IME software isn't installed" -foregroundcolor red
                     }
                }else{
                    write-host "IntuneWindowsAgent.exe seems to be missing, checking if its even installed" -foregroundcolor red
                        if((Get-WmiObject -Class Win32_Product).caption -eq "Microsoft Intune Management Extension"){ 
                            Write-Host "jippie ka yee, the IME software seems to be installed!" -foregroundcolor green
                                }else{
                                    Write-Host "Mmm okay.. The IME software isn't installed" -foregroundcolor red
                                        $title    = 'Fixing the IME'
                                        $question = 'Are you 100% sure you want to proceed?!!!!!'
                                        $choices  = '&Yes', '&No'
                                        $decision = $Host.UI.PromptForChoice($title, $question, $choices, 1)
                
                                        if ($decision -eq 0){
                                            $ProviderRegistryPath = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseDesktopAppManagement\S-0-0-00-0000000000-0000000000-000000000-000\MSI"    
                                            $ProviderPropertyName = "CurrentDownloadUrl"        
                                            $ProviderPropertyValue = "*IntuneWindowsAgent.msi*"    
                                            $GUID = (Get-ChildItem -Path Registry::$ProviderRegistryPath -Recurse -ErrorAction SilentlyContinue | ForEach-Object { if((Get-ItemProperty -Name $ProviderPropertyName -Path $_.PSPath -ErrorAction SilentlyContinue | Get-ItemPropertyValue -Name $ProviderPropertyName -ErrorAction SilentlyContinue) -like $ProviderPropertyValue) { $_ } }).pschildname | select-object -first 1                      
                                            $link = Get-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\EnterpriseDesktopAppManagement\S-0-0-00-0000000000-0000000000-000000000-000\MSI\$GUID                    
                                            $link = $link.currentdownloadurl                    
                                            Invoke-WebRequest -Uri $link -OutFile 'IntuneWindowsAgent.msi'                    
                                            .\IntuneWindowsAgent.msi /quiet
                                        }else{
                                            write-host "`n"
                                                Write-Host 'You dont like me fixing it...? Fine...exiting now' -foregroundcolor red
                                            
                                                 }                

                                    }

                }
}



function check-entdmid{
                write-host "`n"
                write-host "Determing if the certificate subject is also configured in the EntDMID key " -foregroundcolor yellow
                    try{     
                    $ProviderRegistryPath = "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments"
                    $ProviderPropertyName = "ProviderID"
                    $ProviderPropertyValue = "MS DM Server"
                    $GUID = (Get-ChildItem -Path Registry::$ProviderRegistryPath -Recurse -ErrorAction SilentlyContinue | ForEach-Object { if((Get-ItemProperty -Name $ProviderPropertyName -Path $_.PSPath -ErrorAction SilentlyContinue | Get-ItemPropertyValue -Name $ProviderPropertyName -ErrorAction SilentlyContinue) -match $ProviderPropertyValue) { $_ } }).PSChildName
                    $cert = (Get-ChildItem Cert:\LocalMachine\My\ | where{$_.issuer -like "*Microsoft Intune MDM Device CA*"})
                    $certthumbprint = $cert.thumbprint
                    $certsubject = $cert.subject
                    $subject = $certsubject -replace "CN=",""
                     }
                catch {
                     Write-host "Failed to get guid for enrollment from registry, device doesnt seem enrolled?" -foregroundcolor red
                    } 

if((Get-ItemProperty -Path "HKLM:SOFTWARE\Microsoft\Enrollments\$guid\DMClient\MS DM Server").entdmid -eq $subject){
        Write-Host "I have good news!! The subject of the Intune Certificate is also set in the EntDMID registry key. Let's party!!!!" -foregroundcolor green
    }else{
        Write-Host "I have some shitty news! The EntDMID key is not configured, you probably need to reboot the device and run the test again" -foregroundcolor red
        }
}


function check-dmwapservice{
                    write-host "`n"
                    write-host "Determing if the dmwappushservice is running because we don't want to end up with no endpoints left to the endpointmapper" -foregroundcolor yellow
                    $ServiceName = "dmwappushservice"
                    $ServiceStatus = (Get-Service -Name $ServiceName).status
                        if($ServiceStatus -eq "Running")
                        {
                               Write-Host "I am happy...! The DMWAPPUSHSERVICE is Running!" -foregroundcolor green
                                                    }
                        else {
                                   Write-Host "The DMWAPPUSHSERVICE isn't running, let's kickstart that damn service to speed up the enrollment! " -foregroundcolor red
                                   Start-Service $Servicename -ErrorAction SilentlyContinue    
                            }
}

function get-schedule1 {
write-host "Almost finished, checking if the EnterpriseMGT tasks are running to start the sync!" -foregroundcolor yellow
If ((Get-ScheduledTask | Where TaskName -eq 'Schedule #1 created by enrollment client').State -eq 'running')
    {
    write-host "`n"
    write-host "Enrollment task is running! It looks like I fixed your sync issues.I guess you owe me a membeer now!" -foregroundcolor green
    $Form.ShowDialog()
    }elseif ((Get-ScheduledTask | Where TaskName -eq 'Schedule #1 created by enrollment client').State -eq 'ready') 
    {
    write-host "Enrollment task is ready!!!" -foregroundcolor green
    }else{
   write-host "Enrollment task doesn't exist" -foregroundcolor red
}
}


function fix-mdmurls{
            write-host "`n"
            write-host "Determing if the required MDM enrollment urls are configured in the registry" -foregroundcolor yellow

            $key = 'SYSTEM\CurrentControlSet\Control\CloudDomainJoin\TenantInfo\*' 
            $keyinfo = Get-Item "HKLM:\$key" -ErrorAction Ignore
            $url = $keyinfo.name
            $url = $url.Split("\")[-1]
            $path = "HKLM:\SYSTEM\CurrentControlSet\Control\CloudDomainJoin\TenantInfo\$url" 

if (test-path $path){
$mdmurl = get-itemproperty -LiteralPath $path -Name 'MdmEnrollmentUrl'
$mdmurl = $mdmurl.mdmenrollmenturl
}else{
    write-host "I guess I am missing the proper tenantinfo" -foregroundcolor red 
            }


if($mdmurl -eq "https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc"){
        write-host "MDM Enrollment URLS are configured the way I like it!Nice!!" -foregroundcolor green
        
}else{
    write-host "MDM enrollment url's are missing! Let me get my wrench and fix it for you!" -foregroundcolor red 
    New-ItemProperty -LiteralPath $path -Name 'MdmEnrollmentUrl' -Value 'https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc' -PropertyType String -Force -ea SilentlyContinue;
    New-ItemProperty -LiteralPath $path  -Name 'MdmTermsOfUseUrl' -Value 'https://portal.manage.microsoft.com/TermsofUse.aspx' -PropertyType String -Force -ea SilentlyContinue;
    New-ItemProperty -LiteralPath $path -Name 'MdmComplianceUrl' -Value 'https://portal.manage.microsoft.com/?portalAction=Compliance' -PropertyType String -Force -ea SilentlyContinue;

            
            }
}

##################################################################
###############starting the reallll script########################
##################################################################
$RegistryKeys = "HKLM:\SOFTWARE\Microsoft\Enrollments", "HKLM:\SOFTWARE\Microsoft\Enrollments\Status","HKLM:\SOFTWARE\Microsoft\EnterpriseResourceManager\Tracked", "HKLM:\SOFTWARE\Microsoft\PolicyManager\AdmxInstalled", "HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers","HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts", "HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Logger", "HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Sessions"

#fetching the enrollmentid
$EnrollmentID = Get-ScheduledTask -taskname 'PushLaunch' | Where-Object {$_.TaskPath -like "*Microsoft*Windows*EnterpriseMgmt*"} | Select-Object -ExpandProperty TaskPath -Unique | Where-Object {$_ -like "*-*-*"} | Split-Path -Leaf

check-mdmlog
write-host "`n"
write-host "Determining if the device is enrolled and fetching the SSLClientCertReference registry key" -foregroundcolor yellow
try{ 
    $ProviderRegistryPath = "HKLM:SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\$EnrollmentID"
    $ProviderPropertyName = "SslClientCertReference"
    $GUID = (Get-Item -Path $ProviderRegistryPath -ErrorAction SilentlyContinue | ForEach-Object { if((Get-ItemProperty -Name $ProviderPropertyName -Path $_.PSPath -ErrorAction SilentlyContinue | Get-ItemPropertyValue -Name $ProviderPropertyName -ErrorAction SilentlyContinue)) { $_ } }).PSChildName
    $ssl = (Get-ItemProperty -Path "HKLM:SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\$guid" -ErrorAction SilentlyContinue).sslclientcertreference
    } 
catch [System.Exception] {
                Write-Error "Failed to get Enrollment GUID or SSL Client Reference for enrollment from registry... that's odd almost as if the Intune Certificate is gone" 
                  $result = $false
                }
    if ($ssl -eq $null){
                Write-Host "Thats weird, your device doesnt seem to be enrolled into Intune, lets find out why!.. hold my beer!" -foregroundcolor red
    }else{
                Write-Host "Device seems to be Enrolled into Intune... proceeding" -foregroundcolor green
        }

write-host "`n"
write-host "Checking the Certificate Prefix.. to find out if it is configured as SYSTEM or USER" -foregroundcolor yellow

try{
$thumbprintPrefix = "MY;System;"
$thumbprint = $ssl.Replace($thumbprintPrefix, "")         
if ($ssl.StartsWith($thumbprintPrefix) -eq $true)
{ 
          write-host "The Intune Certificate Prefix is configured as $thumbprintprefix" -foregroundcolor green
        write-host "`n"
        write-host "Determing if the certificate is installed in the local machine certificate store" -foregroundcolor yellow
    if (Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Thumbprint -eq $thumbprint}){
        Write-Host "Intune Device Certificate is installed in the Local Machine Certificate store" -foregroundcolor green
        write-host "`n"
        check-certdate
            write-host "`n"
            write-host "Checking if the Certificate is also mentioned in the IME log" -foregroundcolor yellow
            check-imelog
    }else{
        Write-Host "Intune device Certificate is missing in the Local Machine Certificate store" -foregroundcolor red    
        fix-certificate
            write-host "Running some tests to determine if the device has the SSLClientCertReference registry key configured!" -foregroundcolor yellow
            get-sslclientcertreference
    }
        write-host "`n"
        write-host "Determing if the certificate has a Private Key Attached" -foregroundcolor yellow
        get-privatekey
            check-dmpcert
}else{
    write-host "Damn... the SSL prefix is not configured as SYSTEM but as $SSL" -foregroundcolor red
    $thumbprintPrefix = "MY;User;"
    $thumbprint = $ssl.Replace($thumbprintPrefix, "")
    
    write-host "`n"
    write-host "Determing if the certificate is also not in the System Certificate Store" -foregroundcolor yellow
    
    if(Get-ChildItem -Path Cert:\LocalMachine\My | Where-Object {$_.Thumbprint -eq $thumbprint}){
        Write-Host "Intune Device Certificate is installed in the Local Machine Certificate store" -foregroundcolor green
        write-host "`n"
        check-certdate
            write-host "`n"
            write-host "Determing if the certificate has a Private Key Attached" -foregroundcolor yellow
            get-privatekey
            check-dmpcert
    }else{
        Write-Host "Intune device Certificate is installed in the wrong user store. I will fix it for you!" -foregroundcolor red
        fix-wrongstore
            write-host "Determing if the certificate is now been installed in the proper store" -foregroundcolor yellow
            check-intunecert
    }
}
}
catch {
      Write-host "Failed to get the Certificate Details, device doesnt seem enrolled? Who cares?Let's fix it" -foregroundcolor red
    fix-certificate
          
    }

check-entdmid  
}