WaitForOnboarding

# Script to track the process HYbrid Join, MDM enrollment, Defender for endpoint onboarding.
# [email protected]

$logfilepath="C:\Windows\Temp\DefenderOnboarding.log"
$OnboardingFolder = "C:\Windows\Onboarding" #used to set lock screen image by GPO

function WriteToLogFile ($message)
{
$message +" - "+ (Get-Date).ToString() >> $logfilepath
}

WriteToLogFile "Script started"
#Set powerplan to Ultra Performance. Keeps the machine from going to sleep
WriteToLogFile "Importing high Performance powerplan"
powercfg /import C:\Windows\Temp\High.pow 24c8a99f-711f-424b-1234-790c4168ed60
powercfg /s 24c8a99f-711f-424b-1234-790c4168ed60

WriteToLogFile "Waiting for Hybrid Join"
do {
    $AADInfo = Get-Item "HKLM:/SYSTEM/CurrentControlSet/Control/CloudDomainJoin/JoinInfo"

    $guids = $AADInfo.GetSubKeyNames()
    foreach ($guid in $guids) {
        $guidSubKey = $AADinfo.OpenSubKey($guid);
        $DeviceDisplayName = ($Null -ne $guidSubKey.GetValue("DeviceDisplayName"))
        Start-Sleep -Seconds 1
    }
} while ($DeviceDisplayName -ne "True")
    WriteToLogFile "Hybrid Joined"

WriteToLogFile "Retrigger Co-Management task"
Start-Sleep -Seconds 15
$instance = Get-WmiObject -Namespace root\ccm\dcm -Query "Select * from SMS_DesiredConfiguration WHERE DisplayName = 'CoMgmtSettingsProd'"
Invoke-CimMethod -Namespace root\ccm\dcm -ClassName SMS_DesiredConfiguration -MethodName TriggerEvaluation -Arguments @{“Name” = $instance.Name; “Version” = $instance.Version; “PolicyType” = $instance.PolicyType}

WriteToLogFile "Waiting for Intune enrollment"
do {
    $MDMEnrollment = $Null -ne (Get-ItemProperty HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\MDMDeviceID).DeviceClientID
    Start-Sleep -Seconds 1
} while ($MDMEnrollment -ne "True")
    WriteToLogFile "Enrolled in MDM"

WriteToLogFile "Waiting for Defender onboarding"
do {
    $MDEState = (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status").onboardingstate -eq "1"
    Start-Sleep -Seconds 1
} while ($MDEState -ne "True")
    WriteToLogFile "Onboarded to Defender for endpoint"

WriteToLogFile "Waiting for VPN device profile"
do {
    $VPN = Get-VpnConnection -AllUserConnection -Name "AlwaysON VPN Device" -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 10
} while ($VPN -eq $null)
    WriteToLogFile "VPN profile applied from Intune"

Remove-Item -Path HKLM:\SOFTWARE\Policies\Microsoft\Windows\Personalization -Force

WriteToLogFile "Setting compnay recommended powerplan"
$powerplan = Get-WmiObject -Namespace root\cimv2\power -Class Win32_PowerPlan -Filter "ElementName = 'Company recommended'"
powercfg /setactive ([string]$powerplan.InstanceID).Replace("Microsoft:PowerPlan\{","").Replace("}","")

#Delete Ultimate powerplan
WriteToLogFile "Deleting imported performance powerplan"
powercfg /d 24c8a99f-711f-424b-1234-790c4168ed60

Remove-Item $OnboardingFolder
Unregister-ScheduledTask -TaskName waitforonboarding -Confirm:$false
WriteToLogFile "Done. Rebooting.."
Restart-Computer -Force