Get-AutopilotESPStatus

2.0

Get-AutopilotESPStatus.ps1

<#PSScriptInfo
 
.VERSION 2.0
 
.GUID 0f67a69a-b32f-4b56-a101-1394715d7fb5
 
.AUTHOR Michael Niehaus
 
.COMPANYNAME Microsoft
 
.COPYRIGHT
 
.TAGS Windows AutoPilot
 
.LICENSEURI
 
.PROJECTURI
 
.ICONURI
 
.EXTERNALMODULEDEPENDENCIES
 
.REQUIREDSCRIPTS
 
.EXTERNALSCRIPTDEPENDENCIES
 
.RELEASENOTES
Version 2.0: Added -online parameter to look up app and policy details.
Version 1.0: Original published version.
 
#>


<#
.SYNOPSIS
Displays Windows Autopilot ESP tracking information from the current PC.
 
.DESCRIPTION
This script dumps out the Windows Autopilot ESP tracking information from the registry. This should work with Windows 10 1903 and later (earlier versions have not been validated).
 
This script will not work on ARM64 systems due to registry redirection from the use of x86 PowerShell.exe.
 
.PARAMETER Online
Look up the actual policy names via the Intune Graph API
 
.EXAMPLE
.\Get-AutopilotESPStatus.ps1
 
.EXAMPLE
.\Get-AutopilotESPStatus.ps1 -Online
 
#>

[CmdletBinding()]
param(
    [Parameter(Mandatory=$False)] [Switch] $Online = $false
)

Begin
{
    # Configure constants
    $script:path = "HKLM:\Software\Microsoft\Windows\Autopilot\EnrollmentStatusTracking\ESPTrackingInfo\Diagnostics"
    $script:msiPath = "HKLM:\Software\Microsoft\EnterpriseDesktopAppManagement"
    $script:officePath = "HKLM:\Software\Microsoft\OfficeCSP"
    $script:statusCodes = @{"10" = "Initialized"; "20" = "Download In Progress"; "25" = "Pending Download Retry";
        "30" = "Download Failed"; "40" = "Download Completed"; "48" = "Pending User Session"; "50" = "Enforcement In Progress"; 
        "55" = "Pending Enforcement Retry"; "60" = "Enforcement Failed"; 70 = "Success / Enforcement Completed"}
    $script:espStatus = @{"1" = "Not Installed"; "2" = "Downloading / Installing"; "3" = "Success / Installed"; "4" = "Error / Failed"}
        $policyStatus = @{"0" = "Not Processed"; "1" = "Processed"}
    $script:sidecar = "093ea47b-ef2c-4f46-a022-6f57a50e39a2"
}

Process
{
    #------------------------
    # Functions
    #------------------------

    Function ProcessApps() {
    param
    (
        [Parameter(Mandatory=$true,ValueFromPipeline=$True)] [Microsoft.Win32.RegistryKey] $currentKey,
        [Parameter(Mandatory=$true)] $currentUser
    )

    Begin {
        Write-Host "Apps:"
    }

    Process {
        Write-Host " $($currentKey.PSChildName)"
        $currentKey.Property | % {
            if ($_.StartsWith("./Device/Vendor/MSFT/EnterpriseDesktopAppManagement/MSI/")) {
                $msiKey = [URI]::UnescapeDataString(($_.Split("/"))[6])
                $fullPath = "$msiPath\$currentUser\MSI\$msiKey"
                if (Test-Path $fullPath) {
                    $status = Get-ItemPropertyValue -Path $fullPath -Name Status
                }
                else
                {
                    $status = "Not found"
                } 
                if ($msiKey -eq $sidecar)
                {
                    $msiKey = "Intune Management Extensions ($($msiKey))"
                }
                elseif ($Online) {
                    $found = $apps | ? {$_.ProductCode -contains $msiKey}
                    $msiKey = "$($found.DisplayName) ($($msiKey))"
                }
                if ($status -eq 70) {
                    Write-Host " MSI $msiKey : $status ($($statusCodes[$status]))" -ForegroundColor Green
                }
                else {
                    Write-Host " MSI $msiKey : $status ($($statusCodes[$status]))" -ForegroundColor Yellow
                }
            }
            elseif ($_.StartsWith("./Vendor/MSFT/Office/Installation/")) {
                $officeKey = [URI]::UnescapeDataString(($_.Split("/"))[5])
                $fullPath = "$officepath\$officeKey"
                if (Test-Path $fullPath) {
                    $status = Get-ItemPropertyValue -Path $fullPath -Name FinalStatus
                }
                else
                {
                    $status = "Not found"
                }
                if ($status -eq 70) {
                    Write-Host " Office $officeKey : $status ($($statusCodes[$status]))" -ForegroundColor Green
                }
                else {
                    Write-Host " Office $officeKey : $status ($($statusCodes[$status]))" -ForegroundColor Yellow
                }
            }
            else
            {
                Write-Host " $_ : Unknown app"
            }
        }
    }

    }

    Function ProcessModernApps() {
    param
    (
        [Parameter(Mandatory=$true,ValueFromPipeline=$True)] [Microsoft.Win32.RegistryKey] $currentKey,
        [Parameter(Mandatory=$true)] $currentUser
    )

    Begin {
        Write-Host "Modern Apps:"
    }

    Process {
        Write-Host " $($currentKey.PSChildName)"
        $currentKey.Property | % {
            $status = (Get-ItemPropertyValue -path $currentKey.PSPath -Name $_).ToString()
            if ($_.StartsWith("./User/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/")) {
                $appID = [URI]::UnescapeDataString(($_.Split("/"))[7])
                $type = "User UWP"
            }
            elseif ($_.StartsWith("./Device/Vendor/MSFT/EnterpriseModernAppManagement/AppManagement/")) {
                $appID = [URI]::UnescapeDataString(($_.Split("/"))[7])
                $type = "Device UWP"
            }
            else
            {
                $appID = $_
                $type = "Unknown UWP"
            }
            if ($status -eq "1") {
                Write-Host " $type $appID : $status ($($policyStatus[$status]))" -ForegroundColor Green
            }
            else {
                Write-Host " $type $appID : $status ($($policyStatus[$status]))" -ForegroundColor Yellow
            }
        }
    }

    }

    Function ProcessSidecar() {
    param
    (
        [Parameter(Mandatory=$true,ValueFromPipeline=$True)] [Microsoft.Win32.RegistryKey] $currentKey
    )

    Begin {
        Write-Host "Sidecar apps:"
    }

    Process {
        Write-Host " $($currentKey.PSChildName)"
        $currentKey.Property | % {
            $win32Key = [URI]::UnescapeDataString(($_.Split("/"))[9])
            $status = Get-ItemPropertyValue -path $currentKey.PSPath -Name $_
            if ($Online) {
                $found = $apps | ? {$win32Key -match $_.Id }
                $win32Key = "$($found.DisplayName) ($($win32Key))"
            }
            if ($status -eq "3") {
                Write-Host " Win32 $win32Key : $status ($($espStatus[$status.ToString()]))" -ForegroundColor Green
            }
            else {
                Write-Host " Win32 $win32Key : $status ($($espStatus[$status.ToString()]))" -ForegroundColor Yellow
            }
        }
    }

    }

    Function ProcessPolicies() {
    param
    (
        [Parameter(Mandatory=$true,ValueFromPipeline=$True)] [Microsoft.Win32.RegistryKey] $currentKey
    )

    Begin {
        Write-Host "Policies:"
    }

    Process {
        Write-Host " $($currentKey.PSChildName)"
        $currentKey.Property | % {
            $status = Get-ItemPropertyValue -path $currentKey.PSPath -Name $_
            Write-Host " Policy $_ : $status ($($policyStatus[$status.ToString()]))"
        }
    }

    }


    Function ProcessCerts() {
    param
    (
        [Parameter(Mandatory=$true,ValueFromPipeline=$True)] [Microsoft.Win32.RegistryKey] $currentKey
    )

    Begin {
        Write-Host "Certificates:"
    }

    Process {
        Write-Host " $($currentKey.PSChildName)"
        $currentKey.Property | % {
            $certKey = [URI]::UnescapeDataString(($_.Split("/"))[6])
            $status = Get-ItemPropertyValue -path $currentKey.PSPath -Name $_
            if ($Online) {
                $found = $policies | ? { $certKey.Replace("_","-") -match $_.Id }
                $certKey = "$($found.DisplayName) ($($certKey))"
            }
            if ($status -eq "1") {
                Write-Host " Cert $certKey : $status ($($policyStatus[$status.ToString()]))" -ForegroundColor Green
            }
            else {
                Write-Host " Cert $certKey : $status ($($policyStatus[$status.ToString()]))" -ForegroundColor Yellow
            }
        }
    }

    }

    Function GetIntuneObjects() {
        param
        (
            [Parameter(Mandatory=$true)] [String] $uri
        )

        Process {

            Write-Verbose "GET $uri"
            try {
                $response = Invoke-MSGraphRequest -Url $uri -HttpMethod Get

                $objects = $response.value
                $objectsNextLink = $response."@odata.nextLink"
    
                while ($objectsNextLink -ne $null){
                    $response = (Invoke-MSGraphRequest -Url $devicesNextLink -HttpMethod Get)
                    $objectsNextLink = $response."@odata.nextLink"
                    $objects += $response.value
                }

                return $objects
            }
            catch {
                Write-Error $_.Exception
                return $null
                break
            }

        }
    }

    #------------------------
    # Main code
    #------------------------

    # Make sure the tracking path exists
    if (-not (Test-Path $path)) {
        Write-Host "ESP diagnostics info does not (yet) exist."
        exit 0
    }

    # If online, make sure we are able to authenticate
    if ($Online) {

        # Make sure we can connect
        $module = Import-Module Microsoft.Graph.Intune -PassThru -ErrorAction Ignore
        if (-not $module) {
            Write-Host "Installing module Microsoft.Graph.Intune"
            Install-Module Microsoft.Graph.Intune -Force
        }
        Import-Module Microsoft.Graph.Intune
        $graph = Connect-MSGraph
        Write-Host "Connected to tenant $($graph.TenantId)"

        # Get a list of apps
        Write-Host "Getting list of apps"
        $script:apps = GetIntuneObjects("https://graph.microsoft.com/beta/deviceAppManagement/mobileApps")

        # Get a list of policies (for certs)
        Write-Host "Getting list of policies"
        $script:policies = GetIntuneObjects("https://graph.microsoft.com/beta/deviceManagement/deviceConfigurations")
    }
    
    # Process device ESP sessions
    Write-Host " "
    Write-Host "DEVICE:"
    Write-Host " "

    if (Test-Path "$path\ExpectedMSIAppPackages") {
        Get-ChildItem "$path\ExpectedMSIAppPackages" | ProcessApps -currentUser "S-0-0-00-0000000000-0000000000-000000000-000"
    }
    if (Test-Path "$path\ExpectedModernAppPackages") {
        Get-ChildItem "$path\ExpectedModernAppPackages" | ProcessModernApps -currentUser "S-0-0-00-0000000000-0000000000-000000000-000"
    }
    if (Test-Path "$path\Sidecar") {
        Get-ChildItem "$path\Sidecar" | ProcessSidecar
    }
    if (Test-Path "$path\ExpectedPolicies") {
        Get-ChildItem "$path\ExpectedPolicies" | ProcessPolicies
    }
    if (Test-Path "$path\ExpectedSCEPCerts") {
        Get-ChildItem "$path\ExpectedSCEPCerts" | ProcessCerts
    }

    # Process user ESP sessions
    Get-ChildItem "$path" | ? { $_.PSChildName.StartsWith("S-") } | % {
        $userPath = $_.PSPath
        $userSid = $_.PSChildName
        Write-Host " "
        Write-Host "USER $($userSid):"
        Write-Host " "
        if (Test-Path "$userPath\ExpectedMSIAppPackages") {
            Get-ChildItem "$userPath\ExpectedMSIAppPackages" | ProcessApps -currentUser $userSid
        }
        if (Test-Path "$userPath\ExpectedModernAppPackages") {
            Get-ChildItem "$userPath\ExpectedModernAppPackages" | ProcessModernApps -currentUser $userSid
        }
        if (Test-Path "$userPath\Sidecar") {
            Get-ChildItem "$userPath\Sidecar" | ProcessSidecar 
        }
        if (Test-Path "$userPath\ExpectedPolicies") {
            Get-ChildItem "$userPath\ExpectedPolicies" | ProcessPolicies
        }
        if (Test-Path "$userPath\ExpectedSCEPCerts") {
            Get-ChildItem "$userPath\ExpectedSCEPCerts" | ProcessCerts
        }
    }


}