PowerShell Repository

# Vollständiger Report aller Intune-Geräte
$devices = Get-MgDeviceManagementManagedDevice -All
 
$devices | Select-Object `
    DeviceName,
    UserPrincipalName,
    OperatingSystem,
    OsVersion,
    ComplianceState,
    IsEncrypted,
    LastSyncDateTime,
    EnrolledDateTime,
    Model,
    Manufacturer |
    Export-Csv -Path "C:\Reports\intune-devices-$(Get-Date -Format 'yyyy-MM-dd').csv" -NoTypeInformation
 
Write-Host "Exportiert: $($devices.Count) Geräte" -ForegroundColor Green

# Einzelnes Gerät synchronisieren
$deviceName = "MW-5CG1234ABC"
$device = Get-MgDeviceManagementManagedDevice -Filter "deviceName eq '$deviceName'"
 
if ($device) {
    Sync-MgDeviceManagementManagedDevice -ManagedDeviceId $device.Id
    Write-Host "Sync ausgelöst für: $deviceName" -ForegroundColor Green
} else {
    Write-Host "Gerät nicht gefunden: $deviceName" -ForegroundColor Red
}

# Nicht-konforme Geräte mit Details
$nonCompliant = Get-MgDeviceManagementManagedDevice `
    -Filter "complianceState eq 'noncompliant'" -All
 
$nonCompliant | Select-Object `
    DeviceName,
    UserPrincipalName,
    ComplianceState,
    LastSyncDateTime,
    OperatingSystem |
    Format-Table -AutoSize
 
Write-Host "`n⚠️ Nicht-konforme Geräte: $($nonCompliant.Count)" -ForegroundColor Yellow

# Apple Push Notification Zertifikat prüfen
$apns = Get-MgDeviceManagementApplePushNotificationCertificate
 
if ($apns) {
    $daysUntilExpiry = ($apns.ExpirationDateTime - (Get-Date)).Days
    
    Write-Host "APNs Zertifikat:" -ForegroundColor Cyan
    Write-Host "  Ablaufdatum: $($apns.ExpirationDateTime)" 
    Write-Host "  Tage verbleibend: $daysUntilExpiry" -ForegroundColor $(
        if ($daysUntilExpiry -lt 14) { "Red" } 
        elseif ($daysUntilExpiry -lt 30) { "Yellow" } 
        else { "Green" }
    )
}

# Alle Konfigurationsprofile mit Zuweisungsstatus
$configs = Get-MgDeviceManagementDeviceConfiguration -All
 
foreach ($config in $configs) {
    $assignments = Get-MgDeviceManagementDeviceConfigurationAssignment `
        -DeviceConfigurationId $config.Id
    
    [PSCustomObject]@{
        PolicyName    = $config.DisplayName
        LastModified  = $config.LastModifiedDateTime
        Assignments   = $assignments.Count
    }
} | Format-Table -AutoSize

# Auf dem Zielgerät als Administrator ausführen:
Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo -OutputFile "C:\temp\autopilot-hash.csv"

# CSV mit Hardware-Hashes importieren
$csvPath = "C:\temp\autopilot-hash.csv"
$devices = Import-Csv -Path $csvPath
 
foreach ($device in $devices) {
    $body = @{
        "@odata.type" = "#microsoft.graph.importedWindowsAutopilotDeviceIdentity"
        hardwareIdentifier = $device.'Hardware Hash'
        serialNumber = $device.'Device Serial Number'
    } | ConvertTo-Json
 
    try {
        Invoke-MgGraphRequest -Method POST `
            -Uri "https://graph.microsoft.com/v1.0/deviceManagement/importedWindowsAutopilotDeviceIdentities" `
            -Body $body -ContentType "application/json"
        Write-Host "✅ Importiert: $($device.'Device Serial Number')" -ForegroundColor Green
    }
    catch {
        Write-Host "❌ Fehler: $($device.'Device Serial Number') - $($_.Exception.Message)" -ForegroundColor Red
    }
}

# Alle Autopilot-registrierten Geräte
$apDevices = Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -All
 
$apDevices | Select-Object `
    DisplayName,
    SerialNumber,
    Model,
    EnrollmentState,
    DeploymentProfileAssignmentStatus |
    Format-Table -AutoSize
 
Write-Host "Autopilot-Geräte: $($apDevices.Count)" -ForegroundColor Green

# Alle Gruppen mit Lizenzzuweisungen auflisten
$groups = Get-MgGroup -Filter "startsWith(displayName,'LIC-')" -All
 
foreach ($group in $groups) {
    $members = Get-MgGroupMember -GroupId $group.Id -All
    
    [PSCustomObject]@{
        GroupName = $group.DisplayName
        Members   = $members.Count
    }
} | Format-Table -AutoSize

# Achtung: Nur ausführen wenn gruppenbasierte Lizenzierung nicht möglich ist
$groupId = "XXXXXXXX-XXXX-XXXX-XXXX"  # LIC-M365-E3
$skuId = "XXXXXXXX-XXXX-XXXX-XXXX"    # M365 E3 SKU ID
 
$members = Get-MgGroupMember -GroupId $groupId -All
 
foreach ($member in $members) {
    try {
        Set-MgUserLicense -UserId $member.Id -AddLicenses @(@{SkuId = $skuId}) -RemoveLicenses @()
        Write-Host "✅ Lizenz zugewiesen: $($member.AdditionalProperties.displayName)" -ForegroundColor Green
    }
    catch {
        Write-Host "❌ Fehler: $($member.AdditionalProperties.displayName)" -ForegroundColor Red
    }
}

# Geräte die seit 90+ Tagen nicht synchronisiert haben
$staleDate = (Get-Date).AddDays(-90)
$staleDevices = Get-MgDeviceManagementManagedDevice -All |
    Where-Object { $_.LastSyncDateTime -lt $staleDate }
 
$staleDevices | Select-Object `
    DeviceName,
    UserPrincipalName,
    LastSyncDateTime,
    OperatingSystem |
    Sort-Object LastSyncDateTime |
    Format-Table -AutoSize
 
Write-Host "`n⚠️ Veraltete Geräte (90+ Tage): $($staleDevices.Count)" -ForegroundColor Yellow

# ACHTUNG: Destruktive Aktion - nur nach Review!
$staleDate = (Get-Date).AddDays(-90)
$staleDevices = Get-MgDeviceManagementManagedDevice -All |
    Where-Object { $_.LastSyncDateTime -lt $staleDate }
 
Write-Host "Zu löschende Geräte: $($staleDevices.Count)" -ForegroundColor Red
$confirm = Read-Host "Wirklich löschen? (ja/nein)"
 
if ($confirm -eq "ja") {
    foreach ($device in $staleDevices) {
        Remove-MgDeviceManagementManagedDevice -ManagedDeviceId $device.Id
        Write-Host "Gelöscht: $($device.DeviceName)" -ForegroundColor Yellow
    }
}