#Requires -RunAsAdministrator

<#
.SYNOPSIS
    Triggers the Windows TPM Health Attestation Certificate Retrieval scheduled task.

.DESCRIPTION
    Executes the '\Microsoft\Windows\TPM\Tpm-HASCertRetr' scheduled task to resolve 
    BitLocker device registration, Health Attestation, or TPM certificate retrieval 
    issues on endpoints (frequently used in Microsoft Intune environments).

.NOTES
    Created:     2025-01-15
    Modified:    2026-10-04
#>

[CmdletBinding(SupportsShouldProcess = $true)]
param (
    [string]$LogDirectory = "C:\IntuneLogs",
    [string]$LogFileName  = "BitlockerRegFix.log",
    [string]$TaskPath     = "\Microsoft\Windows\TPM\",
    [string]$TaskName     = "Tpm-HASCertRetr"
)

# Build full log file path
$LogPath = Join-Path -Path $LogDirectory -ChildPath $LogFileName

# Helper function for structured, timestamped logging
function Write-Log {
    param (
        [string]$Message,
        [ValidateSet("INFO", "WARNING", "ERROR")]
        [string]$Level = "INFO"
    )
    $Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $FormattedMessage = "[$Timestamp] [$Level] $Message"
    
    # Write to console / verbose stream
    if ($Level -eq "ERROR") {
        Write-Error $Message
    } elseif ($Level -eq "WARNING") {
        Write-Warning $Message
    } else {
        Write-Host $FormattedMessage
    }

    # Append to log file safely
    try {
        if (-not (Test-Path -Path $LogDirectory)) {
            New-Item -Path $LogDirectory -ItemType Directory -Force | Out-Null
        }
        Add-Content -Path $LogPath -Value $FormattedMessage -ErrorAction SilentlyContinue
    }
    catch {
        # Fallback if logging fails
    }
}

# --- Execution Logic ---

Write-Log "Starting BitLocker/TPM registration fix process..."

# 1. Verify scheduled task exists on the system
$Task = Get-ScheduledTask -TaskPath $TaskPath -TaskName $TaskName -ErrorAction SilentlyContinue

if (-not $Task) {
    Write-Log "Scheduled task '$TaskPath$TaskName' was not found on this endpoint." -Level "ERROR"
    exit 1
}

# 2. Trigger the scheduled task
if ($PSCmdlet.ShouldProcess("Scheduled Task: $TaskPath$TaskName", "Execute Task")) {
    try {
        Write-Log "Executing scheduled task '$TaskPath$TaskName'..."
        
        # Trigger task run
        Start-ScheduledTask -TaskPath $TaskPath -TaskName $TaskName -ErrorAction Stop
        
        # Brief pause to verify task state
        Start-Sleep -Seconds 2
        $UpdatedTask = Get-ScheduledTask -TaskPath $TaskPath -TaskName $TaskName
        
        Write-Log "Successfully triggered task. Current Task State: $($UpdatedTask.State)" -Level "INFO"
        exit 0
    }
    catch {
        Write-Log "Failed to execute scheduled task '$TaskPath$TaskName'. Error: $_" -Level "ERROR"
        exit 1
    }
}