devicemanagement

Useful scripts and commands for devicemanagement and application packaging.

Applications:

Find uninstall-strings for all applications:

Get-ChildItem -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall | Get-ItemProperty | Select-Object -Property DisplayName, UninstallString

Find uninstall-string for a specific application: (Note the backslash to allow searching for +)

Get-ChildItem -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, HKLM:\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall | Get-ItemProperty | Select-Object -Property DisplayName, UninstallString | Where-Object {$_.DisplayName -match 'Notepad\+\+' }

Compare installed application versions, useful for requirement-scrips when updating apps

$VMware = Get-Package "VMware Horizon Client" -ProviderName MSI -ErrorAction SilentlyContinue
[Version]$Vmware.Version -lt [version]"8.8.1.34412"

Powershell App Deploy Toolkit

Set logpath for PS ADT to Intune log-folder

Working with Intune and applications, having access to all logfiles are crucial to finding and resolving errors. If you change the default log-path in PS ADT to the IntuneManagementExtension-folder, these logfiles will be collected when you select "Collect diagnostics" in Intune.

Simply change Toolkit_LogPath to the following in .\AppDeployToolkit\AppDeployToolkitConfig.xml: <Toolkit_LogPath>$env:Programdata\Microsoft\IntuneManagementExtension\Logs</Toolkit_LogPath>

Install command to show gui during installation

powershell.exe -ExecutionPolicy Bypass -File .\InstallWin32.ps1 -DeploymentType Install

Place InstallWin32.ps1 in same folder as Deploy-Application.ps1

Powershell

Restart Powershell in 64-bit (Runs as default in 32-bit from Intune)

 if (!([Environment]::Is64BitProcess )) {
if ($MyInvocation.Line) {
& "$env:windir\SysNative\WindowsPowerShell\v1.0\Powershell.exe" -ExecutionPolicy Bypass -NoLogo -NoProfile $MyInvocation.Line
} Else {
& "$env:windir\SysNative\WindowsPowerShell\v1.0\Powershell.exe" -ExecutionPolicy Bypass -NoLogo -NoProfile -File ($MyInvocation.InvocationName)
}
EXIT $LASTEXITCODE
}

Add device list to AAD group (For example when exporting exposed devices from Security Center)

Connect-MSGraph
Update-MSGraphEnvironment -SchemaVersion "Beta" -Quiet
Connect-MSGraph -Quiet
# The group idwe are adding devices to
$groupId = "12121212-34234234-45345-345345-34565756"
$devices = Import-Csv -Path "C:\DevicesExport.csv"
foreach ($device in $devices) {
$deviceName = $device.DeviceName
$deviceId = (Get-MgDevice -Filter "displayName eq '$deviceName'").Id
# Add the device to group
Add-AzureADGroupMember -ObjectId $groupId -RefObjectId $deviceId
Write-host "Adding $deviceid"
}

Security Center / Microsoft 365 Defendeder

Advanced hunting query to get all users with installed software

let klient = DeviceTvmSoftwareVulnerabilities
| where SoftwareName contains "YourApplication"
| distinct DeviceName;
DeviceLogonEvents
| where DeviceName in (klient) and AccountName contains "@yourdomain"
| distinct AccountName