# Get a better Intune policy report part 3. (FINAL) What was my motivation to create my own *rsop-like* or *gpresult-like* Intune policy report? I was super frustrated by the built-in one (that you can generate in System settings) because it misses a lot of information plus shows a lot of useless ones. In my [previous post](https://doitpsway.com/get-a-better-intune-policy-report-part-2), I've talked about [parsing Intune MDMDiagReport.xml report](https://doitpsway.com/get-a-better-intune-policy-report-part-2) and how to extract a lot of helpful information from it. As was stated **MDMDiagReport.xml** doesn't contain all Intune policies processing data. *Scripts*, *Remediation scripts*, and *Win32Apps *are missing. Therefore this final post will be about merging data retrieved from **MDMDiagReport.xml** with data from the client's system registry which contains needed information to get a complete picture. **Result will be PowerShell function ([Get-ClientIntunePolicyResult](https://github.com/ztrhgf/useful_powershell_functions/blob/master/INTUNE/Get-ClientIntunePolicyResult.ps1)) (now part of the [IntuneStuff](https://www.powershellgallery.com/packages/IntuneStuff) module) that outputs PowerShell object or HTML report about every Intune policy, script, application etc applied to your computer.** --- # TL;DR - **Install** module [IntuneStuff](https://www.powershellgallery.com/packages/IntuneStuff) - **Import** the module - **Run ** PowerShell function `Get-ClientIntunePolicyResult` ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1657538281660/lVrdxJcLl.png align="left") > To get most detailed report (as HTML) call it like: `Get-ClientIntunePolicyResult -asHTML -getDataFromIntune -showConnectionData -showEnrollmentIDs -showURLs` and get result (interesting parts are highlighted) similar to ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636617247536/6FDs75u8q.png) TIP: To get a working HTML report, open it in Chrome browser, not Internet Explorer! --- # Why should I care? ## Built-in Intune HTML report has several disadvantages: - it is **very confusing** - is super long - shows a lot of useless information (I am looking at you KNOBS) - doesn't group information into meaningful sections (Bitlocker, Defender, MSI installations,...) - important **data are missing** - doesn't show Scripts, Win32Apps, and Remediation scripts at all - doesn't show details like what has policy changed (registry key/value), when was the last time policy was applied, errors - shows IDs instead of policy names - shows user01 instead of user SID - ... ### One example for all: searching for Bitlocker settings **Built-in Intune report** ![built-in report.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636617956515/LWhmZrJZN.png) **My report** ![my report.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636618134545/3A2AR-KrQ.png) > What irritate me most is that all necessary data are stored on the client, so why isn't Microsoft using them to generate usable report? It was possible for old school `GPO`, so why not for 'modern' Intune? ## What else interesting data do I get? - PolicyURL = URL to policy documentation (if available) - IntuneWin32AppURL, IntuneScriptURL, ... = URL of such item in Intune portal - and lot more, please check screenshots bellow ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636620396816/HsBsomSwB.png) ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636620544048/T1Nv5Ixne.png) ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636620718994/n1eGZZ646g.png) --- # Where can I get processing data for Scripts, Remediation scripts, and Win32Apps? Intune client stores a lot of useful information in the system registry. In general, it is at `HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension`. ## Win32App data Win32App data are stored at `HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension\Win32Apps` ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636554608343/TEeFwz9giS.png) ## Scripts data Script data are stored at `HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension\Policies` ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636554956114/-lq96D7NYK.png) ## Remediation scripts data Remediation scripts data are stored at `HKLM:\SOFTWARE\Microsoft\IntuneManagementExtension\SideCarPolicies\Scripts` - `Execution` key contains last execution time - `Reports` key contains last run result ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636555243302/h1UBSLLqe.png) Converted `Result` JSON can look like this ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636555455476/29pJjPRmH.png) --- # Where can I get Intune policies names? As far as I know, Intune doesn't store policies name (like you can see them in Intune admin web portal) locally. If you are lucky, you will get a policy ID that you have to translate to the corresponding Intune policy name. To do that you have use Intune Graph API. For working with Intune Graph API I am using the official PowerShell module `Microsoft.Graph.Intune`. - For making connection `Connect-MSGraph`. - For data retrieval `Invoke-MSGraphRequest` ``` $intuneRemediationScript = Invoke-MSGraphRequest -Url "https://graph.microsoft.com/beta/deviceManagement/deviceHealthScripts" | Get-MSGraphAllPages $intuneScript = Invoke-MSGraphRequest -Url "https://graph.microsoft.com/beta/deviceManagement/deviceManagementScripts" | Get-MSGraphAllPages $intuneApp = Invoke-MSGraphRequest -Url "https://graph.microsoft.com/beta/deviceAppManagement/mobileApps" | Get-MSGraphAllPages ``` > It seems to me that a lot of Intune policy types cannot be linked to locally applied policies. At least I wasn't able to find their IDs in MDMDiagReport.xml. That's the reason that just some of the policies get a translation. --- # How can I use function Get-ClientIntunePolicyResult As was already stated function [Get-ClientIntunePolicyResult](https://github.com/ztrhgf/useful_powershell_functions/blob/master/INTUNE/Get-ClientIntunePolicyResult.ps1) can outputs HTML or PowerShell object. **Getting object**: ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636622039308/xldPmp-2z.png) ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636622255915/-2G_k8vWB.png) **Getting HTML report**: ![image.png](https://cdn.hashnode.com/res/hashnode/image/upload/v1636622348201/hrHsdVzXE.png) --- # Summary There are still things to improve. Like getting error details from *event log* or local *log files* or making the function [Get-ClientIntunePolicyResult](https://github.com/ztrhgf/useful_powershell_functions/blob/master/INTUNE/Get-ClientIntunePolicyResult.ps1) faster. But in general, the work is done. We now have a useful 'gpresult' like tool for Intune policies 👍