Endpoint Analytics & Proactive Remediations

# Prüfen ob noch alte GPO-Registry Keys existieren
$gpoKeys = Get-ChildItem "HKLM:\SOFTWARE\Policies\Microsoft" -ErrorAction SilentlyContinue
if ($gpoKeys.Count -gt 5) {
    Write-Output "GPO-Tattoos gefunden: $($gpoKeys.Count) Keys"
    exit 1  # Problem erkannt
}
exit 0  # Alles OK

# GPO-Registry Keys bereinigen (selektiv!)
$keysToRemove = @(
    "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate"
    "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
)
foreach ($key in $keysToRemove) {
    if (Test-Path $key) {
        Remove-Item -Path $key -Recurse -Force
        Write-Output "Bereinigt: $key"
    }
}

$drive = Get-CimInstance -ClassName Win32_LogicalDisk -Filter "DeviceID='C:'"
$freeGB = [math]::Round($drive.FreeSpace / 1GB, 2)
if ($freeGB -lt 10) {
    Write-Output "Freier Speicher: ${freeGB}GB - unter 10GB Schwellwert"
    exit 1
}
exit 0

# Windows Temp und User Temp bereinigen
$tempPaths = @(
    "$env:TEMP",
    "C:\Windows\Temp",
    "C:\Windows\SoftwareDistribution\Download"
)
$totalFreed = 0
foreach ($path in $tempPaths) {
    if (Test-Path $path) {
        $size = (Get-ChildItem $path -Recurse -Force -ErrorAction SilentlyContinue | 
            Measure-Object -Property Length -Sum).Sum / 1MB
        Remove-Item "$path\*" -Recurse -Force -ErrorAction SilentlyContinue
        $totalFreed += $size
    }
}
Write-Output "Bereinigt: $([math]::Round($totalFreed, 0))MB"

$teamsCache = "$env:LOCALAPPDATA\Microsoft\Teams"
if (Test-Path $teamsCache) {
    $sizeMB = (Get-ChildItem $teamsCache -Recurse -Force -ErrorAction SilentlyContinue | 
        Measure-Object -Property Length -Sum).Sum / 1MB
    if ($sizeMB -gt 500) {
        Write-Output "Teams Cache: $([math]::Round($sizeMB))MB (über 500MB)"
        exit 1
    }
}
exit 0

# Teams beenden und Cache leeren
$teamsProcess = Get-Process -Name "ms-teams" -ErrorAction SilentlyContinue
if ($teamsProcess) { $teamsProcess | Stop-Process -Force; Start-Sleep -Seconds 3 }
 
$cachePaths = @(
    "$env:LOCALAPPDATA\Microsoft\Teams\Cache",
    "$env:LOCALAPPDATA\Microsoft\Teams\blob_storage",
    "$env:LOCALAPPDATA\Microsoft\Teams\databases",
    "$env:LOCALAPPDATA\Microsoft\Teams\GPUcache"
)
foreach ($path in $cachePaths) {
    if (Test-Path $path) { Remove-Item "$path\*" -Recurse -Force -ErrorAction SilentlyContinue }
}
Write-Output "Teams Cache bereinigt"

$threshold = (Get-Date).AddDays(14)
$expiringCerts = Get-ChildItem Cert:\CurrentUser\My | 
    Where-Object { $_.NotAfter -lt $threshold -and $_.NotAfter -gt (Get-Date) }
 
if ($expiringCerts.Count -gt 0) {
    Write-Output "Ablaufende Zertifikate: $($expiringCerts.Count)"
    exit 1
}
exit 0

# Keine automatische Remediation - Alert an IT senden
# Zertifikatserneuerung muss über SCEP/PKCS-Profil erfolgen
Write-Output "ALERT: Zertifikat läuft bald ab - SCEP-Profil prüfen"
# Intune Sync auslösen um neues Zertifikat zu pushen
$syncCmd = New-ScheduledTaskAction -Execute "DeviceEnroller.exe" -Argument "/c /AutoEnrollMDM"
exit 0