MDM_utils.ps1
|
# This file contains utility functions for Intune MDM # Get MDM discovery information # Aug 20th function Get-MDMEnrollmentService { [cmdletbinding()] Param( [Parameter(Mandatory=$False)] [String]$UserName="user@alt.none" ) Process { $messageId = $(New-Guid).ToString() $deviceType = "CIMClient_Windows" $applicationVersion = "10.0.18363.0" $OSEdition = "4" $body=@" <s:Envelope xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:s="http://www.w3.org/2003/05/soap-envelope"> <s:Header> <a:Action s:mustUnderstand="1">http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover</a:Action> <a:MessageID>urn:uuid:$messageId</a:MessageID> <a:ReplyTo> <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address> </a:ReplyTo> <a:To s:mustUnderstand="1">https://enrollment.manage.microsoft.com:443/enrollmentserver/discovery.svc</a:To> </s:Header> <s:Body> <Discover xmlns="http://schemas.microsoft.com/windows/management/2012/01/enrollment"> <request xmlns:i="http://www.w3.org/2001/XMLSchema-instance"> <EmailAddress>$UserName</EmailAddress> <RequestVersion>4.0</RequestVersion> <DeviceType>$deviceType</DeviceType> <ApplicationVersion>$applicationVersion</ApplicationVersion> <OSEdition>$OSEdition</OSEdition> <AuthPolicies> <AuthPolicy>OnPremise</AuthPolicy> <AuthPolicy>Federated</AuthPolicy> </AuthPolicies> </request> </Discover> </s:Body> </s:Envelope> "@ $headers=@{ "Content-Type" = "application/soap+xml; charset=utf-8" "User-Agent" = "ENROLLClient" } $response = Invoke-RestMethod -UseBasicParsing -Method Post -Uri "https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc" -Body $body -ContentType "application/soap+xml; charset=utf-8" -Headers $headers # Get the data $activityId = $response.Envelope.Header.ActivityId.'#text' $serviceUri = $response.Envelope.Body.DiscoverResponse.DiscoverResult.EnrollmentServiceUrl if(!$serviceUri.EndsWith($activityId)) { $serviceUri += "?client-request-id=$activityId" } # Return return $serviceUri } } # Enroll device to MDM # Aug 28th function Enroll-DeviceToMDM { [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [String]$AccessToken, [Parameter(Mandatory=$True)] [String]$DeviceName, [Parameter(Mandatory=$True)] [bool]$BPRT, [Parameter(Mandatory=$False)] [object]$ZtdCorrelationId ) Process { # Get the claims from the access token $claims = Read-Accesstoken -AccessToken $AccessToken # Construct the values $enrollmentUrl = Get-MDMEnrollmentService -UserName $claims.upn $binarySecurityToken = Convert-ByteArrayToB64 -Bytes ([text.encoding]::UTF8.GetBytes($AccessToken)) $HWDevID = "$($claims.deviceid)$($claims.tid)".Replace("-","") $deviceId = $claims.deviceid.Replace("-","") # Create a private key $rsa = [System.Security.Cryptography.RSA]::Create(2048) # Initialize the Certificate Signing Request object $CN = "CN=$($claims.deviceid)" $req = [System.Security.Cryptography.X509Certificates.CertificateRequest]::new($CN, $rsa, [System.Security.Cryptography.HashAlgorithmName]::SHA256,[System.Security.Cryptography.RSASignaturePadding]::Pkcs1) # Create the signing request $csr = Convert-ByteArrayToB64 -Bytes $req.CreateSigningRequest() $headers=@{ "Content-Type" = "application/soap+xml; charset=utf-8" "User-Agent" = "ENROLLClient" } # Create the CSR request body $csrBody=@" <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/200512" xmlns:ac="http://schemas.xmlsoap.org/ws/2006/12/authorization"> <s:Header> <a:Action s:mustUnderstand="1">http://schemas.microsoft.com/windows/pki/2009/01/enrollment/RST/wstep</a:Action> <a:MessageID>urn:uuid:$((New-Guid).ToString())</a:MessageID> <a:ReplyTo> <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address> </a:ReplyTo> <a:To s:mustUnderstand="1">$enrollmentUrl</a:To> <wsse:Security s:mustUnderstand="1"> <wsse:BinarySecurityToken ValueType="urn:ietf:params:oauth:token-type:jwt" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd#base64binary">$binarySecurityToken</wsse:BinarySecurityToken> </wsse:Security> </s:Header> <s:Body> <wst:RequestSecurityToken> <wst:TokenType>http://schemas.microsoft.com/5.0.0.0/ConfigurationManager/Enrollment/DeviceEnrollmentToken</wst:TokenType> <wst:RequestType>http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue</wst:RequestType> <wsse:BinarySecurityToken ValueType="http://schemas.microsoft.com/windows/pki/2009/01/enrollment#PKCS10" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd#base64binary">$csr</wsse:BinarySecurityToken> <ac:AdditionalContext xmlns="http://schemas.xmlsoap.org/ws/2006/12/authorization"> <ac:ContextItem Name="UXInitiated"> <ac:Value>$(($BPRT -eq $false).ToString().ToLower())</ac:Value> </ac:ContextItem> <ac:ContextItem Name="HWDevID"> <ac:Value>$HWDevID</ac:Value> </ac:ContextItem> <ac:ContextItem Name="OfflineAutoPilotEnrollmentCorrelator"> <ac:Value>$ZtdCorrelationId</ac:Value> </ac:ContextItem> <ac:ContextItem Name="BulkAADJ"> <ac:Value>$($BPRT.ToString().ToLower())</ac:Value> </ac:ContextItem> <ac:ContextItem Name="Locale"> <ac:Value>en-US</ac:Value> </ac:ContextItem> <ac:ContextItem Name="TargetedUserLoggedIn"> <ac:Value>$((($BPRT -eq $false) -or ($ZtdCorrelationId -eq $null)).ToString().ToLower())</ac:Value> </ac:ContextItem> <ac:ContextItem Name="EnrollmentData"> <ac:Value>$ZtdCorrelationId</ac:Value> </ac:ContextItem> <ac:ContextItem Name="OSEdition"> <ac:Value>4</ac:Value> </ac:ContextItem> <ac:ContextItem Name="DeviceName"> <ac:Value>$DeviceName</ac:Value> </ac:ContextItem> <ac:ContextItem Name="MAC"> <ac:Value>00-00-00-00-00-00</ac:Value> </ac:ContextItem> <ac:ContextItem Name="DeviceID"> <ac:Value>$deviceId</ac:Value> </ac:ContextItem> <ac:ContextItem Name="EnrollmentType"> <ac:Value>Device</ac:Value> </ac:ContextItem> <ac:ContextItem Name="DeviceType"> <ac:Value>CIMClient_Windows</ac:Value> </ac:ContextItem> <ac:ContextItem Name="OSVersion"> <ac:Value>10.0.18363.0</ac:Value> </ac:ContextItem> <ac:ContextItem Name="ApplicationVersion"> <ac:Value>10.0.18363.0</ac:Value> </ac:ContextItem> <ac:ContextItem Name="NotInOobe"> <ac:Value>true</ac:Value> </ac:ContextItem> <ac:ContextItem Name="RequestVersion"> <ac:Value>5.0</ac:Value> </ac:ContextItem> </ac:AdditionalContext> </wst:RequestSecurityToken> </s:Body> </s:Envelope> "@ # Clean the url $url=$enrollmentUrl.Replace(":443","") # The user might not have the lisence try { $response = Invoke-RestMethod -UseBasicParsing -Method Post -Uri $url -Body $csrBody -ContentType "application/soap+xml; charset=utf-8" -Headers $headers } catch { throw $_ } # Get the data $binSecurityToken = $response.Envelope.Body.RequestSecurityTokenResponseCollection.RequestSecurityTokenResponse.RequestedSecurityToken.BinarySecurityToken.'#text' $xmlSecurityToken = [xml][text.encoding]::UTF8.GetString((Convert-B64ToByteArray -B64 $binSecurityToken)) Write-Debug "BinarySecurityToken: $($xmlSecurityToken.OuterXml)" # Get the certificates $CA = $xmlSecurityToken.'wap-provisioningdoc'.characteristic[0].characteristic[0].characteristic.characteristic.Parm.value $IntMedCA = $xmlSecurityToken.'wap-provisioningdoc'.characteristic[0].characteristic[1].characteristic.characteristic.Parm.value $binCert = [byte[]](Convert-B64ToByteArray -B64 ($xmlSecurityToken.'wap-provisioningdoc'.characteristic[0].characteristic[2].characteristic.characteristic.Parm.value)) # Create a new x509certificate $cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]::new($binCert,"",[System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet -bor [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable) # Store the private key to so that it can be exported $cspParameters = [System.Security.Cryptography.CspParameters]::new() $cspParameters.ProviderName = "Microsoft Enhanced RSA and AES Cryptographic Provider" $cspParameters.ProviderType = 24 $cspParameters.KeyContainerName ="AADInternals" # Set the private key $privateKey = [System.Security.Cryptography.RSACryptoServiceProvider]::new(2048,$cspParameters) $privateKey.ImportParameters($rsa.ExportParameters($true)) $cert.PrivateKey = $privateKey # Generate the return value $joinInfo = @( $CA, $IntMedCA, $cert ) return $joinInfo } } # Sep 3rd 2020 # Automatically responses to the given command array function New-SyncMLAutoresponse { [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [string]$DeviceName, [Parameter(Mandatory=$True)] [Object[]]$Commands, [Parameter(Mandatory=$True)] [int]$MsgID, [Parameter(Mandatory=$True)] [Hashtable]$Settings ) Begin { $response200 = @( "Add" "Replace" "Atomic" "Delete" "Sequence" ) } Process { $resCommands = @() $CmdID = 1 foreach($command in $commands) { if($command.type -ne "Status") { # Just answer 400 to (almost) all requests $errorCode = 400 # For NodeCache requests if($command.Type -eq "Get" -and $command.LocURI.StartsWith("./Vendor/MSFT/NodeCache/")) { $errorCode = 404 } # Status must be 200 for predefined answers if($command.type -eq "Get" -and $Settings[$command.LocURI] -ne $null) { $errorCode = 200 } # Okay, let's be nice for some commands :) if($response200 -contains $command.Type) { $errorCode = 200 } # Create the status message $attr = [ordered]@{ Type="Status" CmdID = $CmdID++ MsgRef = $MsgID-1 # Status is always referring to the previous message CmdRef = $command.CmdID Cmd = $command.Type Data = $errorCode } $resCommands += New-Object psobject -Property $attr # Create the results message if($command.type -eq "Get" -and $Settings[$command.LocURI] -ne $null) { $attr = [ordered]@{ Type="Results" CmdID = $CmdID++ MsgRef = $MsgID-1 # Status is always referring to the previous message CmdRef = $command.CmdID Cmd = $command.Type LocURI = $command.LocURI Data = $Settings[$command.LocURI] } $resCommands += New-Object psobject -Property $attr } if($command.type -eq "Get" -and $errorCode -ne 200) { #if($VerbosePreference) #{ Write-Warning " < No data ($MsgID): $command" #} } } else { $resCommands += $command $CmdID++ } } return $resCommands } } # Sep 2nd 2020 # Create a new SyncML request function New-SyncMLRequest { [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [string]$DeviceName, [Parameter(Mandatory=$True)] [int]$SessionID, [Parameter(Mandatory=$True)] [int]$MsgID, [Parameter(Mandatory=$False)] [string]$VerDTD="1.2", [Parameter(Mandatory=$False)] [string]$VerProto="DM/1.2", [Parameter(Mandatory=$False)] [Object[]]$commands ) Process { $CmdId = 1 $syncBody="" foreach($command in $commands) { Write-Verbose " > $command" switch($command.Type) { "Alert" { if($command.ItemData) { if($command.MetaType) { $meta = @" <Meta> <Type xmlns="syncml:metinf">$($command.MetaType)</Type> </Meta> "@ } $syncBody += @" <Alert> <CmdID>$($command.CmdId)</CmdID> <Data>$($command.Data)</Data> <Item> $meta <Data>$($command.ItemData)</Data> </Item> </Alert> "@ } else { $syncBody += @" <Alert> <CmdID>$($command.CmdId)</CmdID> <Data>$($command.Data)</Data> </Alert> "@ } break } "Replace" { $syncBody += @" <Replace> <CmdID>$($command.CmdId)</CmdID> "@ foreach($key in $command.Items.Keys) { $syncBody += @" <Item> <Source> <LocURI>$key</LocURI> </Source> <Data>$($command.Items[$key])</Data> </Item> "@ } $syncBody += "`n </Replace>" break } "Delete" { break } "Atomic" { $syncBody += "`n" $syncBody += @" <Status> <CmdID>$($command.CmdId)</CmdID> <MsgRef>$($command.MsgRef)</MsgRef> <CmdRef>$($command.CmdRef)</CmdRef> <Cmd>$($command.Cmd)</Cmd> <Data>200</Data> </Status> "@ break } "Sequence" { $syncBody += "`n" $syncBody += @" <Status> <CmdID>$($command.CmdId)</CmdID> <MsgRef>$($command.MsgRef)</MsgRef> <CmdRef>$($command.CmdRef)</CmdRef> <Cmd>$($command.Cmd)</Cmd> <Data>200</Data> </Status> "@ break } "Final" { break } "Status" { $syncBody += "`n" $syncBody += @" <Status> <CmdID>$($command.CmdId)</CmdID> <MsgRef>$($command.MsgRef)</MsgRef> <CmdRef>$($command.CmdRef)</CmdRef> <Cmd>$($command.Cmd)</Cmd> <Data>$($command.Data)</Data> </Status> "@ break } "Results" { $syncBody += "`n" $syncBody += @" <Results> <CmdID>$($command.CmdId)</CmdID> <MsgRef>$($command.MsgRef)</MsgRef> <CmdRef>$($command.CmdRef)</CmdRef> <Item> <Source> <LocURI>$($command.LocURI)</LocURI> </Source> <Data>$($command.Data)</Data> </Item> </Results> "@ break } } } # Construct the body $syncML = @" <?xml version = "1.0" encoding = "UTF-8" ?> <SyncML> <SyncHdr> <VerDTD>$VerDTD</VerDTD> <VerProto>$VerProto</VerProto> <SessionID>$SessionID</SessionID> <MsgID>$MsgID</MsgID> <Target> <LocURI>https://r.manage.microsoft.com/devicegatewayproxy/cimhandler.ashx</LocURI> </Target> <Source> <LocURI>$DeviceName</LocURI> </Source> </SyncHdr> <SyncBody> $syncBody <Final/> </SyncBody> </SyncML> "@ return $syncML } } # Sep 2nd 2020 # Parses the SyncML response and returns an array containing all the returned commands function Parse-SyncMLResponse { [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [System.Xml.XmlDocument]$SyncML ) Process { $commands = @() $CmdId = 1 function parseNode { Param( [Parameter(Mandatory=$True)] $node, [Parameter(Mandatory=$True)] [ref]$commands ) Process { switch($node.Name) { "Status" { $attr = [ordered]@{ Type="Status" CmdID = $node.CmdID MsgRef = $node.MsgRef CmdRef = 0 Cmd = $node.Cmd Data = $node.Data } $commands.value += New-Object psobject -Property $attr break } "Get" { $attr = [ordered]@{ Type="Get" CmdID = $node.CmdID LocURI = $node.Item.Target.LocURI } $commands.value += New-Object psobject -Property $attr break } "Add" { $attr = [ordered]@{ Type="Add" CmdID = $node.CmdID LocURI = $node.Item.Target.LocURI } $commands.value += New-Object psobject -Property $attr break } "Replace" { $attr = [ordered]@{ Type="Replace" CmdID = $node.CmdID LocURI = $node.Item.Target.LocURI MFormat = $node.Item.Meta.Format.'#text' MType = $node.Item.Meta.Type.'#text' Data = $node.Item.Data } $commands.value += New-Object psobject -Property $attr break } "Delete" { $attr = [ordered]@{ Type="Delete" CmdID = $node.CmdID LocURI = $node.Item.Target.LocURI } $commands.value += New-Object psobject -Property $attr break } "Atomic" { # Parse nodes inside this one foreach($inode in $node.ChildNodes) { parseNode -node $inode -commands $commands } $attr = [ordered]@{ Type="Atomic" CmdID = $node.CmdID } $commands.value += New-Object psobject -Property $attr break } "Sequence" { # Parse nodes inside this one foreach($inode in $node.ChildNodes) { parseNode -node $inode -commands $commands } $attr = [ordered]@{ Type="Sequence" CmdID = $node.CmdID LocURI = "" } $commands.value += New-Object psobject -Property $attr break } "Final" { #$commands.value += New-Object psobject -Property @{Type="Final"} break } } } } foreach($node in $SyncML.SyncML.SyncBody.ChildNodes) { parseNode -node $node -commands ([ref]$commands) } if($VerbosePreference) { foreach($command in $commands) { Write-Verbose " < $command" } } return $commands } } # Sep 2nd 2020 # Sends the given SyncML to Intune and returns the response as an xml document function Invoke-SyncMLRequest { [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [string]$SyncML, [Parameter(ParameterSetName='Certificate',Mandatory=$True)] [System.Security.Cryptography.X509Certificates.X509Certificate2]$Certificate ) Process { $headers=@{ "Content-Type" = "application/vnd.syncml.dm+xml; charset=utf-8" "Accept" = "application/vnd.syncml.dm+xml, application/octet-stream" "Accept-Charset" = "UTF-8" "User-Agent" = "MSFT OMA DM Client/1.2.0.1" } Write-Debug "Request: $SyncML" try { $response = Invoke-WebRequest -UseBasicParsing -Certificate $Certificate -Method Post -Uri "https://r.manage.microsoft.com/devicegatewayproxy/cimhandler.ashx?mode=Maintenance&Platform=WoA" -Headers $headers -Body $SyncML -ErrorAction SilentlyContinue -ContentType "application/vnd.syncml.dm+xml; charset=utf-8" $xml = [xml]$response.content } catch { throw "SyncML request failed" } Write-Debug "Response: $($xml.OuterXml)" return $xml } } # Gets the object id of the device using device id # Sep 11th 2020 function Get-DeviceObjectId { [cmdletbinding()] Param( [Parameter(Mandatory=$True)] [String]$DeviceId, [Parameter(Mandatory=$True)] [String]$TenantId, [Parameter(Mandatory=$True)] [String]$AccessToken ) Process { $headers=@{ "Authorization" = "Bearer $AccessToken" "Accept" = "application/json;odata=nometadata" } Write-Verbose "Getting objectId for device $DeviceId" $devices = Invoke-RestMethod -UseBasicParsing -Method Get -Uri "https://graph.windows.net/$tenantId/devices?`$filter=deviceId eq guid'$DeviceId'&`$select=objectId,displayName,deviceId&api-version=1.61-internal" -Headers $headers foreach($device in $devices.value) { if($device.deviceId -eq $DeviceId) { $ObjectId = $device.objectId break } } if([string]::IsNullOrEmpty($ObjectId)) { throw "Device $DeviceId not found!" } return $ObjectId } } |