90 lines
2.8 KiB
PowerShell
Executable File
90 lines
2.8 KiB
PowerShell
Executable File
#Requires -RunAsAdministrator
|
|
|
|
<#
|
|
.SYNOPSIS
|
|
Triggers the Windows TPM Health Attestation Certificate Retrieval scheduled task.
|
|
|
|
.DESCRIPTION
|
|
Executes the '\Microsoft\Windows\TPM\Tpm-HASCertRetr' scheduled task to resolve
|
|
BitLocker device registration, Health Attestation, or TPM certificate retrieval
|
|
issues on endpoints (frequently used in Microsoft Intune environments).
|
|
|
|
.NOTES
|
|
Created: 2025-01-15
|
|
Modified: 2026-10-04
|
|
#>
|
|
|
|
[CmdletBinding(SupportsShouldProcess = $true)]
|
|
param (
|
|
[string]$LogDirectory = "C:\IntuneLogs",
|
|
[string]$LogFileName = "BitlockerRegFix.log",
|
|
[string]$TaskPath = "\Microsoft\Windows\TPM\",
|
|
[string]$TaskName = "Tpm-HASCertRetr"
|
|
)
|
|
|
|
# Build full log file path
|
|
$LogPath = Join-Path -Path $LogDirectory -ChildPath $LogFileName
|
|
|
|
# Helper function for structured, timestamped logging
|
|
function Write-Log {
|
|
param (
|
|
[string]$Message,
|
|
[ValidateSet("INFO", "WARNING", "ERROR")]
|
|
[string]$Level = "INFO"
|
|
)
|
|
$Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
|
|
$FormattedMessage = "[$Timestamp] [$Level] $Message"
|
|
|
|
# Write to console / verbose stream
|
|
if ($Level -eq "ERROR") {
|
|
Write-Error $Message
|
|
} elseif ($Level -eq "WARNING") {
|
|
Write-Warning $Message
|
|
} else {
|
|
Write-Host $FormattedMessage
|
|
}
|
|
|
|
# Append to log file safely
|
|
try {
|
|
if (-not (Test-Path -Path $LogDirectory)) {
|
|
New-Item -Path $LogDirectory -ItemType Directory -Force | Out-Null
|
|
}
|
|
Add-Content -Path $LogPath -Value $FormattedMessage -ErrorAction SilentlyContinue
|
|
}
|
|
catch {
|
|
# Fallback if logging fails
|
|
}
|
|
}
|
|
|
|
# --- Execution Logic ---
|
|
|
|
Write-Log "Starting BitLocker/TPM registration fix process..."
|
|
|
|
# 1. Verify scheduled task exists on the system
|
|
$Task = Get-ScheduledTask -TaskPath $TaskPath -TaskName $TaskName -ErrorAction SilentlyContinue
|
|
|
|
if (-not $Task) {
|
|
Write-Log "Scheduled task '$TaskPath$TaskName' was not found on this endpoint." -Level "ERROR"
|
|
exit 1
|
|
}
|
|
|
|
# 2. Trigger the scheduled task
|
|
if ($PSCmdlet.ShouldProcess("Scheduled Task: $TaskPath$TaskName", "Execute Task")) {
|
|
try {
|
|
Write-Log "Executing scheduled task '$TaskPath$TaskName'..."
|
|
|
|
# Trigger task run
|
|
Start-ScheduledTask -TaskPath $TaskPath -TaskName $TaskName -ErrorAction Stop
|
|
|
|
# Brief pause to verify task state
|
|
Start-Sleep -Seconds 2
|
|
$UpdatedTask = Get-ScheduledTask -TaskPath $TaskPath -TaskName $TaskName
|
|
|
|
Write-Log "Successfully triggered task. Current Task State: $($UpdatedTask.State)" -Level "INFO"
|
|
exit 0
|
|
}
|
|
catch {
|
|
Write-Log "Failed to execute scheduled task '$TaskPath$TaskName'. Error: $_" -Level "ERROR"
|
|
exit 1
|
|
}
|
|
} |