mirror of
https://github.com/Micke-K/IntuneManagement.git
synced 2026-09-28 10:55:38 +02:00
426 lines
13 KiB
PowerShell
426 lines
13 KiB
PowerShell
#ImportOrder 220
|
|
|
|
#########################################################################################
|
|
#
|
|
# Script Group
|
|
#
|
|
#########################################################################################
|
|
|
|
[Diagnostics.CodeAnalysis.SuppressMessageAttribute("TypeNotFound","", Justification = "")]
|
|
class ScriptsGroup : IntunePolicyGroupBase
|
|
{
|
|
ScriptsGroup() : Base()
|
|
{
|
|
$this.Init()
|
|
}
|
|
|
|
Init()
|
|
{
|
|
$this._ID = "ScriptsAndRemediations"
|
|
$this._Name = "Scripts and remediations"
|
|
$this._Icon = "Scripts"
|
|
# Three members share the Policy type "Platform Script"; Script type is the
|
|
# language. File name is worth its blanks on the members without a file.
|
|
$this._ExtraColumns = @("ScriptType=Script type", "Object.fileName=File name")
|
|
}
|
|
}
|
|
|
|
#########################################################################################
|
|
#
|
|
# Script Base Type
|
|
#
|
|
#########################################################################################
|
|
|
|
class ScriptTypeBase : IntunePolicyTypeBase
|
|
{
|
|
static [bool] $IsAbstract = $true
|
|
|
|
ScriptTypeBase() : Base()
|
|
{
|
|
([ScriptTypeBase]$this).Init()
|
|
}
|
|
|
|
Init()
|
|
{
|
|
|
|
}
|
|
|
|
PostExportCommand([PSCustomObject]$PolicyObject, [String]$PathToFile)
|
|
{
|
|
if($PathToFile -and [IO.File]::Exists($PathToFile) -and $PolicyObject.JsonObject.scriptContent -and (Get-CacheObject "ExportScripts") -eq $true)
|
|
{
|
|
$fi = [IO.FileInfo]$PathToFile
|
|
Write-Log "Export script $($PolicyObject.JsonObject.FileName)"
|
|
$fileName = [IO.Path]::Combine($fi.DirectoryName, $PolicyObject.JsonObject.FileName)
|
|
try {
|
|
[IO.File]::WriteAllBytes($fileName, ([System.Convert]::FromBase64String($PolicyObject.JsonObject.scriptContent)))
|
|
}
|
|
catch {
|
|
Write-LogError "Failed to save script file" $_.Exception
|
|
}
|
|
}
|
|
}
|
|
|
|
[Boolean]CheckPolicy([PSCustomObject]$PolicyObject)
|
|
{
|
|
return $false
|
|
}
|
|
}
|
|
|
|
#########################################################################################
|
|
#
|
|
# PowerShell Script
|
|
#
|
|
#########################################################################################
|
|
|
|
# region PowerShell Script
|
|
class PowerShellScriptType : ScriptTypeBase
|
|
{
|
|
PowerShellScriptType() : Base()
|
|
{
|
|
$this.Init()
|
|
}
|
|
|
|
Init()
|
|
{
|
|
$this._PolicyGroup = (Get-SingletonObject "ScriptsGroup")
|
|
$this._PolicyName = "Platform Script"
|
|
$this._PolicyBaseName = "PowerShell Scripts"
|
|
$this._APITitle = "Scripts (PowerShell)"
|
|
$this._ID = "PowerShellScripts"
|
|
$this._API = "deviceManagement/deviceManagementScripts"
|
|
$this._Permissions = @("DeviceManagementScripts.ReadWrite.All")
|
|
$this._AssignmentsType = "deviceManagementScriptAssignments"
|
|
$this._ObjectClass = "PowerShellScriptObject"
|
|
$this._Icon = "Scripts"
|
|
|
|
if($null -ne $this._PolicyGroup) {
|
|
$this._PolicyGroup.AddPolicyType($this)
|
|
}
|
|
}
|
|
}
|
|
|
|
Class PowerShellScriptObject : IntunePolicyBase
|
|
{
|
|
PowerShellScriptObject([PSCustomObject]$JsonObj) : Base($JsonObj) { $this.Init() }
|
|
|
|
PowerShellScriptObject() : Base()
|
|
{
|
|
$this.Init()
|
|
}
|
|
|
|
Hidden Init()
|
|
{
|
|
$this._PlatformName = Get-LanguageString "Platform.windows"
|
|
|
|
Add-ObjectProperty $this "ScriptType" { "PowerShell script" }
|
|
|
|
$this._PolicyType = (Get-SingletonObject "PowerShellScriptType")
|
|
}
|
|
}
|
|
|
|
#endregion
|
|
|
|
#########################################################################################
|
|
#
|
|
# Shell Script
|
|
#
|
|
#########################################################################################
|
|
|
|
# region PowerShell Script
|
|
class ShellScriptType : ScriptTypeBase
|
|
{
|
|
ShellScriptType() : Base()
|
|
{
|
|
$this.Init()
|
|
}
|
|
|
|
Init()
|
|
{
|
|
$this._PolicyGroup = (Get-SingletonObject "ScriptsGroup")
|
|
$this._PolicyName = "Platform Script"
|
|
$this._PolicyBaseName = "DeviceShell Scripts"
|
|
$this._APITitle = "Scripts (Shell)"
|
|
$this._ID = "MacScripts"
|
|
$this._API = "deviceManagement/deviceShellScripts"
|
|
$this._Permissions = @("DeviceManagementScripts.ReadWrite.All")
|
|
$this._AssignmentsType = "deviceManagementScriptAssignments"
|
|
# GET {id}/assignments returns 400 for shell scripts (verified live
|
|
# 2026-09-22); {id}?$expand=assignments is the working read path.
|
|
$this._AssignmentsViaExpand = $true
|
|
$this._ObjectClass = "ShellScriptObject"
|
|
$this._Icon = "Scripts"
|
|
|
|
if($null -ne $this._PolicyGroup) {
|
|
$this._PolicyGroup.AddPolicyType($this)
|
|
}
|
|
}
|
|
}
|
|
|
|
Class ShellScriptObject : IntunePolicyBase
|
|
{
|
|
ShellScriptObject([PSCustomObject]$JsonObj) : Base($JsonObj) { $this.Init() }
|
|
|
|
ShellScriptObject() : Base()
|
|
{
|
|
$this.Init()
|
|
}
|
|
|
|
Hidden Init()
|
|
{
|
|
$this._PlatformName = Get-LanguageString "Platform.macOS"
|
|
|
|
Add-ObjectProperty $this "ScriptType" { "Shell script" }
|
|
|
|
$this._PolicyType = (Get-SingletonObject "ShellScriptType")
|
|
}
|
|
}
|
|
#endregion
|
|
|
|
#########################################################################################
|
|
#
|
|
# Platform Script
|
|
#
|
|
#########################################################################################
|
|
|
|
# region Platform Script
|
|
class ScriptSettingsCatalogType : SettingsCatalogTypeBase
|
|
{
|
|
ScriptSettingsCatalogType() : Base()
|
|
{
|
|
$this.Init()
|
|
}
|
|
|
|
Init()
|
|
{
|
|
$this._PolicyGroup = (Get-SingletonObject "ScriptsGroup")
|
|
$this._PolicyName = "Platform Script"
|
|
$this._APITitle = "Scripts (Linux)"
|
|
$this._ID = "DeviceConfigurationScripts"
|
|
$this._QueryList = "?`$filter=templateReference/TemplateFamily eq 'deviceConfigurationScripts'"
|
|
$this._ObjectClass = "DeviceConfigurationScriptObject"
|
|
$this._Icon = "Scripts"
|
|
|
|
if($null -ne $this._PolicyGroup) {
|
|
$this._PolicyGroup.AddPolicyType($this)
|
|
}
|
|
|
|
$this._PolicyTypeOrder = 50
|
|
}
|
|
}
|
|
|
|
Class DeviceConfigurationScriptObject : IntunePolicyBase
|
|
{
|
|
DeviceConfigurationScriptObject([PSCustomObject]$JsonObj) : Base($JsonObj) { $this.Init() }
|
|
|
|
DeviceConfigurationScriptObject() : Base()
|
|
{
|
|
$this.Init()
|
|
}
|
|
|
|
Hidden Init()
|
|
{
|
|
$this._PlatformName = Get-LanguageString "Platform.linux"
|
|
|
|
Add-ObjectProperty $this "ScriptType" { "Shell script" }
|
|
|
|
$this._PolicyType = (Get-SingletonObject "ScriptSettingsCatalogType")
|
|
}
|
|
}
|
|
#endregion
|
|
|
|
#########################################################################################
|
|
#
|
|
# Shell Script
|
|
#
|
|
#########################################################################################
|
|
|
|
# region PowerShell Script
|
|
class MacCustomAttributeType : ScriptTypeBase
|
|
{
|
|
MacCustomAttributeType() : Base()
|
|
{
|
|
$this.Init()
|
|
}
|
|
|
|
Init()
|
|
{
|
|
$this._PolicyGroup = (Get-SingletonObject "ScriptsGroup")
|
|
$this._PolicyName = "Custom Attributes"
|
|
$this._PolicyBaseName = "Custom Attributes"
|
|
$this._ID = "MacCustomAttributes"
|
|
$this._API = "deviceManagement/deviceCustomAttributeShellScripts"
|
|
$this._Permissions = @("DeviceManagementScripts.ReadWrite.All")
|
|
$this._AssignmentsType = "deviceManagementScriptAssignments"
|
|
# Same 400 on GET {id}/assignments as the shell scripts above.
|
|
$this._AssignmentsViaExpand = $true
|
|
$this._ObjectClass = "MacCustomAttributeObject"
|
|
$this._Icon = "CustomAttributes"
|
|
$this._PropertiesToRemoveForUpdate = @('customAttributeName','customAttributeType','displayName')
|
|
|
|
if($null -ne $this._PolicyGroup) {
|
|
$this._PolicyGroup.AddPolicyType($this)
|
|
}
|
|
}
|
|
}
|
|
|
|
Class MacCustomAttributeObject : IntunePolicyBase
|
|
{
|
|
MacCustomAttributeObject([PSCustomObject]$JsonObj) : Base($JsonObj) { $this.Init() }
|
|
|
|
MacCustomAttributeObject() : Base()
|
|
{
|
|
$this.Init()
|
|
}
|
|
|
|
Hidden Init()
|
|
{
|
|
$this._PlatformName = Get-LanguageString "Platform.macOS"
|
|
|
|
Add-ObjectProperty $this "ScriptType" { "Shell script" }
|
|
|
|
$this._PolicyType = (Get-SingletonObject "MacCustomAttributeType")
|
|
}
|
|
}
|
|
#endregion
|
|
|
|
|
|
#########################################################################################
|
|
#
|
|
# Shell Script
|
|
#
|
|
#########################################################################################
|
|
|
|
# region PowerShell Script
|
|
class DeviceHealthScriptType : IntunePolicyTypeBase
|
|
{
|
|
DeviceHealthScriptType() : Base()
|
|
{
|
|
$this.Init()
|
|
}
|
|
|
|
Init()
|
|
{
|
|
$this._PolicyGroup = (Get-SingletonObject "ScriptsGroup")
|
|
$this._PolicyName = "Remediation Script"
|
|
$this._APITitle = "Remediation Scripts"
|
|
$this._PolicyBaseName = "Remediations"
|
|
$this._ID = "DeviceHealthScripts"
|
|
$this._API = "deviceManagement/deviceHealthScripts"
|
|
$this._QueryList = "?`$filter=isGlobalScript eq false" # Looks like filters are not working for deviceHealthScripts
|
|
$this._Permissions = @("DeviceManagementScripts.ReadWrite.All")
|
|
$this._ObjectClass = "DeviceHealthScriptObject"
|
|
$this._Icon = "Report"
|
|
$this._AssignmentsType = "deviceHealthScriptAssignments"
|
|
$this._ExpandAssignmentsList = $false
|
|
$this._AssignmentPropertiesToKeep = @("target","runSchedule","runRemediationScript")
|
|
# deviceHealthScriptType is a read-only GET property - PATCHing it back
|
|
# is rejected ("Invalid property name: DeviceHealthScriptType").
|
|
$this._PropertiesToRemoveForUpdate = @('version','isGlobalScript','highestAvailableVersion','deviceHealthScriptType')
|
|
|
|
if($null -ne $this._PolicyGroup) {
|
|
$this._PolicyGroup.AddPolicyType($this)
|
|
}
|
|
}
|
|
|
|
[Hashtable]PreImportCommand([IntunePolicyBase]$PolicyObject)
|
|
{
|
|
if($PolicyObject.Object.isGlobalScript -eq $true)
|
|
{
|
|
@{ "Import" = $false }
|
|
}
|
|
return (@{})
|
|
}
|
|
|
|
[Hashtable]PreDeleteCommand([IntunePolicyBase]$PolicyObject)
|
|
{
|
|
if($PolicyObject.Object.isGlobalScript -eq $true)
|
|
{
|
|
@{ "Delete" = $false }
|
|
}
|
|
return (@{})
|
|
}
|
|
|
|
[Hashtable]PreUpdateCommand([IntunePolicyBase]$PolicyObject, [IntunePolicyBase]$SourceObject)
|
|
{
|
|
if($SourceObject.Object.isGlobalScript -eq $true)
|
|
{
|
|
# Class methods discard non-return expressions - without the
|
|
# explicit return, global scripts were NOT skipped.
|
|
return @{ "Update" = $false }
|
|
}
|
|
return (@{})
|
|
}
|
|
|
|
PostExportCommand([PSCustomObject]$PolicyObject, [String]$PathToFile)
|
|
{
|
|
if($PathToFile -and [IO.File]::Exists($PathToFile) -and $PolicyObject.JsonObject.detectionScriptContent -and (Get-CacheObject "ExportScripts") -eq $true)
|
|
{
|
|
Write-Log "Export remediation scripts"
|
|
$fi = [IO.FileInfo]$PathToFile
|
|
|
|
try
|
|
{
|
|
if($PolicyObject.JsonObject.detectionScriptContent) {
|
|
[IO.File]::WriteAllBytes(([IO.Path]::Combine($fi.DirectoryName, "$($fi.BaseName)_DetectionScript.ps1")), ([System.Convert]::FromBase64String($PolicyObject.JsonObject.detectionScriptContent)))
|
|
}
|
|
|
|
if($PolicyObject.JsonObject.remediationScriptContent) {
|
|
[IO.File]::WriteAllBytes(([IO.Path]::Combine($fi.DirectoryName, "$($fi.BaseName)_RemediationScript.ps1")), ([System.Convert]::FromBase64String($PolicyObject.JsonObject.remediationScriptContent)))
|
|
}
|
|
}
|
|
catch
|
|
{
|
|
Write-LogError "Failed to export remediation scripts" $_.Exception
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
Class DeviceHealthScriptObject : IntunePolicyBase
|
|
{
|
|
DeviceHealthScriptObject([PSCustomObject]$JsonObj) : Base($JsonObj) { $this.Init() }
|
|
|
|
DeviceHealthScriptObject() : Base()
|
|
{
|
|
$this.Init()
|
|
}
|
|
|
|
Hidden Init()
|
|
{
|
|
$this._PlatformName = Get-LanguageString "Platform.windows"
|
|
|
|
Add-ObjectProperty $this "ScriptType" { "Remediation Script" }
|
|
|
|
$this._PolicyType = (Get-SingletonObject "DeviceHealthScriptType")
|
|
}
|
|
}
|
|
|
|
#endregion
|
|
|
|
#########################################################################################
|
|
#
|
|
# Script functions
|
|
#
|
|
#########################################################################################
|
|
|
|
function Save-IntuneScriptContent
|
|
{
|
|
param($ScriptPolicy, [string]$FileName)
|
|
|
|
if(-not $ScriptPolicy) { return }
|
|
|
|
if($ScriptPolicy.IsFullObject -eq $false) {
|
|
[void]$ScriptPolicy.Get()
|
|
}
|
|
|
|
if(-not $ScriptPolicy.JsonObject.scriptContent) { return }
|
|
if([string]::IsNullOrWhiteSpace($FileName)) { throw "A destination file path is required." }
|
|
|
|
Write-Log "Download PowerShell script '$($ScriptPolicy.JsonObject.FileName)' from $($ScriptPolicy.Name)"
|
|
|
|
# Changed to WriteAllBytes to get rid of BOM characters from Custom Attribute file
|
|
[IO.File]::WriteAllBytes($FileName, ([System.Convert]::FromBase64String($ScriptPolicy.JsonObject.scriptContent)))
|
|
return $FileName
|
|
}
|