Get-UserDeviceRegistrationEvents.ps1
|
<#PSScriptInfo .VERSION 1.0 .GUID 28a1b634-1267-415c-891d-4afb3a72e217 .AUTHOR Iain Borghoff .COMPANYNAME .COPYRIGHT .TAGS Windows Autopilot .LICENSEURI .PROJECTURI .ICONURI .EXTERNALMODULEDEPENDENCIES .REQUIREDSCRIPTS .EXTERNALSCRIPTDEPENDENCIES .RELEASENOTES Version 1.0: Initial publish. #> <# .DESCRIPTION Retrieves the User Device Registration events from the device and either save them as a log file to C:\ProgramData\Microsoft\IntuneManagementExtension\Logs (which will be included with the logs files collected with Collect Diagnostics from Endpoint), or specify a file name and path. Be sure to set/update the file extension to xlsx before opening the resulting file. .PARAMETER outputfile The name and path of the log file .EXAMPLE .\Get-UserDeviceRegistrationEvents.ps1 -logfile C:\temp\udre.xlsx #> [CmdletBinding()] param ( $logfile ) if (!(Get-InstalledModule | Where-Object { $_.Name -like 'ImportExcel' })) { try { Write-Host 'Installing ImportExcel module' Install-Module -Name ImportExcel -Force -ErrorAction SilentlyContinue Write-Host 'Module installed' } catch { Write-Host 'Module failed to install' Exit 1 } } else { Import-Module -Name ImportExcel # Get serial number $serialnumber = (Get-WmiObject Win32_BIOS | Select-Object SerialNumber).Serialnumber # Check if serial number is blank and if it is, get the baseboard serial number if ($serialnumber.Trim() -eq "") { $serialnumber = (Get-WmiObject Win32_BaseBoard).SerialNumber } Write-Host 'Getting events and generating report...' -ForegroundColor Cyan $events = Get-WinEvent -LogName 'Microsoft-Windows-User Device Registration/Admin' -Oldest | Where-Object { $_.ID -like '4096' -or $_.ID -like '304' -or $_.ID -like '306' -or $_.ID -like '334' -or $_.ID -like '335' } | Select-Object TimeCreated, ID, ProviderName, LevelDisplayName, Message if ($logfile) { $events | Export-Excel -path "$logfile" } else { $events | Export-Excel -path "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\$($serialnumber)_udre.log" } Write-Host 'Report generated' -ForegroundColor Green } |