# === CHECK ENRÔLEMENT MDM INTUNE ===
# Exécuter sur le poste (PowerShell en admin)

# 1) Jonction Entra ID et état MDM
Write-Host "`n=== JONCTION ENTRA ID ===" -ForegroundColor Cyan
$dsreg       = dsregcmd /status
$aadJoined   = ($dsreg | Select-String "AzureAdJoined\s*:\s*YES").Count -gt 0
$mdmEnrolled = ($dsreg | Select-String "MDMEnrolled\s*:\s*YES").Count -gt 0
$mdmUrl      = ($dsreg | Select-String "MdmUrl\s*:") -replace ".*:\s*",""
Write-Host "Azure AD Joined  : $(if($aadJoined){'OUI'}else{'NON'})" `
  -ForegroundColor $(if($aadJoined){'Green'}else{'Red'})
Write-Host "MDM Enrolled     : $(if($mdmEnrolled){'OUI'}else{'NON'})" `
  -ForegroundColor $(if($mdmEnrolled){'Green'}else{'Red'})
Write-Host "MDM URL          : $($mdmUrl | Select-Object -First 1)"

# 2) Clés registre MDM
Write-Host "`n=== REGISTRE MDM ===" -ForegroundColor Cyan
$mdmKeys = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" -ErrorAction SilentlyContinue |
    ForEach-Object { Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue } |
    Where-Object { $_.ProviderID -eq "MS DM Server" }
if ($mdmKeys) {
    Write-Host "Enrôlement MDM trouvé :" -ForegroundColor Green
    $mdmKeys | Select-Object UPN, EnrollmentStartDate | Format-Table -AutoSize
} else {
    Write-Host "Aucun enrôlement MDM dans le registre" -ForegroundColor Red
}

# 3) Service IME (agent Win32 / Scripts PowerShell)
Write-Host "`n=== SERVICE IME ===" -ForegroundColor Cyan
$ime = Get-Service -Name IntuneManagementExtension -ErrorAction SilentlyContinue
if ($ime) {
    Write-Host "IntuneManagementExtension : $($ime.Status)" `
      -ForegroundColor $(if($ime.Status -eq 'Running'){'Green'}else{'Yellow'})
} else {
    Write-Host "Service IME absent (normal si aucune app Win32 ou script assigné)" -ForegroundColor Yellow
}

# Vue complète (sortie brute)
dsregcmd /status

# Vue filtrée — les infos clés uniquement
$keys = @("AzureAdJoined","DomainJoined","WorkplaceJoined",
          "MDMEnrolled","MdmUrl","AzureAdTenantId",
          "DeviceId","UserEmail","TenantDisplayName")
$out = dsregcmd /status
Write-Host "=== État jonction & MDM ===" -ForegroundColor Cyan
foreach ($k in $keys) {
    $line = $out | Select-String "$k\s*:" | Select-Object -First 1
    if ($line) { Write-Host $line.ToString().Trim() }
}

# Forcer le check-in MDM via les tâches planifiées Windows
Write-Host "Déclenchement sync MDM..." -ForegroundColor Cyan
$tasks = Get-ScheduledTask | Where-Object {
    $_.TaskName -like "*Schedule*to run OMADMClient*" -or
    $_.TaskName -like "*PushLaunch*" -or
    $_.TaskName -like "*EnterpriseMgmt*"
}
if ($tasks) {
    $tasks | Start-ScheduledTask
    Write-Host "Sync déclenchée ($($tasks.Count) tâche(s) lancée(s))." -ForegroundColor Green
} else {
    Write-Host "Tâches MDM non trouvées — vérifier que le poste est enrôlé." -ForegroundColor Yellow
}
Write-Host "Attendre 2-5 minutes puis vérifier le portail Intune."

# Alternative : ouvrir les Paramètres compte professionnel
# Start-Process "ms-settings:workplace"

# Collecte logs MDM — exécuter en admin sur le poste
$logDir = "C:\Temp\Logs_MDM_$(Get-Date -Format 'yyyyMMdd_HHmm')"
New-Item -ItemType Directory -Path $logDir -Force | Out-Null
Write-Host "Collecte vers : $logDir" -ForegroundColor Cyan

function Get-EventLog2CSV($name, $logname) {
    try {
        Get-WinEvent -LogName $logname -MaxEvents 1000 -ErrorAction Stop |
            Select-Object TimeCreated, Id, LevelDisplayName, Message |
            Export-Csv "$logDir\$name.csv" -NoTypeInformation -Encoding UTF8
        Write-Host "OK : $name.csv" -ForegroundColor Green
    } catch { Write-Host "SKIP : $name (vide ou absent)" -ForegroundColor Yellow }
}

Get-EventLog2CSV "MDM_Admin"  "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin"
Get-EventLog2CSV "MDM_Oper"   "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Operational"
Get-EventLog2CSV "Autopilot"  "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot"
Get-EventLog2CSV "ESP"        "Microsoft-Windows-ModernDeployment-Diagnostics-Provider/ManagementService"

# Logs IME (apps Win32 / scripts)
$imelog = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log"
if (Test-Path $imelog) {
    Copy-Item $imelog "$logDir\IME.log"
    Get-Content $imelog | Where-Object { $_ -match "Error|Failed|Exception" -and
        $_ -notmatch "SuccessResponse|0 errors" } |
        ForEach-Object { [PSCustomObject]@{ Ligne = $_ } } |
        Export-Csv "$logDir\IME_Erreurs.csv" -NoTypeInformation -Encoding UTF8
    Write-Host "OK : IME.log + IME_Erreurs.csv" -ForegroundColor Green
} else { Write-Host "SKIP : IME log absent" -ForegroundColor Yellow }

# dsregcmd complet en fichier texte
dsregcmd /status | Out-File "$logDir\dsregcmd.txt" -Encoding UTF8
Write-Host "OK : dsregcmd.txt" -ForegroundColor Green

Write-Host "`nCollecte terminée !" -ForegroundColor Green
explorer.exe $logDir

# Analyser les logs IME pour identifier les apps/scripts en échec
$imelog = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log"
if (-not (Test-Path $imelog)) {
    Write-Host "IME non présent sur ce poste" -ForegroundColor Yellow; exit
}

# Erreurs détectées
Write-Host "=== ERREURS IME ===" -ForegroundColor Cyan
$errors = Get-Content $imelog | Where-Object {
    $_ -match "\[Error\]|Failed|Exception" -and
    $_ -notmatch "SuccessResponse|0 errors|ErrorCount=0"
}
if ($errors.Count -eq 0) {
    Write-Host "Aucune erreur dans les logs IME" -ForegroundColor Green
} else {
    Write-Host "$($errors.Count) ligne(s) — 30 dernières :" -ForegroundColor Red
    $errors | Select-Object -Last 30 | ForEach-Object { Write-Host $_ -ForegroundColor Red }
}

# Apps installées avec succès
Write-Host "`n=== INSTALLS RÉUSSIES ===" -ForegroundColor Cyan
Get-Content $imelog | Where-Object { $_ -match "Installation succeeded|install result.*ExitCode=0" } |
    Select-Object -Last 15

# Dernières syncs + heartbeat
Write-Host "`n=== DERNIÈRES SYNCS ===" -ForegroundColor Cyan
Get-Content $imelog | Where-Object { $_ -match "Start sync|SyncApp|Aggregated" } | Select-Object -Last 5
Get-Content $imelog | Select-Object -Last 3

# Résumé par état de conformité
Get-MgDeviceManagementManagedDevice -All |
    Group-Object ComplianceState | Select-Object Name, Count | Sort-Object Count -Descending

# Liste des politiques de conformité du tenant
Get-MgDeviceManagementDeviceCompliancePolicy -All |
    Select-Object DisplayName, CreatedDateTime, LastModifiedDateTime | Sort-Object DisplayName

# Assignments d'une politique (remplacer l'ID)
$policyId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
Get-MgDeviceManagementDeviceCompliancePolicyAssignment -DeviceCompliancePolicyId $policyId

# Toutes les apps (export CSV)
Get-MgDeviceAppManagementMobileApp -All |
    Select-Object DisplayName, Publisher,
        @{N="Type";E={$_."@odata.type" -replace "#microsoft.graph.",""}} |
    Sort-Object DisplayName |
    Export-Csv "apps_intune.csv" -NoTypeInformation -Encoding UTF8

# Apps Win32 (.intunewin) uniquement
Get-MgDeviceAppManagementMobileApp `
    -Filter "isof('microsoft.graph.win32LobApp')" -All |
    Select-Object DisplayName, Publisher, CreatedDateTime

# Microsoft 365 Apps (suite Office)
Get-MgDeviceAppManagementMobileApp `
    -Filter "isof('microsoft.graph.officeSuiteApp')" -All

# Apps Store Windows
Get-MgDeviceAppManagementMobileApp `
    -Filter "isof('microsoft.graph.microsoftStoreForBusinessApp')" -All |
    Select-Object DisplayName, Publisher

# Générer le hash du PC local (admin requis, sur le PC à importer)
Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo -OutputFile "C:\Temp\hash_autopilot.csv"

# Générer le hash ET l'uploader directement dans Intune
Get-WindowsAutopilotInfo -Online

# Lister les appareils Autopilot enregistrés dans le tenant
Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -All |
    Select-Object SerialNumber, Manufacturer, Model, GroupTag, EnrollmentState |
    Format-Table -AutoSize

# Importer un CSV de hashes dans Intune
Import-AutopilotCSV -csvFile "C:\Temp\hash_autopilot.csv"

# Vérifier le statut d'import
Get-MgDeviceManagementImportedWindowsAutopilotDeviceIdentity -All |
    Select-Object SerialNumber, State

# Rapport multi-onglets
Import-Module ImportExcel
$file    = "Rapport_Intune_$(Get-Date -Format 'yyyyMMdd').xlsx"
$devices = Get-MgDeviceManagementManagedDevice -All
$cutoff  = (Get-Date).AddDays(-30)

# Onglet 1 : KPIs
@(
    [PSCustomObject]@{ Indicateur="Total appareils enrôlés" ; Valeur=$devices.Count },
    [PSCustomObject]@{ Indicateur="Conformes"               ; Valeur=($devices|Where-Object ComplianceState -eq 'compliant').Count },
    [PSCustomObject]@{ Indicateur="Non conformes"           ; Valeur=($devices|Where-Object ComplianceState -eq 'noncompliant').Count },
    [PSCustomObject]@{ Indicateur="Etat inconnu"            ; Valeur=($devices|Where-Object ComplianceState -eq 'unknown').Count },
    [PSCustomObject]@{ Indicateur="Sans sync +30 jours"     ; Valeur=($devices|Where-Object { $_.LastSyncDateTime -lt $cutoff }).Count },
    [PSCustomObject]@{ Indicateur="Windows 10 EOL"          ; Valeur=($devices|Where-Object { $_.OsVersion -like "10.*" }).Count },
    [PSCustomObject]@{ Indicateur="Taux conformite (%)"     ; Valeur=[math]::Round(($devices|Where-Object ComplianceState -eq 'compliant').Count / $devices.Count * 100,1) }
) | Export-Excel $file -WorksheetName "KPIs" -AutoSize -TableName "KPIs" -TableStyle Medium6 -FreezeTopRow

# Onglet 2 : Répartition par OS
$devices | Group-Object OperatingSystem |
    Select-Object @{N="OS";E={$_.Name}}, @{N="Nombre";E={$_.Count}} |
    Export-Excel $file -WorksheetName "Par OS" -AutoSize -TableName "ParOS" -TableStyle Medium2

# Onglet 3 : Appareils stale
$devices | Where-Object { $_.LastSyncDateTime -lt $cutoff } |
    Select-Object DeviceName, OperatingSystem,
        @{N="Derniere sync";E={$_.LastSyncDateTime.ToString("dd/MM/yyyy")}}, UserPrincipalName |
    Export-Excel $file -WorksheetName "Stale" -AutoSize -TableName "Stale" -TableStyle Light9 -FreezeTopRow

Write-Host "Rapport généré : $file" -ForegroundColor Green
Invoke-Item $file

# Chercher un groupe Intune par nom (partiel)
Get-MgGroup -Filter "startsWith(displayName,'Intune')" -All |
    Select-Object DisplayName, Id, Description

# Membres d'un groupe de déploiement
$groupId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
Get-MgGroupMember -GroupId $groupId -All |
    ForEach-Object { Get-MgUser -UserId $_.Id } |
    Select-Object DisplayName, UserPrincipalName, AccountEnabled

# Vérifier les licences Intune d'un utilisateur
Get-MgUserLicenseDetail -UserId "user@domaine.com" |
    Where-Object { $_.SkuPartNumber -like "*INTUNE*" -or $_.SkuPartNumber -like "*EMS*" } |
    Select-Object SkuPartNumber, SkuId

# Utilisateurs avec appareils non conformes
Get-MgDeviceManagementManagedDevice `
    -Filter "complianceState eq 'noncompliant'" -All |
    Select-Object UserPrincipalName | Sort-Object UserPrincipalName -Unique

# Récupérer l'ID d'un appareil par son nom
$device = Get-MgDeviceManagementManagedDevice `
    -Filter "deviceName eq 'LAPTOP-01'" | Select-Object -First 1
$id = $device.Id
Write-Host "ID appareil : $id — $($device.DeviceName) ($($device.UserPrincipalName))"

# Forcer la synchronisation MDM
Invoke-MgGraphRequest -Method POST `
    -Uri "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/$id/syncDevice"

# Retirer (Retire) — supprime les données d'entreprise, conserve les données perso
Invoke-MgGraphRequest -Method POST `
    -Uri "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/$id/retire"

# Effacer (Wipe) — factory reset complet, IRRÉVERSIBLE
$body = @{ keepEnrollmentData=$false; keepUserData=$false } | ConvertTo-Json
Invoke-MgGraphRequest -Method POST `
    -Uri "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/$id/wipe" `
    -Body $body -ContentType "application/json"

# Renommer un appareil Windows
$body = @{ deviceName="PC-NOUVEAU-NOM" } | ConvertTo-Json
Invoke-MgGraphRequest -Method POST `
    -Uri "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/$id/setDeviceName" `
    -Body $body -ContentType "application/json"