autopilotnuke.ps1
|
<#PSScriptInfo
.VERSION 3.2 .GUID b608a45b-6cd0-405e-bfb2-aa11450821b5 .AUTHOR Alexey Semibratov - Updated by Andrew Taylor .COMPANYNAME .COPYRIGHT Alexey Semibratov .TAGS .LICENSEURI https://github.com/andrew-s-taylor/WindowsAutopilotInfo/blob/main/LICENSE .PROJECTURI .ICONURI .EXTERNALMODULEDEPENDENCIES .REQUIREDSCRIPTS .EXTERNALSCRIPTDEPENDENCIES .RELEASENOTES Version 3.2: Second fix Version 3.1: Fix Version 3.0: Updated to work with SDK v2 Version 2.9: Remove-MgDevice ObjectID switched to ID to match updated module Version 2.8: Fixed speechmarks issue Version 2.7: Changed Autopilot delete method Version 2.6: Fixed mg-device command Version 2.5: Typo Version 2.4: Switched to MgGraph SDK and added support for app reg Version 2.1: Bugfix Version 2.0: Bugfix Version 1.9: Bugfix Version 1.8: Streamlined all logic with found Intune/AAD devices, changed output of found objects to a table Version 1.7: Fixed a situation where there can be multiple Intune devices Version 1.6: Added assigned user and tag - we will capture the old values, and will allow to change those if needed Version 1.5: Some change in language around on-prem domain. Added wait for sync if it was less then 10 minutes ago. Fixed a bug when there is no AP devices, but we still want to delete Intune/AAD/AD devices. Version 1.2: Added more documentation and set of required rights. Now if the device is not found in Autopilot, but exists in Intune (by serial number), it still cleans it from AD DS and AAD Version 1.1: Invoke-AutopilotSync, when called too soon, error out Version 1.0: Original public version. #> <# .SYNOPSIS Interactive script that helps to provision Autopilot machines. Identifies and fixes issues by removing the computer from Intune, AAD, AD and Autopilot, then adds it. MIT LICENSE Copyright (c) 2021 Alexey Semibratov Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. .DESCRIPTION Runs from OOBE screen, connects to Azure AD, Intune and optionally to AD DS, finds all objects for the serial number of the machine it is running on, then deletes it from everywhere, then adds it to Autopilot again. Asks for deletion of each object Usage: - The script can work from running Windows 10, but be careful removing native Azure AD joined Intune Devices - you can lock yourself out, if you do not know local administrator's password - Intended usage - from OOBE (Out of Box Experience) - While in OOBE, hits Shift+F10 - Powershell.exe - Install-Script AutopilotNuke - Accept all prompts - & 'C:\Program Files\WindowsPowerShell\Scripts\AutopilotNuke.ps1' - The script will: Download and install all required modules (accept all prompts) Show you the Serial Number of the machine Prompt to connect you to Azure AD and Intune Graph Ask you if you want to connect to local AD (ADDS, NT Domain) so it could delete old records from there. Enter the local FQDN (domain.com, contoso.local) of your AD Domain If you entered local AD domain, it will ask you for the username and password, for the username, use <NetbiosName>\User format Search in Autopilot for the serial number Show you all objects in Intune and AAD related to that Serial Number Ask if you want to delete in from Intune then deletes Ask if you want to delete in from Autopilot then deletes Loop through all AAD and AD (if it was selected) objects and ask to delete them Ask if you want to add it to AP then adds Minimum security rights needed: • This script will install the required modules • Custom role with the following permissions required in Intune: Managed devices Read Delete Update Enrollment programs Create device Delete device Read device Sync device Assigned to All Devices (did not try scoping it with RBAC, but should work in theory) • Cloud device administrator role required in Azure AD • AD DS rights similar to Intune Connector rights: https://docs.microsoft.com/en-us/mem/autopilot/windows-autopilot-hybrid#:~:text=The%20Intune%20Connector%20for%20your,the%20rights%20to%20create%20computers. #> [CmdletBinding()] param( [Parameter(Mandatory = $False)] [String] $TenantId = "", [Parameter(Mandatory = $False)] [String] $AppId = "", [Parameter(Mandatory = $False)] [String] $AppSecret = "" ) Function Connect-ToGraph { <# .SYNOPSIS Authenticates to the Graph API via the Microsoft.Graph.Authentication module. .DESCRIPTION The Connect-ToGraph cmdlet is a wrapper cmdlet that helps authenticate to the Intune Graph API using the Microsoft.Graph.Authentication module. It leverages an Azure AD app ID and app secret for authentication or user-based auth. .PARAMETER Tenant Specifies the tenant (e.g. contoso.onmicrosoft.com) to which to authenticate. .PARAMETER AppId Specifies the Azure AD app ID (GUID) for the application that will be used to authenticate. .PARAMETER AppSecret Specifies the Azure AD app secret corresponding to the app ID that will be used to authenticate. .PARAMETER Scopes Specifies the user scopes for interactive authentication. .EXAMPLE Connect-ToGraph -TenantId $tenantID -AppId $app -AppSecret $secret -#> [cmdletbinding()] param ( [Parameter(Mandatory = $false)] [string]$Tenant, [Parameter(Mandatory = $false)] [string]$AppId, [Parameter(Mandatory = $false)] [string]$AppSecret, [Parameter(Mandatory = $false)] [string]$scopes ) Process { Import-Module Microsoft.Graph.Authentication $version = (get-module microsoft.graph.authentication | Select-Object -expandproperty Version).major if ($AppId -ne "") { $body = @{ grant_type = "client_credentials"; client_id = $AppId; client_secret = $AppSecret; scope = "https://graph.microsoft.com/.default"; } $response = Invoke-RestMethod -Method Post -Uri https://login.microsoftonline.com/$Tenant/oauth2/v2.0/token -Body $body $accessToken = $response.access_token $accessToken if ($version -eq 2) { write-host "Version 2 module detected" $accesstokenfinal = ConvertTo-SecureString -String $accessToken -AsPlainText -Force } else { write-host "Version 1 Module Detected" Select-MgProfile -Name Beta $accesstokenfinal = $accessToken } $graph = Connect-MgGraph -AccessToken $accesstokenfinal Write-Host "Connected to Intune tenant $TenantId using app-based authentication (Azure AD authentication not supported)" } else { if ($version -eq 2) { write-host "Version 2 module detected" } else { write-host "Version 1 Module Detected" Select-MgProfile -Name Beta } $graph = Connect-MgGraph -scopes $scopes Write-Host "Connected to Intune tenant $($graph.TenantId)" } } } Write-Host "Downloading and installing all required modules, please accept all prompts" # Get NuGet $provider = Get-PackageProvider NuGet -ErrorAction Ignore if (-not $provider) { Write-Host "Installing provider NuGet" Find-PackageProvider -Name NuGet -ForceBootstrap -IncludeDependencies } # Get Graph Authentication module (and dependencies) $module = Import-Module microsoft.graph.authentication -PassThru -ErrorAction Ignore if (-not $module) { Write-Host "Installing module microsoft.graph.authentication" Install-Module microsoft.graph.authentication -Force -ErrorAction Ignore } Import-Module microsoft.graph.authentication -Scope Global $module = Import-Module microsoft.graph.groups -PassThru -ErrorAction Ignore if (-not $module) { Write-Host "Installing module MS Graph Groups" Install-Module microsoft.graph.groups -Force -ErrorAction Ignore } Import-Module microsoft.graph.groups -Scope Global $module2 = Import-Module Microsoft.Graph.Identity.DirectoryManagement -PassThru -ErrorAction Ignore if (-not $module2) { Write-Host "Installing module MS Graph Identity Management" Install-Module Microsoft.Graph.Identity.DirectoryManagement -Force -ErrorAction Ignore } Import-Module microsoft.graph.Identity.DirectoryManagement -Scope Global $module3 = Import-Module WindowsAutopilotIntuneCommunity -PassThru -ErrorAction Ignore if (-not $module3) { Write-Host "Installing module WindowsAutopilotIntuneCommunity" Install-Module WindowsAutopilotIntuneCommunity -Force -ErrorAction Ignore } Import-Module WindowsAutopilotIntuneCommunity -Scope Global $session = New-CimSession $DomainIP = $null $de = $null $autopilotDevices = $null $aadDevices = $null $intuneDevices = $null $localADfqdn = $null $DomainIP = $null $de = $null $relatedIntuneDevice=$null $FoundAADDevices=$null $groupTag="" $userPrincipalName="" $displayName="" $newdisplayName="" $serial = (Get-CimInstance -CimSession $session -Class Win32_BIOS).SerialNumber Write-Host "Will be processing device with serial number: " -NoNewline Write-Host $serial -ForegroundColor Green Write-Host "Connecting to Intune Graph" if ($AppId -ne "") { Connect-ToGraph -Tenant $TenantId -AppId $AppId -AppSecret $AppSecret Write-Host "Connected to Intune tenant $TenantId using app-based authentication (Azure AD authentication not supported)" } else { $graph = Connect-ToGraph -scopes "Group.ReadWrite.All, Device.ReadWrite.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementServiceConfig.ReadWrite.All, GroupMember.ReadWrite.All" Write-Host "Connected to Intune tenant $($graph.TenantId)" if ($AddToGroup) { $aadId = Connect-ToGraph -scopes "Group.ReadWrite.All, Device.ReadWrite.All, DeviceManagementManagedDevices.ReadWrite.All, DeviceManagementServiceConfig.ReadWrite.All, GroupMember.ReadWrite.All" Write-Host "Connected to Azure AD tenant $($aadId.TenantId)" } } Write-Host "Loading all objects. This can take a while on large tenants" $aadDevices = Get-MgDevice -All ##$intuneDevices = Get-IntuneManagedDevice -Filter "contains(operatingsystem, 'Windows')" | Get-MSGraphAllPages $uri = "https://graph.microsoft.com/beta/deviceManagement/managedDevices" $response = Invoke-MgGraphRequest -Uri $uri -Method Get -OutputType PSObject $devices = $response.value $devicesNextLink = $response."@odata.nextLink" while ($null -ne $devicesNextLink) { $devicesResponse = (Invoke-MgGraphRequest -Uri $devicesNextLink -Method Get -OutputType PSObject) $devicesNextLink = $devicesResponse."@odata.nextLink" if ($serialhasspaces -eq 1) { $devices += $devicesResponse.value | Where-Object {$_.serialNumber -eq "$($serial)"} } else { $devices += $devicesResponse.value } } $intunedevices = $devices | Where-Object {$_.operatingSystem -eq "Windows"} ##$autopilotDevices = Get-AutopilotDevice | Get-MSGraphAllPages $autopilotDevices = Get-AutopilotDevice $localADfqdn = Read-Host -Prompt 'If you want to *DELETE* this computer from your local Active Directory domain and have Domain Controllers in line of sight, please enter the DNS of your AD DS domain (ie domain.local or contoso.com), otherwise, to skip AD DS deletion, hit "Enter"' if($localADfqdn -ne "" -and $localADfqdn -ne $null) { $DomainIP = (Test-Connection -ComputerName $localADfqdn -Count 1 -ErrorAction SilentlyContinue).IPV4Address.IPAddressToString } # Let's connect to on-prem AD if($DomainIP -ne $null) { Write-Host Connecting to $DomainIP Write-Host "Please provide the username and the password (DOMAIN\UserName)" $ADUserName = Read-Host -Prompt 'Username' $ADPassword = Read-Host -Prompt 'Password' -AsSecureString $ADPassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto([System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($ADPassword)) $de = New-Object System.DirectoryServices.DirectoryEntry("LDAP://$DomainIP", $ADUserName, $ADPassword) -ErrorAction Stop Write-Host Connected to $de.distinguishedName } $currentAutopilotDevice = $autopilotDevices | Where-Object {$_.serialNumber -eq $serial} if ($currentAutopilotDevice -ne $null) { # Find the objects linked to the Autopilot device Write-Verbose $currentAutopilotDevice | Format-List -Property * [array]$relatedIntuneDevice = $intuneDevices | Where-Object { $_.serialNumber -eq $currentAutopilotDevice.serialNumber -or $_.serialNumber -eq $currentAutopilotDevice.serialNumber.replace(' ','') -or $_.id -eq $currentAutopilotDevice.managedDeviceId -or $_.azureADDeviceId -eq $currentAutopilotDevice.azureActiveDirectoryDeviceId} [array]$FoundAADDevices = $aadDevices | Where-Object { $_.DeviceId -eq $currentAutopilotDevice.azureActiveDirectoryDeviceId -or $_.DeviceId -iin $relatedIntuneDevice.azureADDeviceId -or $_.DevicePhysicalIds -match $currentAutopilotDevice.Id } # Display a summary for this device and found related Intune /AAD devices Write-Host "User:" $currentAutopilotDevice.userPrincipalName Write-Host "Group Tag:" $currentAutopilotDevice.groupTag $userPrincipalName = $currentAutopilotDevice.userPrincipalName $groupTag = $currentAutopilotDevice.groupTag Write-Host "Found Related Intune Devices:" $relatedIntuneDevice | Format-Table -Property deviceName, id, userID, enrolledDateTime, LastSyncDateTime, operatingSystem, osVersion, deviceEnrollmentType Write-Host "Found Related AAD Devices:" $FoundAADDevices | Format-Table -Property DisplayName, ObjectID, DeviceID, AccountEnabled, ApproximateLastLogonTimeStamp, DeviceTrustType, DirSyncEnabled, LastDirSyncTime -AutoSize if($relatedIntuneDevice -ne $null){ foreach($relIntuneDevice in $relatedIntuneDevice) { $displayName=$relIntuneDevice.deviceName if($Host.UI.PromptForChoice('Delete Intune Device', 'Do you want to *DELETE* ' + $relIntuneDevice.deviceName +' from the Intune?', @('&Yes'; '&No'), 1) -eq 0){ $deviceid = $relIntuneDevice.id $url = "https://graph.microsoft.com/beta/deviceManagement/managedDevices/$deviceid" $response = Invoke-MgGraphRequest -Uri $url -Method Delete -OutputType PSObject #Remove-IntuneManagedDevice -managedDeviceId $relIntuneDevice.id -ErrorAction Continue } } } if($Host.UI.PromptForChoice('Delete Autopilot Device', 'Do you want to *DELETE* the device with serial number ' + $currentAutopilotDevice.serialNumber +' from the Autopilot?', @('&Yes'; '&No'), 1) -eq 0){ $id = $currentAutopilotDevice.id $graphApiVersion = "beta" $Resource = "deviceManagement/windowsAutopilotDeviceIdentities" $uri = "https://graph.microsoft.com/$graphApiVersion/$Resource/$id" Invoke-MGGraphRequest -Uri $uri -Method DELETE #Remove-AutopilotDevice -id $currentAutopilotDevice.id -ErrorAction Continue $SecondsSinceLastSync = $null $SecondsSinceLastSync = (New-Timespan -Start (Get-AutopilotSyncInfo).lastSyncDateTime.ToUniversalTime() -End (Get-Date).ToUniversalTime()).TotalSeconds If ($SecondsSinceLastSync -ge 610) { Invoke-AutopilotSync } else { Write-Host "Last sync was" $SecondsSinceLastSync "seconds ago, will sleep for" (610-$SecondsSinceLastSync) "seconds before trying to sync." if($Host.UI.PromptForChoice('Autopilot Sync','Do you want to wait?', @('&Yes'; '&No'), 1) -eq 0){Start-Sleep -Seconds (610-$SecondsSinceLastSync) ; Invoke-AutopilotSync} } while (Get-AutopilotDevice | Where-Object {$_.serialNumber -eq $serial} -ne $null){ Start-Sleep -Seconds 5 } Write-Host "Deleted" } } if($relatedIntuneDevice -eq $null -and $FoundAADDevices -eq $null ){ # this serial number was not found in Autopilot Devices, but we still want to check intune devices with this serial number and search AAD and AD DS for that one [array]$relatedIntuneDevice = $intuneDevices | Where-Object {$_.serialNumber -eq $serial -or $_.serialNumber -eq $serial.replace(' ','')} [array]$FoundAADDevices = $aadDevices | Where-Object { $_.DeviceId -eq $relatedIntuneDevice.azureADDeviceId } Write-Host "Found Related Intune Devices:" $relatedIntuneDevice | Format-Table -Property deviceName, id, userID, enrolledDateTime, LastSyncDateTime, operatingSystem, osVersion, deviceEnrollmentType Write-Host "Found Related AAD Devices:" $FoundAADDevices | Format-Table -Property DisplayName, ObjectID, DeviceID, AccountEnabled, ApproximateLastLogonTimeStamp, DeviceTrustType, DirSyncEnabled, LastDirSyncTime -AutoSize if($relatedIntuneDevice -ne $null){ foreach($relIntuneDevice in $relatedIntuneDevice) { $displayName=$relIntuneDevice.deviceName if($Host.UI.PromptForChoice('Delete Intune Device', 'Do you want to *DELETE* ' + $relIntuneDevice.deviceName +' from the Intune?', @('&Yes'; '&No'), 1) -eq 0){ $deviceid = $relIntuneDevice.id $url = "https://graph.microsoft.com/beta/deviceManagement/managedDevices/$deviceid" $response = Invoke-MgGraphRequest -Uri $url -Method Delete -OutputType PSObject #Remove-IntuneManagedDevice -managedDeviceId $relIntuneDevice.id -ErrorAction Stop } } } } foreach($aadDevice in $FoundAADDevices){ if($de -ne $null){ $escapedguid = "\" + ((([GUID]$aadDevice.deviceID).ToByteArray() |ForEach-Object {"{0:x}" -f $_}) -join '\') $searcher = New-Object System.DirectoryServices.DirectorySearcher($de,"(&(objectCategory=Computer)(ObjectGUID=$escapedguid))") $obj = $searcher.FindOne() if ($obj -ne $null){ $objdel = $obj.GetDirectoryEntry() if($Host.UI.PromptForChoice('Delete Active Directory Device', 'Do you want to *DELETE* the device with the name ' + $objdel.Name +' from AD DS?', @('&Yes'; '&No'), 1) -eq 0){ $objdel.DeleteTree() } } } if($Host.UI.PromptForChoice('Delete Azure Active Directory Device', 'Do you want to *DELETE* the device with the name ' + $aadDevice.DisplayName +' from Azure AD?', @('&Yes'; '&No'), 1) -eq 0){ Remove-mgdevice -DeviceId $aadDevice.Id -ErrorAction SilentlyContinue } } # Get the hash (if available) $devDetail = (Get-CimInstance -CimSession $session -Namespace root/cimv2/mdm/dmmap -Class MDM_DevDetail_Ext01 -Filter "InstanceID='Ext' AND ParentID='./DevDetail'") if ($devDetail) { $hash = $devDetail.DeviceHardwareData if($Host.UI.PromptForChoice('Add Autopilot Device', 'Do you want to *ADD* the device with serial number ' + $serial +' to Autopilot?', @('&Yes'; '&No'), 1) -eq 0){ $newuserPrincipalName = Read-Host -Prompt "Change assigned user [$userPrincipalName] (type a new value or hit enter to keep the old one)" if (![string]::IsNullOrWhiteSpace($newuserPrincipalName)){ $userPrincipalName = $newuserPrincipalName } $newgroupTag = Read-Host -Prompt "Change group tag [$groupTag] (type a new value or hit enter to keep the old one)" if (![string]::IsNullOrWhiteSpace($newgroupTag)){ $groupTag = $newgroupTag } Add-AutopilotImportedDevice -serialNumber $serial -hardwareIdentifier $hash -groupTag $groupTag -assignedUser $userPrincipalName $SecondsSinceLastSync = $null $SecondsSinceLastSync = (New-Timespan -Start (Get-AutopilotSyncInfo).lastSyncDateTime.ToUniversalTime() -End (Get-Date).ToUniversalTime()).TotalSeconds If ($SecondsSinceLastSync -ge 610) { Invoke-AutopilotSync } else { Write-Host "Last sync was" $SecondsSinceLastSync "seconds ago, will sleep for" (610-$SecondsSinceLastSync) "seconds before trying to sync." if($Host.UI.PromptForChoice('Autopilot Sync','Do you want to wait?', @('&Yes'; '&No'), 0) -eq 0){Start-Sleep -Seconds (610-$SecondsSinceLastSync); Invoke-AutopilotSync} } } } if($Host.UI.PromptForChoice('Computer name','Do you want to configure a unique name for a device? This name will be ignored in Hybrid Azure AD joined deployments. Device name still comes from the domain join profile for Hybrid Azure AD devices. This will only work if you have not deleted the device from AP recently.', @('&Yes'; '&No'), 1) -eq 0){ $newdisplayName = Read-Host -Prompt "[$displayName] (type a new value or hit enter to keep the old one)" if (![string]::IsNullOrWhiteSpace($displayName) -or ![string]::IsNullOrWhiteSpace($newdisplayName)){ if (![string]::IsNullOrWhiteSpace($newdisplayName) ){ $displayName = $newdisplayName } $autopilotDevices = Get-AutopilotDevice [array]$currentAutopilotDevices = $autopilotDevices | Where-Object {$_.serialNumber -eq $serial} foreach($currentAutopilotDevice in $currentAutopilotDevices){ Set-AutopilotDevice -id $currentAutopilotDevice.id -displayName $displayName } } } |