Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
  marcoandClaude Opus 4.8
|
5c60eacc12 | ||
|
marcoandClaude Opus 4.8
|
830dddd15a | ||
|
marcoandClaude Opus 4.8
|
c1fc6f8b94 | ||
|
marcoandClaude Opus 4.8
|
4efc71376b | ||
|
marcoandClaude Opus 4.8
|
450428e7f7 |
@@ -119,10 +119,8 @@ jobs:
|
|||||||
MSI_NAME: ${{ steps.build.outputs.MSI_NAME }}
|
MSI_NAME: ${{ steps.build.outputs.MSI_NAME }}
|
||||||
COMMIT_SHA: ${{ github.sha }}
|
COMMIT_SHA: ${{ github.sha }}
|
||||||
run: |
|
run: |
|
||||||
$tokLen = if ([string]::IsNullOrEmpty($env:GITEA_TOKEN)) { 0 } else { $env:GITEA_TOKEN.Length }
|
|
||||||
Write-Host "Diagnose: GITEA_TOKEN Laenge = $tokLen (0 = Secret erreicht den Lauf nicht)"
|
|
||||||
if ([string]::IsNullOrWhiteSpace($env:GITEA_TOKEN)) {
|
if ([string]::IsNullOrWhiteSpace($env:GITEA_TOKEN)) {
|
||||||
Write-Host "::warning::GITEA_TOKEN leer (Laenge=$tokLen) — Gitea-Upload uebersprungen. Muss ein REPOSITORY-Secret sein unter Settings > Secrets and variables > Actions (Tab 'Secrets', NICHT 'Variables'), Name exakt GITEA_TOKEN, im Repo mwende/Intune-Manager."
|
Write-Host "::notice::GITEA_TOKEN nicht gesetzt — Gitea-Upload uebersprungen."
|
||||||
exit 0
|
exit 0
|
||||||
}
|
}
|
||||||
$headers = @{ Authorization = "token $env:GITEA_TOKEN" }
|
$headers = @{ Authorization = "token $env:GITEA_TOKEN" }
|
||||||
|
|||||||
@@ -5,6 +5,59 @@ Versionierung folgt [Semantic Versioning](https://semver.org/lang/de/) — solan
|
|||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
|
## [0.1.29] - 2026-08-24
|
||||||
|
|
||||||
|
Geräte-Offboarding (v1).
|
||||||
|
|
||||||
|
### Neu
|
||||||
|
|
||||||
|
- **Geräte-Offboarding** als neue Ansicht: Geräte über **Intune, Autopilot und Entra ID** hinweg entfernen (Decommissioning). Portiert aus dem [Device Offboarding Manager](https://github.com/ugurkocde/DeviceOffboardingManager) von Ugur Koc (MIT-Lizenz).
|
||||||
|
- Suche per Gerätename/Seriennummer, Auflösung der IDs über alle drei Dienste (`$batch`)
|
||||||
|
- **Recovery-Keys vor dem Löschen**: BitLocker/FileVault und LAPS-Passwörter werden angezeigt
|
||||||
|
- Bestätigungs-Dialog mit Dienst-Auswahl (Entra löschen/deaktivieren, Intune, Autopilot), Pflicht-Bestätigung und Ergebnis-Liste; **403/Multi-Admin-Approval** wird abgefangen
|
||||||
|
- Im **Read-Only-Modus gesperrt**
|
||||||
|
- Neue Endpoints: `GET /api/offboard/search`, `POST /api/offboard/keys`, `POST /api/offboard/execute` (neues Modul `src/Offboard.ps1`)
|
||||||
|
- Zusätzliche Berechtigungen dokumentiert; Setup-Skript-Schalter `-IncludeOffboarding`. (MDE-Offboarding bewusst nicht in v1.)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## [0.1.28] - 2026-08-24
|
||||||
|
|
||||||
|
Umbenennen beim Import, UI-Fixes, Geräte-Export repariert.
|
||||||
|
|
||||||
|
### Neu
|
||||||
|
|
||||||
|
- **Umbenennen beim Import**: Vor dem Anlegen kann jeder importierten Policy im neuen Dialog „Policies importieren" ein anderer Name gegeben werden (das richtige Namensfeld je Typ — `name`/`displayName` — wird gesetzt).
|
||||||
|
|
||||||
|
### Behoben
|
||||||
|
|
||||||
|
- **Geräte-Export im App Report**: Der von Graph entfernte synchrone Endpoint `getDeviceInstallStatusReport` (400 „Resource not found for the segment") ist durch den asynchronen Export-Job **`DeviceInstallStatusByApp`** ersetzt (ZIP/CSV-Auswertung, tolerantes Spalten-Mapping). ZIP/CSV-Logik in `Get-IntuneReportRows` ausgelagert.
|
||||||
|
- **Darkmode-Kontrast** im Zuweisungs-Dialog: Gruppen-Chips nutzen jetzt die Theme-Variablen (`--surface-strong`/`--ink` statt fester heller Farben) — heller Text auf hellem Chip behoben.
|
||||||
|
- **Dialog-Breite**: Lange Policy-Namen im Zuweisungs-/Import-Dialog brechen jetzt um (`overflow-wrap`/`flex-wrap`) statt horizontal zu scrollen; das Fenster passt sich der Breite an.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## [0.1.27] - 2026-08-23
|
||||||
|
|
||||||
|
Policy-Import härter, Administrative Vorlagen, Zuweisung nach Import, Git-Snapshot, App-Registrierungs-Doku.
|
||||||
|
|
||||||
|
### Neu
|
||||||
|
|
||||||
|
- **Administrative Vorlagen (ADMX / `groupPolicyConfigurations`)** als vierter Policy-Typ für Export und Import. Beim Import wird die Konfigurations-Hülle angelegt und jede Einstellung einzeln über `definition@odata.bind` / `presentation@odata.bind` angehängt (eingebaute ADMX-Definitionen sind tenantübergreifend gültig). Neuer Endpoint `GET /api/policies/administrativetemplate`.
|
||||||
|
- **Zuweisung direkt nach Import**: Dialog listet die neu angelegten Policies und lässt **pro Policy Include-/Exclude-Gruppen** im Ziel-Tenant zuweisen (Typeahead über die vorhandene Gruppensuche). Neuer Endpoint `POST /api/policies/assign` (nutzt die typ-spezifische `/assign`-Action für alle vier Typen).
|
||||||
|
- **Git-Snapshot (versioniertes Policy-Backup)**: Button „Git-Snapshot" schreibt alle Policies aller Typen als JSON in einen konfigurierten lokalen Git-Ordner und committet sie (optional `git push` über den vorhandenen Credential-Helper). Stabile Dateinamen + deterministische, zeitstempel-freie Ausgabe → saubere Diffs. Neue Settings-Sektion `policyBackup` (`gitRepoPath`, `push`).
|
||||||
|
- Import akzeptiert jetzt auch **Git-Snapshot-Dateien** (Feld `policyType` zusätzlich zu `exportType`).
|
||||||
|
- **Doku + Provisioning-Skript für die App-Registrierung**: [`docs/App-Registration.md`](docs/App-Registration.md) listet alle benötigten delegierten Graph-Berechtigungen (Kern, Geräte-Tab, Read-Only) samt Auth-Konfiguration; [`docs/Setup-AppRegistration.ps1`](docs/Setup-AppRegistration.ps1) legt die Registrierung automatisch an bzw. aktualisiert sie (Rechte, Public-Client-Flow, Redirect-URIs, optional Admin-Consent) — Berechtigungs-IDs werden live aufgelöst, keine fest verdrahteten GUIDs.
|
||||||
|
|
||||||
|
### Behoben
|
||||||
|
|
||||||
|
- **Settings-Catalog-Import** war gegen Graph-Schema-Fehler anfällig: verschachtelte Collection-Properties (`children`, `*SettingCollectionValue`) werden jetzt konsequent als Arrays serialisiert (repariert PowerShell-5.1-JSON-Roundtrip-Schäden), `null`-Collections werden zu `[]` (Graph verlangt `Nullable=False`), der Wrapper-`@odata.type` wird je Setting gesetzt und das read-only `id`-Feld entfernt.
|
||||||
|
- **Phantom-Fehler beim Import**: ein fehlendes `fileNames`-Feld erzeugte über `@($null)` einen Geisterdurchlauf im Archiv-Pfad und meldete fälschlich „1 fehlgeschlagen".
|
||||||
|
- **Tenant-Wechsel**: das Frontend zeigte weiter die Apps/Gruppen des vorherigen Tenants, weil die Lade-Guards nicht zurückgesetzt wurden. Alle datentragenden Caches werden jetzt beim Wechsel verworfen (`resetClientState`).
|
||||||
|
- **WAM-Anmeldefenster** kommt beim Login/Tenant-Wechsel zuverlässig in den Vordergrund (AttachThreadInput + kurzer ALT-Tap zum Lösen des Windows-Foreground-Locks).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
## [0.1.26] - 2026-08-21
|
## [0.1.26] - 2026-08-21
|
||||||
|
|
||||||
Multi-Tenant, Pro-Tenant-Vorgaben, RPA entfernt.
|
Multi-Tenant, Pro-Tenant-Vorgaben, RPA entfernt.
|
||||||
|
|||||||
@@ -120,6 +120,11 @@ Settings → Verbindung
|
|||||||
> ⚠ Ohne `DeviceManagementManagedDevices.Read.All` zeigt der App-Report nur
|
> ⚠ Ohne `DeviceManagementManagedDevices.Read.All` zeigt der App-Report nur
|
||||||
> Zaehler = 0 und der Geraete-Export liefert keine Eintraege.
|
> Zaehler = 0 und der Geraete-Export liefert keine Eintraege.
|
||||||
|
|
||||||
|
**Vollstaendige Berechtigungsliste, Redirect-URIs und ein Skript, das die
|
||||||
|
App-Registrierung automatisch anlegt/konfiguriert:**
|
||||||
|
[docs/App-Registration.md](docs/App-Registration.md) — inkl.
|
||||||
|
[`Setup-AppRegistration.ps1`](docs/Setup-AppRegistration.ps1).
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Navigation (Tabs)
|
## Navigation (Tabs)
|
||||||
@@ -237,6 +242,21 @@ neu an. Unterstuetzte Typen:
|
|||||||
automatisch zur Verbindung ergaenzt — in der Azure-App-Registration muss die
|
automatisch zur Verbindung ergaenzt — in der Azure-App-Registration muss die
|
||||||
Berechtigung aber vorhanden und (Admin-)zugestimmt sein.
|
Berechtigung aber vorhanden und (Admin-)zugestimmt sein.
|
||||||
|
|
||||||
|
### Git-Snapshot (versioniertes Backup)
|
||||||
|
|
||||||
|
Button **„Git-Snapshot"** im Policies-Tab schreibt **alle** Policies aller Typen
|
||||||
|
als JSON in einen konfigurierten **lokalen Git-Ordner** und committet sie
|
||||||
|
automatisch — ideal als versioniertes Backup mit nachvollziehbarer History.
|
||||||
|
|
||||||
|
- Konfiguration: **Settings → Policy-Backup (Git)** — lokaler Repo-Pfad (wird bei
|
||||||
|
Bedarf angelegt und `git init`-isiert) + optional **automatischer `git push`**
|
||||||
|
(nutzt den vorhandenen Git-Credential-Helper; **kein Token in der App**).
|
||||||
|
- **Stabile Dateinamen** (`<tenant>/<typ>/<name>__<id8>.json`) und deterministische,
|
||||||
|
zeitstempel-freie JSON-Ausgabe → saubere Git-Diffs zwischen Snapshots. Entfernte
|
||||||
|
Policies verschwinden aus dem Snapshot.
|
||||||
|
- Multi-Tenant: je Mandant ein eigener Unterordner (nach Profil-Label bzw. Tenant-ID).
|
||||||
|
- Gibt es keine Aenderungen seit dem letzten Snapshot, wird nichts committet.
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
## Architektur
|
## Architektur
|
||||||
|
|||||||
@@ -137,6 +137,7 @@ if (-not $SkipModuleCheck) {
|
|||||||
. (Join-Path $root "src/Graph.ps1")
|
. (Join-Path $root "src/Graph.ps1")
|
||||||
. (Join-Path $root "src/Api.ps1")
|
. (Join-Path $root "src/Api.ps1")
|
||||||
. (Join-Path $root "src/PolicyIO.ps1")
|
. (Join-Path $root "src/PolicyIO.ps1")
|
||||||
|
. (Join-Path $root "src/Offboard.ps1")
|
||||||
. (Join-Path $root "src/Router.ps1")
|
. (Join-Path $root "src/Router.ps1")
|
||||||
. (Join-Path $root "src/Server.ps1")
|
. (Join-Path $root "src/Server.ps1")
|
||||||
|
|
||||||
@@ -188,7 +189,7 @@ $script:State = [pscustomobject]@{
|
|||||||
Session = @() # geplante Zuweisungen
|
Session = @() # geplante Zuweisungen
|
||||||
}
|
}
|
||||||
|
|
||||||
$script:ToolVersion = "0.1.26"
|
$script:ToolVersion = "0.1.29"
|
||||||
$script:BuildStamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
|
$script:BuildStamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
|
||||||
|
|
||||||
Write-Host ""
|
Write-Host ""
|
||||||
|
|||||||
@@ -0,0 +1,150 @@
|
|||||||
|
# App-Registrierung & Berechtigungen
|
||||||
|
|
||||||
|
Der Intune Manager meldet sich als **delegierte** Anwendung an (Device-Code- bzw.
|
||||||
|
WAM-Login) — er handelt also immer **im Namen des angemeldeten Admins**, nie mit
|
||||||
|
Anwendungsrechten. Die App-Registrierung braucht daher **delegierte
|
||||||
|
Microsoft-Graph-Berechtigungen** plus die passende Authentifizierungs-Konfiguration.
|
||||||
|
|
||||||
|
> **Schnellweg:** Statt alles von Hand zu klicken, legt das Skript
|
||||||
|
> [`Setup-AppRegistration.ps1`](Setup-AppRegistration.ps1) die Registrierung
|
||||||
|
> komplett an (Rechte + Public-Client-Flow + Redirect-URIs + optional Consent).
|
||||||
|
> Siehe [Automatische Einrichtung](#automatische-einrichtung).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Benötigte Berechtigungen
|
||||||
|
|
||||||
|
Alle Berechtigungen sind vom Typ **Delegiert** (Microsoft Graph).
|
||||||
|
|
||||||
|
### Kern (immer erforderlich)
|
||||||
|
|
||||||
|
| Berechtigung | Wofür |
|
||||||
|
|---|---|
|
||||||
|
| `Group.ReadWrite.All` | Gruppen anlegen, App-/Policy-Zuweisungen setzen |
|
||||||
|
| `GroupMember.ReadWrite.All` | Gruppenmitglieder lesen/hinzufügen/entfernen, CSV-Import |
|
||||||
|
| `User.Read.All` | Benutzersuche, UPN-Auflösung |
|
||||||
|
| `DeviceManagementApps.ReadWrite.All` | Apps auflisten, zuweisen, umbenennen, löschen, Setup-Datei aktualisieren, App-Report |
|
||||||
|
| `DeviceManagementConfiguration.ReadWrite.All` | Policies (Settings Catalog, Compliance, Konfigurationsprofile, Administrative Vorlagen) lesen, exportieren, importieren, zuweisen |
|
||||||
|
| `offline_access` | Refresh-Token (Device-Code-Flow) |
|
||||||
|
|
||||||
|
> `DeviceManagementConfiguration.ReadWrite.All` wird vom Tool automatisch zur
|
||||||
|
> Verbindung ergänzt — die App-Registrierung muss die Berechtigung aber besitzen
|
||||||
|
> und (Admin-)zugestimmt bekommen haben, sonst schlägt der Policy-Import mit
|
||||||
|
> `403 Forbidden` fehl.
|
||||||
|
|
||||||
|
### Geräte-Tab (optional)
|
||||||
|
|
||||||
|
Nur nötig, wenn der **Geräte-Tab** (Sync/Reboot/Lock/Diagnose/Wipe/Retire) genutzt wird:
|
||||||
|
|
||||||
|
| Berechtigung | Wofür |
|
||||||
|
|---|---|
|
||||||
|
| `DeviceManagementManagedDevices.Read.All` | Geräte auflisten und Details anzeigen |
|
||||||
|
| `DeviceManagementManagedDevices.ReadWrite.All` | Sync, Neustart, Remote-Lock, Diagnose, BitLocker-Key-Rotation |
|
||||||
|
| `DeviceManagementManagedDevices.PrivilegedOperations.All` | Wipe, Retire, Autopilot-Reset |
|
||||||
|
|
||||||
|
### Geräte-Offboarding (optional)
|
||||||
|
|
||||||
|
Nur nötig, wenn die **Offboarding**-Ansicht (Geräte aus Intune + Autopilot + Entra
|
||||||
|
entfernen, Recovery-Keys lesen) genutzt wird:
|
||||||
|
|
||||||
|
| Berechtigung | Wofür |
|
||||||
|
|---|---|
|
||||||
|
| `Device.ReadWrite.All` | Gerät aus Entra ID löschen/deaktivieren |
|
||||||
|
| `DeviceManagementManagedDevices.ReadWrite.All` | Gerät aus Intune löschen |
|
||||||
|
| `DeviceManagementServiceConfig.ReadWrite.All` | Gerät aus Autopilot löschen |
|
||||||
|
| `BitlockerKey.Read.All` | BitLocker-Recovery-Keys lesen |
|
||||||
|
| `DeviceLocalCredential.Read.All` | LAPS-Passwörter lesen |
|
||||||
|
|
||||||
|
> **Wichtig:** Löschen aus Entra/Intune/Autopilot benötigt bei delegierter
|
||||||
|
> Anmeldung zusätzlich **Verzeichnis-/Intune-Rollen** (Cloud Device Administrator
|
||||||
|
> bzw. Intune Administrator) — die Scopes allein reichen nicht, sonst `403`.
|
||||||
|
> Diese Scopes müssen außerdem in den **Read/Write-Scopes** des Tools eingetragen
|
||||||
|
> sein (Einstellungen → Verbindung), damit sie im Token landen.
|
||||||
|
> Skript: `.\docs\Setup-AppRegistration.ps1 -IncludeOffboarding -GrantAdminConsent`
|
||||||
|
|
||||||
|
### Read-Only-Variante
|
||||||
|
|
||||||
|
Für eine reine Anzeige-App (im Tool als `clientIdRo` hinterlegbar) genügen die
|
||||||
|
`*.Read.All`-Pendants:
|
||||||
|
|
||||||
|
`Group.Read.All`, `GroupMember.Read.All`, `User.Read.All`,
|
||||||
|
`DeviceManagementApps.Read.All`, `DeviceManagementConfiguration.Read.All`,
|
||||||
|
`offline_access` (+ optional `DeviceManagementManagedDevices.Read.All`).
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Authentifizierungs-Konfiguration
|
||||||
|
|
||||||
|
Zusätzlich zu den Berechtigungen muss die App als **öffentlicher Client** nutzbar
|
||||||
|
sein — sonst scheitert der erste Login (`AADSTS500113` bzw. `AADSTS50011`):
|
||||||
|
|
||||||
|
1. **Öffentliche Clientflows zulassen** → **Ja**
|
||||||
|
(Entra → App-Registrierung → *Authentifizierung* → ganz unten;
|
||||||
|
im Manifest `isFallbackPublicClient = true`).
|
||||||
|
2. **Redirect-URIs** unter *Mobilgerät- und Desktopanwendungen*:
|
||||||
|
```
|
||||||
|
https://login.microsoftonline.com/common/oauth2/nativeclient
|
||||||
|
ms-appx-web://Microsoft.AAD.BrokerPlugin/<CLIENT-ID>
|
||||||
|
```
|
||||||
|
- Zeile 1 → **Device-Code-Flow**
|
||||||
|
- Zeile 2 → **WAM-Broker** (Windows-Anmeldefenster); `<CLIENT-ID>` ist die
|
||||||
|
AppId der Registrierung selbst.
|
||||||
|
3. **Multi-Tenant:** Wird dieselbe App gegen fremde Tenants genutzt, muss
|
||||||
|
`signInAudience` auf *Accounts in any organizational directory*
|
||||||
|
(`AzureADMultipleOrgs`) stehen und im Ziel-Tenant per Admin-Consent
|
||||||
|
bereitgestellt werden. Bei einer eigenen App **pro** Tenant ist Single-Tenant
|
||||||
|
ausreichend.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Automatische Einrichtung
|
||||||
|
|
||||||
|
Das Skript [`Setup-AppRegistration.ps1`](Setup-AppRegistration.ps1) erledigt alles
|
||||||
|
oben Genannte über Microsoft Graph. Es braucht nur das Modul
|
||||||
|
`Microsoft.Graph.Authentication` (dieselbe Abhängigkeit wie das Tool) und löst die
|
||||||
|
Berechtigungs-IDs **live** aus dem Graph-Service-Principal auf — keine fest
|
||||||
|
verdrahteten GUIDs.
|
||||||
|
|
||||||
|
```powershell
|
||||||
|
# Einmalig:
|
||||||
|
Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
|
||||||
|
|
||||||
|
# Neue Single-Tenant-App inkl. Admin-Consent:
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -GrantAdminConsent
|
||||||
|
|
||||||
|
# Mit Geräte-Rechten:
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -IncludeDeviceActions -GrantAdminConsent
|
||||||
|
|
||||||
|
# Multi-Tenant-App:
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -MultiTenant -GrantAdminConsent
|
||||||
|
|
||||||
|
# Bestehende App nur um Rechte/Redirect-URIs ergänzen:
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -ClientId "<APP-ID>" -GrantAdminConsent
|
||||||
|
|
||||||
|
# Nur das Manifest-Snippet ausgeben (ohne etwas anzulegen wäre -WhatIf-artig —
|
||||||
|
# hier zusätzlich zum Anlegen):
|
||||||
|
.\docs\Setup-AppRegistration.ps1 -EmitManifest
|
||||||
|
```
|
||||||
|
|
||||||
|
Am Ende gibt das Skript **Tenant ID** und **Client ID** aus — diese Werte im
|
||||||
|
Intune Manager unter *Einstellungen → Verbindung* (bzw. im Tenant-Profil)
|
||||||
|
eintragen.
|
||||||
|
|
||||||
|
Die zum Anlegen/Ändern nötigen Admin-Rechte (`Application.ReadWrite.All`, für
|
||||||
|
Consent zusätzlich `DelegatedPermissionGrant.ReadWrite.All`) werden beim
|
||||||
|
`Connect-MgGraph`-Aufruf des Skripts einmalig abgefragt.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## Manuelle Einrichtung (Portal)
|
||||||
|
|
||||||
|
1. **Entra** → *App-Registrierungen* → *Neue Registrierung* → Name vergeben,
|
||||||
|
Kontotyp wählen (Single- oder Multi-Tenant) → **Registrieren**.
|
||||||
|
2. *API-Berechtigungen* → *Berechtigung hinzufügen* → **Microsoft Graph** →
|
||||||
|
**Delegierte Berechtigungen** → die [Kern-Berechtigungen](#kern-immer-erforderlich)
|
||||||
|
(und bei Bedarf die [Geräte-Berechtigungen](#geräte-tab-optional)) auswählen →
|
||||||
|
**Administratorzustimmung erteilen**.
|
||||||
|
3. *Authentifizierung* → [Authentifizierungs-Konfiguration](#authentifizierungs-konfiguration)
|
||||||
|
wie oben setzen (Public-Client-Flow + beide Redirect-URIs).
|
||||||
|
4. **Übersichtsseite**: *Anwendungs-(Client-)ID* und *Verzeichnis-(Mandanten-)ID*
|
||||||
|
in den Intune Manager übernehmen.
|
||||||
@@ -0,0 +1,227 @@
|
|||||||
|
<#
|
||||||
|
.SYNOPSIS
|
||||||
|
Legt die App-Registrierung fuer den Intune Manager an (oder aktualisiert sie)
|
||||||
|
inkl. Graph-Berechtigungen, Public-Client-Flow und Redirect-URIs.
|
||||||
|
|
||||||
|
.DESCRIPTION
|
||||||
|
Deckt genau die Punkte ab, an denen der erste Login sonst mit
|
||||||
|
AADSTS500113 / AADSTS50011 scheitert:
|
||||||
|
* Delegierte Microsoft-Graph-Berechtigungen (nach Bedarf: RW, RO, Geraete)
|
||||||
|
* "Oeffentliche Clientflows zulassen" (isFallbackPublicClient = true)
|
||||||
|
* Redirect-URIs fuer Device-Code (nativeclient) und WAM-Broker
|
||||||
|
* optional Admin-Consent
|
||||||
|
|
||||||
|
Nutzt nur Microsoft.Graph.Authentication (Invoke-MgGraphRequest) — dieselbe
|
||||||
|
Abhaengigkeit wie das Tool selbst. Berechtigungs-IDs werden LIVE aus dem
|
||||||
|
Graph-Service-Principal aufgeloest, es sind also keine fest verdrahteten
|
||||||
|
GUIDs noetig (die sonst leicht veralten).
|
||||||
|
|
||||||
|
.PARAMETER DisplayName
|
||||||
|
Anzeigename der App-Registrierung. Default: "Intune Manager".
|
||||||
|
|
||||||
|
.PARAMETER ClientId
|
||||||
|
AppId einer BESTEHENDEN Registrierung, die aktualisiert werden soll.
|
||||||
|
Ohne diesen Parameter wird eine NEUE App angelegt.
|
||||||
|
|
||||||
|
.PARAMETER MultiTenant
|
||||||
|
App fuer mehrere Tenants (signInAudience = AzureADMultipleOrgs).
|
||||||
|
Default: nur der aktuelle Tenant (AzureADMyOrg).
|
||||||
|
|
||||||
|
.PARAMETER ReadOnly
|
||||||
|
Verwendet die Read-Only-Berechtigungen (fuer eine reine Anzeige-/RO-App,
|
||||||
|
passend zu clientIdRo im Tool).
|
||||||
|
|
||||||
|
.PARAMETER IncludeDeviceActions
|
||||||
|
Nimmt zusaetzlich die Berechtigungen fuer den Geraete-Tab auf
|
||||||
|
(Read + ReadWrite + PrivilegedOperations = Sync/Reboot/Lock/Wipe/Retire).
|
||||||
|
|
||||||
|
.PARAMETER GrantAdminConsent
|
||||||
|
Erteilt direkt tenantweiten Admin-Consent fuer die gesetzten Scopes.
|
||||||
|
Benoetigt entsprechend privilegierte Anmeldung.
|
||||||
|
|
||||||
|
.PARAMETER EmitManifest
|
||||||
|
Gibt zusaetzlich den requiredResourceAccess-Block als JSON aus (zum manuellen
|
||||||
|
Einfuegen in das App-Manifest im Portal).
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
# Neue Single-Tenant-App inkl. Consent:
|
||||||
|
.\Setup-AppRegistration.ps1 -GrantAdminConsent
|
||||||
|
|
||||||
|
.EXAMPLE
|
||||||
|
# Bestehende App um Geraete-Rechte erweitern:
|
||||||
|
.\Setup-AppRegistration.ps1 -ClientId "51477347-...." -IncludeDeviceActions -GrantAdminConsent
|
||||||
|
|
||||||
|
.NOTES
|
||||||
|
Vorher einmalig: Install-Module Microsoft.Graph.Authentication -Scope CurrentUser
|
||||||
|
#>
|
||||||
|
[CmdletBinding()]
|
||||||
|
param(
|
||||||
|
[string]$DisplayName = 'Intune Manager',
|
||||||
|
[string]$ClientId,
|
||||||
|
[switch]$MultiTenant,
|
||||||
|
[switch]$ReadOnly,
|
||||||
|
[switch]$IncludeDeviceActions,
|
||||||
|
[switch]$IncludeOffboarding,
|
||||||
|
[switch]$GrantAdminConsent,
|
||||||
|
[switch]$EmitManifest
|
||||||
|
)
|
||||||
|
|
||||||
|
$ErrorActionPreference = 'Stop'
|
||||||
|
$GraphAppId = '00000003-0000-0000-c000-000000000000' # Microsoft Graph
|
||||||
|
|
||||||
|
# --- Benoetigte delegierte Berechtigungen zusammenstellen ---------------------
|
||||||
|
$perms = if ($ReadOnly) {
|
||||||
|
@('Group.Read.All','GroupMember.Read.All','User.Read.All',
|
||||||
|
'DeviceManagementApps.Read.All','DeviceManagementConfiguration.Read.All','offline_access')
|
||||||
|
} else {
|
||||||
|
@('Group.ReadWrite.All','GroupMember.ReadWrite.All','User.Read.All',
|
||||||
|
'DeviceManagementApps.ReadWrite.All','DeviceManagementConfiguration.ReadWrite.All','offline_access')
|
||||||
|
}
|
||||||
|
if ($IncludeDeviceActions) {
|
||||||
|
$perms += if ($ReadOnly) {
|
||||||
|
@('DeviceManagementManagedDevices.Read.All')
|
||||||
|
} else {
|
||||||
|
@('DeviceManagementManagedDevices.Read.All',
|
||||||
|
'DeviceManagementManagedDevices.ReadWrite.All',
|
||||||
|
'DeviceManagementManagedDevices.PrivilegedOperations.All')
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if ($IncludeOffboarding) {
|
||||||
|
# Geraete ueber Intune/Autopilot/Entra entfernen + Recovery-Keys lesen.
|
||||||
|
# ACHTUNG: Loeschen braucht zusaetzlich Verzeichnis-/Intune-ROLLEN (Cloud
|
||||||
|
# Device Administrator / Intune Administrator) — nicht nur diese Scopes.
|
||||||
|
$perms += @(
|
||||||
|
'Device.ReadWrite.All',
|
||||||
|
'DeviceManagementManagedDevices.ReadWrite.All',
|
||||||
|
'DeviceManagementServiceConfig.ReadWrite.All',
|
||||||
|
'BitlockerKey.Read.All',
|
||||||
|
'DeviceLocalCredential.Read.All'
|
||||||
|
)
|
||||||
|
}
|
||||||
|
$perms = $perms | Select-Object -Unique
|
||||||
|
|
||||||
|
# --- Verbinden ----------------------------------------------------------------
|
||||||
|
Write-Host "[1/6] Mit Microsoft Graph verbinden (Admin noetig)..." -ForegroundColor Cyan
|
||||||
|
$connectScopes = @('Application.ReadWrite.All')
|
||||||
|
if ($GrantAdminConsent) { $connectScopes += 'DelegatedPermissionGrant.ReadWrite.All' }
|
||||||
|
Import-Module Microsoft.Graph.Authentication -ErrorAction Stop
|
||||||
|
Connect-MgGraph -Scopes $connectScopes -NoWelcome
|
||||||
|
$ctx = Get-MgContext
|
||||||
|
if (-not $ctx) { throw 'Keine Graph-Verbindung.' }
|
||||||
|
Write-Host " verbunden mit Tenant $($ctx.TenantId) als $($ctx.Account)" -ForegroundColor DarkGray
|
||||||
|
|
||||||
|
# --- Graph-Service-Principal + Berechtigungs-IDs aufloesen --------------------
|
||||||
|
Write-Host "[2/6] Graph-Berechtigungen aufloesen..." -ForegroundColor Cyan
|
||||||
|
$graphSp = (Invoke-MgGraphRequest -Method GET `
|
||||||
|
-Uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '$GraphAppId'&`$select=id,oauth2PermissionScopes").value | Select-Object -First 1
|
||||||
|
if (-not $graphSp) { throw 'Graph-Service-Principal nicht gefunden.' }
|
||||||
|
$graphSpId = $graphSp.id
|
||||||
|
|
||||||
|
$scopeMap = @{}
|
||||||
|
foreach ($s in $graphSp.oauth2PermissionScopes) { $scopeMap[$s.value] = $s.id }
|
||||||
|
|
||||||
|
$resourceAccess = @()
|
||||||
|
foreach ($p in $perms) {
|
||||||
|
if (-not $scopeMap.ContainsKey($p)) { throw "Delegierte Berechtigung '$p' nicht im Graph-SP gefunden." }
|
||||||
|
$resourceAccess += @{ id = $scopeMap[$p]; type = 'Scope' }
|
||||||
|
}
|
||||||
|
$requiredResourceAccess = @(@{ resourceAppId = $GraphAppId; resourceAccess = $resourceAccess })
|
||||||
|
|
||||||
|
if ($EmitManifest) {
|
||||||
|
Write-Host "`n--- requiredResourceAccess (Manifest) ---" -ForegroundColor Yellow
|
||||||
|
($requiredResourceAccess | ConvertTo-Json -Depth 6)
|
||||||
|
Write-Host "-----------------------------------------`n" -ForegroundColor Yellow
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- App anlegen oder aktualisieren -------------------------------------------
|
||||||
|
$signInAudience = if ($MultiTenant) { 'AzureADMultipleOrgs' } else { 'AzureADMyOrg' }
|
||||||
|
|
||||||
|
if ($ClientId) {
|
||||||
|
Write-Host "[3/6] Bestehende App $ClientId laden..." -ForegroundColor Cyan
|
||||||
|
$app = (Invoke-MgGraphRequest -Method GET `
|
||||||
|
-Uri "https://graph.microsoft.com/v1.0/applications?`$filter=appId eq '$ClientId'&`$select=id,appId").value | Select-Object -First 1
|
||||||
|
if (-not $app) { throw "App mit appId $ClientId nicht gefunden." }
|
||||||
|
$objId = $app.id
|
||||||
|
$appId = $ClientId
|
||||||
|
$patch = @{
|
||||||
|
signInAudience = $signInAudience
|
||||||
|
isFallbackPublicClient = $true
|
||||||
|
requiredResourceAccess = $requiredResourceAccess
|
||||||
|
publicClient = @{ redirectUris = @(
|
||||||
|
'https://login.microsoftonline.com/common/oauth2/nativeclient'
|
||||||
|
"ms-appx-web://Microsoft.AAD.BrokerPlugin/$appId"
|
||||||
|
) }
|
||||||
|
}
|
||||||
|
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/applications/$objId" `
|
||||||
|
-Body ($patch | ConvertTo-Json -Depth 8) -ContentType 'application/json' | Out-Null
|
||||||
|
Write-Host " App aktualisiert." -ForegroundColor Green
|
||||||
|
} else {
|
||||||
|
Write-Host "[3/6] Neue App '$DisplayName' anlegen..." -ForegroundColor Cyan
|
||||||
|
# Broker-Redirect-URI braucht die appId -> erst mit nativeclient anlegen,
|
||||||
|
# danach die Broker-URI per PATCH ergaenzen.
|
||||||
|
$create = @{
|
||||||
|
displayName = $DisplayName
|
||||||
|
signInAudience = $signInAudience
|
||||||
|
isFallbackPublicClient = $true
|
||||||
|
requiredResourceAccess = $requiredResourceAccess
|
||||||
|
publicClient = @{ redirectUris = @('https://login.microsoftonline.com/common/oauth2/nativeclient') }
|
||||||
|
}
|
||||||
|
$app = Invoke-MgGraphRequest -Method POST -Uri 'https://graph.microsoft.com/v1.0/applications' `
|
||||||
|
-Body ($create | ConvertTo-Json -Depth 8) -ContentType 'application/json'
|
||||||
|
$objId = $app.id
|
||||||
|
$appId = $app.appId
|
||||||
|
|
||||||
|
$patch = @{ publicClient = @{ redirectUris = @(
|
||||||
|
'https://login.microsoftonline.com/common/oauth2/nativeclient'
|
||||||
|
"ms-appx-web://Microsoft.AAD.BrokerPlugin/$appId"
|
||||||
|
) } }
|
||||||
|
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/applications/$objId" `
|
||||||
|
-Body ($patch | ConvertTo-Json -Depth 6) -ContentType 'application/json' | Out-Null
|
||||||
|
Write-Host " App angelegt: appId $appId" -ForegroundColor Green
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- Service-Principal (Enterprise-App) sicherstellen -------------------------
|
||||||
|
Write-Host "[4/6] Service-Principal sicherstellen..." -ForegroundColor Cyan
|
||||||
|
$sp = (Invoke-MgGraphRequest -Method GET `
|
||||||
|
-Uri "https://graph.microsoft.com/v1.0/servicePrincipals?`$filter=appId eq '$appId'&`$select=id").value | Select-Object -First 1
|
||||||
|
if (-not $sp) {
|
||||||
|
$sp = Invoke-MgGraphRequest -Method POST -Uri 'https://graph.microsoft.com/v1.0/servicePrincipals' `
|
||||||
|
-Body (@{ appId = $appId } | ConvertTo-Json) -ContentType 'application/json'
|
||||||
|
}
|
||||||
|
$spId = $sp.id
|
||||||
|
|
||||||
|
# --- Optional: Admin-Consent --------------------------------------------------
|
||||||
|
Write-Host "[5/6] Admin-Consent..." -ForegroundColor Cyan
|
||||||
|
if ($GrantAdminConsent) {
|
||||||
|
$scopeString = ($perms -join ' ')
|
||||||
|
# Bestehenden Grant fuer (Client -> Graph) suchen und ersetzen, sonst neu.
|
||||||
|
$existing = (Invoke-MgGraphRequest -Method GET `
|
||||||
|
-Uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants?`$filter=clientId eq '$spId' and resourceId eq '$graphSpId'").value | Select-Object -First 1
|
||||||
|
$grantBody = @{
|
||||||
|
clientId = $spId
|
||||||
|
consentType = 'AllPrincipals'
|
||||||
|
resourceId = $graphSpId
|
||||||
|
scope = $scopeString
|
||||||
|
}
|
||||||
|
if ($existing) {
|
||||||
|
Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/$($existing.id)" `
|
||||||
|
-Body (@{ scope = $scopeString } | ConvertTo-Json) -ContentType 'application/json' | Out-Null
|
||||||
|
} else {
|
||||||
|
Invoke-MgGraphRequest -Method POST -Uri 'https://graph.microsoft.com/v1.0/oauth2PermissionGrants' `
|
||||||
|
-Body ($grantBody | ConvertTo-Json) -ContentType 'application/json' | Out-Null
|
||||||
|
}
|
||||||
|
Write-Host " Admin-Consent erteilt fuer: $scopeString" -ForegroundColor Green
|
||||||
|
} else {
|
||||||
|
Write-Host " uebersprungen (-GrantAdminConsent nicht gesetzt)." -ForegroundColor DarkGray
|
||||||
|
Write-Host " Consent im Portal: Entra -> App-Registrierungen -> $DisplayName -> API-Berechtigungen -> Administratorzustimmung erteilen" -ForegroundColor DarkGray
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- Ergebnis -----------------------------------------------------------------
|
||||||
|
Write-Host "[6/6] Fertig." -ForegroundColor Cyan
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host " Im Intune Manager eintragen:" -ForegroundColor White
|
||||||
|
Write-Host " Tenant ID : $($ctx.TenantId)"
|
||||||
|
Write-Host " Client ID : $appId"
|
||||||
|
Write-Host ""
|
||||||
|
Write-Host " Gesetzte delegierte Berechtigungen:" -ForegroundColor White
|
||||||
|
$perms | ForEach-Object { Write-Host " - $_" }
|
||||||
@@ -12,7 +12,7 @@ if (Test-Path "$x64Dotnet\dotnet.exe") {
|
|||||||
$env:DOTNET_ROOT = "C:\Program Files\dotnet"
|
$env:DOTNET_ROOT = "C:\Program Files\dotnet"
|
||||||
}
|
}
|
||||||
|
|
||||||
$version = "0.1.26"
|
$version = "0.1.29"
|
||||||
$src = "\\Mac\Home\ClaudePRJ\Intune Manager"
|
$src = "\\Mac\Home\ClaudePRJ\Intune Manager"
|
||||||
$stage = "$env:TEMP\IntuneManagerStage"
|
$stage = "$env:TEMP\IntuneManagerStage"
|
||||||
$installerDir = "$src\installer"
|
$installerDir = "$src\installer"
|
||||||
|
|||||||
+148
-51
@@ -53,9 +53,17 @@ function Invoke-ApiHandler {
|
|||||||
"GET /api/policies/compliance" { return Get-CompliancePoliciesEndpoint }
|
"GET /api/policies/compliance" { return Get-CompliancePoliciesEndpoint }
|
||||||
"GET /api/policies/configuration" { return Get-ConfigurationProfilesEndpoint }
|
"GET /api/policies/configuration" { return Get-ConfigurationProfilesEndpoint }
|
||||||
"GET /api/policies/settingscatalog" { return Get-SettingsCatalogPoliciesEndpoint }
|
"GET /api/policies/settingscatalog" { return Get-SettingsCatalogPoliciesEndpoint }
|
||||||
|
"GET /api/policies/administrativetemplate" { return Get-AdministrativeTemplatesEndpoint }
|
||||||
"POST /api/policies/export" { return Export-PoliciesEndpoint -Body $Body }
|
"POST /api/policies/export" { return Export-PoliciesEndpoint -Body $Body }
|
||||||
"GET /api/policies/exports" { return Get-PolicyExportsEndpoint }
|
"GET /api/policies/exports" { return Get-PolicyExportsEndpoint }
|
||||||
"POST /api/policies/import" { return Import-PoliciesEndpoint -Body $Body }
|
"POST /api/policies/import" { return Import-PoliciesEndpoint -Body $Body }
|
||||||
|
"POST /api/policies/assign" { return Invoke-PolicyAssignEndpoint -Body $Body }
|
||||||
|
"POST /api/policies/git-snapshot" { return Invoke-PolicyGitSnapshotEndpoint }
|
||||||
|
"POST /api/pickfolder" { return Invoke-FolderPickerEndpoint -Body $Body }
|
||||||
|
|
||||||
|
"GET /api/offboard/search" { return Search-OffboardDevicesEndpoint -Query $Query }
|
||||||
|
"POST /api/offboard/keys" { return Get-OffboardKeysEndpoint -Body $Body }
|
||||||
|
"POST /api/offboard/execute" { return Invoke-OffboardExecuteEndpoint -Body $Body }
|
||||||
}
|
}
|
||||||
|
|
||||||
# 2-segment fallbacks (z.B. /api/groups/<id>/members)
|
# 2-segment fallbacks (z.B. /api/groups/<id>/members)
|
||||||
@@ -928,7 +936,30 @@ public class WinFocusHelper2 {
|
|||||||
[DllImport("user32.dll")] public static extern bool EnumWindows(EnumProc lpEnumFunc, IntPtr lParam);
|
[DllImport("user32.dll")] public static extern bool EnumWindows(EnumProc lpEnumFunc, IntPtr lParam);
|
||||||
[DllImport("user32.dll", CharSet = CharSet.Auto)] public static extern int GetWindowText(IntPtr hWnd, StringBuilder text, int count);
|
[DllImport("user32.dll", CharSet = CharSet.Auto)] public static extern int GetWindowText(IntPtr hWnd, StringBuilder text, int count);
|
||||||
[DllImport("user32.dll")] public static extern bool IsWindowVisible(IntPtr hWnd);
|
[DllImport("user32.dll")] public static extern bool IsWindowVisible(IntPtr hWnd);
|
||||||
|
[DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow();
|
||||||
|
[DllImport("user32.dll")] public static extern uint GetWindowThreadProcessId(IntPtr hWnd, IntPtr lpdwProcessId);
|
||||||
|
[DllImport("user32.dll")] public static extern bool AttachThreadInput(uint idAttach, uint idAttachTo, bool fAttach);
|
||||||
|
[DllImport("kernel32.dll")] public static extern uint GetCurrentThreadId();
|
||||||
|
[DllImport("user32.dll")] public static extern void keybd_event(byte bVk, byte bScan, uint dwFlags, UIntPtr dwExtraInfo);
|
||||||
public delegate bool EnumProc(IntPtr hWnd, IntPtr lParam);
|
public delegate bool EnumProc(IntPtr hWnd, IntPtr lParam);
|
||||||
|
// Holt ein Fenster zuverlaessig in den Vordergrund und umgeht den Windows-
|
||||||
|
// Foreground-Lock: kurzer ALT-Tap (entsperrt SetForegroundWindow) + Anhaengen
|
||||||
|
// an den Input-Thread des aktuellen Vordergrundfensters (AttachThreadInput).
|
||||||
|
public static void ForceForeground(IntPtr hWnd) {
|
||||||
|
keybd_event(0x12, 0, 0, UIntPtr.Zero); // ALT down -> Foreground-Lock loesen
|
||||||
|
keybd_event(0x12, 0, 2, UIntPtr.Zero); // ALT up (KEYEVENTF_KEYUP = 2)
|
||||||
|
IntPtr fore = GetForegroundWindow();
|
||||||
|
uint foreThread = GetWindowThreadProcessId(fore, IntPtr.Zero);
|
||||||
|
uint thisThread = GetCurrentThreadId();
|
||||||
|
bool attached = false;
|
||||||
|
if (foreThread != 0 && foreThread != thisThread) {
|
||||||
|
attached = AttachThreadInput(foreThread, thisThread, true);
|
||||||
|
}
|
||||||
|
ShowWindow(hWnd, 9); // SW_RESTORE
|
||||||
|
BringWindowToTop(hWnd);
|
||||||
|
SetForegroundWindow(hWnd);
|
||||||
|
if (attached) { AttachThreadInput(foreThread, thisThread, false); }
|
||||||
|
}
|
||||||
}
|
}
|
||||||
'@ -ErrorAction SilentlyContinue
|
'@ -ErrorAction SilentlyContinue
|
||||||
$deadline = (Get-Date).AddSeconds(30)
|
$deadline = (Get-Date).AddSeconds(30)
|
||||||
@@ -950,9 +981,7 @@ public class WinFocusHelper2 {
|
|||||||
return $true
|
return $true
|
||||||
}, [IntPtr]::Zero) | Out-Null
|
}, [IntPtr]::Zero) | Out-Null
|
||||||
if ($script:found -ne [IntPtr]::Zero) {
|
if ($script:found -ne [IntPtr]::Zero) {
|
||||||
[WinFocusHelper2]::ShowWindow($script:found, 9) | Out-Null # SW_RESTORE
|
[WinFocusHelper2]::ForceForeground($script:found)
|
||||||
[WinFocusHelper2]::BringWindowToTop($script:found) | Out-Null
|
|
||||||
[WinFocusHelper2]::SetForegroundWindow($script:found) | Out-Null
|
|
||||||
Start-Sleep -Milliseconds 800
|
Start-Sleep -Milliseconds 800
|
||||||
}
|
}
|
||||||
Start-Sleep -Milliseconds 400
|
Start-Sleep -Milliseconds 400
|
||||||
@@ -1970,8 +1999,49 @@ function Get-AppInstallReportEndpoint {
|
|||||||
return @{ items = $items; count = $items.Count }
|
return @{ items = $items; count = $items.Count }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Intune-Report via asynchronem Export-Job (exportJobs) -> CSV-Zeilen.
|
||||||
|
# Kein 'select' (unbekannte Spalten wuerden 400 ausloesen) — der Aufrufer
|
||||||
|
# greift tolerant auf die tatsaechlich gelieferten Spalten zu.
|
||||||
|
function Get-IntuneReportRows {
|
||||||
|
param(
|
||||||
|
[Parameter(Mandatory=$true)][string]$ReportName,
|
||||||
|
[string]$Filter = '',
|
||||||
|
[int]$TimeoutSec = 120
|
||||||
|
)
|
||||||
|
$jobBody = @{ reportName = $ReportName; filter = $Filter } | ConvertTo-Json -Compress
|
||||||
|
$job = Invoke-MgGraphRequestRetry `
|
||||||
|
-Uri 'https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs' `
|
||||||
|
-Method POST -Body $jobBody -ContentType 'application/json'
|
||||||
|
$jobId = $job.id
|
||||||
|
$status = $job.status
|
||||||
|
$waited = 0
|
||||||
|
while ($status -ne 'completed' -and $status -ne 'failed' -and $waited -lt $TimeoutSec) {
|
||||||
|
Start-Sleep -Seconds 3
|
||||||
|
$waited += 3
|
||||||
|
$job = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/reports/exportJobs/$jobId"
|
||||||
|
$status = $job.status
|
||||||
|
}
|
||||||
|
if ($status -ne 'completed') { throw "Export-Job '$ReportName' nicht abgeschlossen (Status: $status nach $waited s)" }
|
||||||
|
|
||||||
|
$tmpZip = [System.IO.Path]::GetTempFileName() + '.zip'
|
||||||
|
$tmpDir = [System.IO.Path]::Combine([System.IO.Path]::GetTempPath(), "IntuneReport_$jobId")
|
||||||
|
try {
|
||||||
|
Invoke-WebRequest -Uri $job.url -OutFile $tmpZip -UseBasicParsing
|
||||||
|
Add-Type -AssemblyName System.IO.Compression.FileSystem
|
||||||
|
[System.IO.Compression.ZipFile]::ExtractToDirectory($tmpZip, $tmpDir)
|
||||||
|
$csv = Get-ChildItem -Path $tmpDir -Filter '*.csv' | Select-Object -First 1
|
||||||
|
if (-not $csv) { throw "Keine CSV im Export-ZIP gefunden" }
|
||||||
|
return @(Import-Csv -Path $csv.FullName -Encoding UTF8)
|
||||||
|
} finally {
|
||||||
|
Remove-Item -Path $tmpZip -Force -ErrorAction SilentlyContinue
|
||||||
|
Remove-Item -Path $tmpDir -Recurse -Force -ErrorAction SilentlyContinue
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
function Get-AppDeviceStatusEndpoint {
|
function Get-AppDeviceStatusEndpoint {
|
||||||
# Verwendet getDeviceInstallStatusReport (synchron, paginiert) statt deviceStatuses.
|
# Per-Device-Installationsstatus einer App via Export-Job 'DeviceInstallStatusByApp'.
|
||||||
|
# (Der frueher genutzte synchrone Endpoint getDeviceInstallStatusReport existiert
|
||||||
|
# nicht mehr -> 400 "Resource not found for the segment".)
|
||||||
param([hashtable]$Query)
|
param([hashtable]$Query)
|
||||||
$err = Test-Connected
|
$err = Test-Connected
|
||||||
if ($err) { return $err }
|
if ($err) { return $err }
|
||||||
@@ -1981,58 +2051,38 @@ function Get-AppDeviceStatusEndpoint {
|
|||||||
return @{ __status = 400; error = "appId fehlt" }
|
return @{ __status = 400; error = "appId fehlt" }
|
||||||
}
|
}
|
||||||
|
|
||||||
Write-Host "[DEVSTATUS] Lade Install-Status fuer App $appId via Reports-API..." -ForegroundColor DarkCyan
|
Write-Host "[DEVSTATUS] Export-Job (DeviceInstallStatusByApp) fuer App $appId..." -ForegroundColor DarkCyan
|
||||||
$pageSize = 50
|
try {
|
||||||
$skip = 0
|
$rows = @(Get-IntuneReportRows -ReportName 'DeviceInstallStatusByApp' -Filter "(ApplicationId eq '$appId')")
|
||||||
$allRows = @()
|
} catch {
|
||||||
$cols = $null
|
$msg = $_.Exception.Message
|
||||||
|
try { if ($_.ErrorDetails.Message) { $msg = $_.ErrorDetails.Message } } catch {}
|
||||||
do {
|
return @{ __status = 500; error = "Graph-Fehler: $msg" }
|
||||||
$bodyJson = "{""filter"":""(ApplicationId eq '$appId')"",""select"":[],""skip"":$skip,""top"":$pageSize,""orderBy"":[]}"
|
|
||||||
try {
|
|
||||||
$resp = Invoke-MgGraphRequestRetry `
|
|
||||||
-Uri 'https://graph.microsoft.com/beta/deviceManagement/reports/getDeviceInstallStatusReport' `
|
|
||||||
-Method POST -Body $bodyJson -ContentType 'application/json'
|
|
||||||
} catch {
|
|
||||||
return @{ __status = 500; error = "Graph-Fehler: $($_.Exception.Message)" }
|
|
||||||
}
|
|
||||||
|
|
||||||
if (-not $cols) {
|
|
||||||
$cols = @($resp.Schema | ForEach-Object { $_.Column })
|
|
||||||
Write-Host " [DEVSTATUS] Spalten: $($cols -join ',')" -ForegroundColor DarkGray
|
|
||||||
}
|
|
||||||
$rows = @($resp.Values)
|
|
||||||
$allRows += $rows
|
|
||||||
$skip += $pageSize
|
|
||||||
} while ($rows.Count -eq $pageSize)
|
|
||||||
|
|
||||||
Write-Host " -> $($allRows.Count) Eintraege" -ForegroundColor DarkGray
|
|
||||||
|
|
||||||
if (-not $cols -or $allRows.Count -eq 0) {
|
|
||||||
return @{ items = @(); count = 0 }
|
|
||||||
}
|
}
|
||||||
|
Write-Host " -> $($rows.Count) Eintraege" -ForegroundColor DarkGray
|
||||||
|
if ($rows.Count -eq 0) { return @{ items = @(); count = 0 } }
|
||||||
|
|
||||||
function ColIdx($name) { [Array]::IndexOf($cols, $name) }
|
Write-Host " [DEVSTATUS] Spalten: $(($rows[0].PSObject.Properties.Name) -join ',')" -ForegroundColor DarkGray
|
||||||
$iDevice = ColIdx 'DeviceName'
|
|
||||||
$iUser = ColIdx 'UserName'
|
|
||||||
$iState = ColIdx 'InstallState'
|
|
||||||
$iDetail = ColIdx 'InstallStateDetail'
|
|
||||||
$iErr = ColIdx 'ErrorCode'
|
|
||||||
$iOs = ColIdx 'OSVersion'
|
|
||||||
$iSync = ColIdx 'LastModifiedDateTime'
|
|
||||||
if ($iOs -lt 0) { $iOs = ColIdx 'OsVersion' }
|
|
||||||
if ($iSync -lt 0) { $iSync = ColIdx 'LastSyncDateTime' }
|
|
||||||
|
|
||||||
$result = @($allRows | ForEach-Object {
|
# Spaltennamen des Reports koennen variieren -> tolerant mit Fallbacks lesen.
|
||||||
|
$col = {
|
||||||
|
param($row, [string[]]$names)
|
||||||
|
foreach ($n in $names) {
|
||||||
|
$p = $row.PSObject.Properties[$n]
|
||||||
|
if ($p -and $null -ne $p.Value -and [string]$p.Value -ne '') { return [string]$p.Value }
|
||||||
|
}
|
||||||
|
return ''
|
||||||
|
}
|
||||||
|
$result = @($rows | ForEach-Object {
|
||||||
$r = $_
|
$r = $_
|
||||||
[pscustomobject]@{
|
[pscustomobject]@{
|
||||||
DeviceName = if ($iDevice -ge 0) { [string]$r[$iDevice] } else { '' }
|
DeviceName = & $col $r @('DeviceName')
|
||||||
UserName = if ($iUser -ge 0) { [string]$r[$iUser] } else { '' }
|
UserName = & $col $r @('UserName','UserPrincipalName')
|
||||||
InstallState = if ($iState -ge 0) { [string]$r[$iState] } else { '' }
|
InstallState = & $col $r @('InstallState_loc','InstallState','AppInstallState_loc','AppInstallState')
|
||||||
InstallStateDetail = if ($iDetail -ge 0) { [string]$r[$iDetail] } else { '' }
|
InstallStateDetail = & $col $r @('InstallStateDetail_loc','InstallStateDetail','AppInstallStateDetail_loc','AppInstallStateDetail')
|
||||||
ErrorCode = if ($iErr -ge 0) { [string]$r[$iErr] } else { '' }
|
ErrorCode = & $col $r @('ErrorCode','HexErrorCode')
|
||||||
OsVersion = if ($iOs -ge 0) { [string]$r[$iOs] } else { '' }
|
OsVersion = & $col $r @('OSVersion','OsVersion','Platform')
|
||||||
LastSyncDateTime = if ($iSync -ge 0) { [string]$r[$iSync] } else { '' }
|
LastSyncDateTime = & $col $r @('LastModifiedDateTime','LastSyncDateTime')
|
||||||
}
|
}
|
||||||
})
|
})
|
||||||
|
|
||||||
@@ -2597,6 +2647,53 @@ function Invoke-FilePickerEndpoint {
|
|||||||
return @{ ok = $true; path = $path }
|
return @{ ok = $true; path = $path }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function Show-OpenFolderDialog {
|
||||||
|
# Wie Show-OpenFileDialog, aber FolderBrowserDialog in einem STA-Prozess.
|
||||||
|
param([string]$Title = "Ordner auswaehlen")
|
||||||
|
$tEsc = $Title -replace "'", "''"
|
||||||
|
$inner = @"
|
||||||
|
`$ProgressPreference = 'SilentlyContinue'
|
||||||
|
Add-Type -AssemblyName System.Windows.Forms
|
||||||
|
`$dlg = New-Object System.Windows.Forms.FolderBrowserDialog
|
||||||
|
`$dlg.Description = '$tEsc'
|
||||||
|
`$owner = New-Object System.Windows.Forms.Form
|
||||||
|
`$owner.TopMost = `$true
|
||||||
|
`$owner.ShowInTaskbar = `$false
|
||||||
|
`$owner.WindowState = 'Minimized'
|
||||||
|
`$owner.Show(); `$owner.Activate()
|
||||||
|
`$r = `$dlg.ShowDialog(`$owner)
|
||||||
|
`$owner.Dispose()
|
||||||
|
if (`$r -eq [System.Windows.Forms.DialogResult]::OK) { [Console]::Out.Write(`$dlg.SelectedPath) }
|
||||||
|
"@
|
||||||
|
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($inner))
|
||||||
|
$psi = New-Object System.Diagnostics.ProcessStartInfo
|
||||||
|
$psi.FileName = "powershell.exe"
|
||||||
|
$psi.Arguments = "-NoProfile -STA -ExecutionPolicy Bypass -EncodedCommand $encoded"
|
||||||
|
$psi.UseShellExecute = $false
|
||||||
|
$psi.RedirectStandardOutput = $true
|
||||||
|
$psi.CreateNoWindow = $true
|
||||||
|
try {
|
||||||
|
$proc = [System.Diagnostics.Process]::Start($psi)
|
||||||
|
$path = $proc.StandardOutput.ReadToEnd()
|
||||||
|
$proc.WaitForExit()
|
||||||
|
} catch {
|
||||||
|
throw "Ordner-Dialog-Prozess konnte nicht gestartet werden: $($_.Exception.Message)"
|
||||||
|
}
|
||||||
|
return ([string]$path).Trim()
|
||||||
|
}
|
||||||
|
|
||||||
|
function Invoke-FolderPickerEndpoint {
|
||||||
|
param($Body)
|
||||||
|
$title = if ($Body -and $Body.title) { [string]$Body.title } else { "Git-Repo-Ordner auswaehlen" }
|
||||||
|
try {
|
||||||
|
$path = Show-OpenFolderDialog -Title $title
|
||||||
|
} catch {
|
||||||
|
return @{ __status = 500; error = "Ordner-Dialog fehlgeschlagen: $($_.Exception.Message)" }
|
||||||
|
}
|
||||||
|
if (-not $path) { return @{ ok = $true; cancelled = $true } }
|
||||||
|
return @{ ok = $true; path = $path }
|
||||||
|
}
|
||||||
|
|
||||||
# App-Typ (@odata.type) -> unterstuetzter Content-Update-Pfad + erlaubte Endung.
|
# App-Typ (@odata.type) -> unterstuetzter Content-Update-Pfad + erlaubte Endung.
|
||||||
# Phase 1: nur win32LobApp/.intunewin aktiv; MSI/MSIX kommen in Phase 2/3.
|
# Phase 1: nur win32LobApp/.intunewin aktiv; MSI/MSIX kommen in Phase 2/3.
|
||||||
function Get-AppContentTypeMap {
|
function Get-AppContentTypeMap {
|
||||||
|
|||||||
@@ -74,6 +74,13 @@ function Get-DefaultSettings {
|
|||||||
# Explizite Liste der RPA-Gruppen. Leer = RPA-Tab zeigt Hinweis.
|
# Explizite Liste der RPA-Gruppen. Leer = RPA-Tab zeigt Hinweis.
|
||||||
groupNames = @()
|
groupNames = @()
|
||||||
}
|
}
|
||||||
|
policyBackup = [pscustomobject]@{
|
||||||
|
# Lokaler Git-Repo-Ordner fuer Policy-Snapshots. Leer = Funktion aus.
|
||||||
|
gitRepoPath = ""
|
||||||
|
# Nach dem Commit automatisch 'git push' ausfuehren (nutzt den
|
||||||
|
# vorhandenen Git-Credential-Helper; kein Token in der App).
|
||||||
|
push = $false
|
||||||
|
}
|
||||||
userSearch = [pscustomobject]@{
|
userSearch = [pscustomobject]@{
|
||||||
# In welchen Feldern bei der Benutzersuche gesucht wird.
|
# In welchen Feldern bei der Benutzersuche gesucht wird.
|
||||||
# Erlaubt: displayName, userPrincipalName, mail, department.
|
# Erlaubt: displayName, userPrincipalName, mail, department.
|
||||||
|
|||||||
@@ -0,0 +1,238 @@
|
|||||||
|
# Geraete-Offboarding: ein Geraet ueber Intune, Autopilot und Entra ID hinweg
|
||||||
|
# entfernen (Decommissioning). Vor dem Loeschen koennen BitLocker-/FileVault-Keys
|
||||||
|
# und LAPS-Passwoerter ausgelesen werden, damit sie nicht verloren gehen.
|
||||||
|
#
|
||||||
|
# Portiert aus dem "Device Offboarding Manager" (Ugur Koc, MIT-Lizenz) — dort
|
||||||
|
# WPF, hier als Web-Endpoints in den Intune Manager integriert.
|
||||||
|
#
|
||||||
|
# Loeschen ist destruktiv -> im Read-Only-Modus gesperrt, harte Bestaetigung im UI.
|
||||||
|
|
||||||
|
# Generischer Microsoft-Graph-$batch-Helper. Nimmt Sub-Requests
|
||||||
|
# ( @{ id; method; url; body?; headers? } ) und liefert eine Map id -> Response.
|
||||||
|
function Invoke-GraphBatch {
|
||||||
|
param([Parameter(Mandatory=$true)][object[]]$Requests)
|
||||||
|
$map = @{}
|
||||||
|
for ($i = 0; $i -lt $Requests.Count; $i += 20) {
|
||||||
|
$chunk = $Requests[$i .. [Math]::Min($i + 19, $Requests.Count - 1)]
|
||||||
|
$body = @{ requests = @($chunk) } | ConvertTo-Json -Depth 10 -Compress
|
||||||
|
$resp = Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/$batch' -Method POST -Body $body -ContentType 'application/json'
|
||||||
|
foreach ($r in @($resp.responses)) { $map[[string]$r.id] = $r }
|
||||||
|
}
|
||||||
|
return $map
|
||||||
|
}
|
||||||
|
|
||||||
|
# Graph-Fehlermeldung aus einer Exception ziehen (Body statt generischer Text).
|
||||||
|
function Get-OffboardGraphErr {
|
||||||
|
param($ErrorRecord)
|
||||||
|
$m = $ErrorRecord.Exception.Message
|
||||||
|
try { if ($ErrorRecord.ErrorDetails.Message) { $m = $ErrorRecord.ErrorDetails.Message } } catch {}
|
||||||
|
return $m
|
||||||
|
}
|
||||||
|
|
||||||
|
# Geraete suchen und ueber die drei Dienste hinweg aufloesen.
|
||||||
|
# Query: query=<text>, type=name|serial
|
||||||
|
function Search-OffboardDevicesEndpoint {
|
||||||
|
param([hashtable]$Query)
|
||||||
|
$err = Test-Connected
|
||||||
|
if ($err) { return $err }
|
||||||
|
|
||||||
|
$q = [string]$Query['query']
|
||||||
|
$type = [string]$Query['type']
|
||||||
|
if ([string]::IsNullOrWhiteSpace($q)) { return @{ __status = 400; error = 'Suchbegriff fehlt' } }
|
||||||
|
$qEsc = $q -replace "'", "''"
|
||||||
|
|
||||||
|
# managedDevices unterstuetzt startswith(deviceName) bzw. serialNumber eq.
|
||||||
|
$filter = if ($type -eq 'serial') { "serialNumber eq '$qEsc'" } else { "startswith(deviceName,'$qEsc')" }
|
||||||
|
$sel = 'id,deviceName,serialNumber,operatingSystem,osVersion,userPrincipalName,lastSyncDateTime,azureADDeviceId,managedDeviceOwnerType,managementAgent'
|
||||||
|
$uri = "https://graph.microsoft.com/beta/deviceManagement/managedDevices?`$filter=$([Uri]::EscapeDataString($filter))&`$select=$sel&`$top=50&`$orderby=deviceName"
|
||||||
|
try {
|
||||||
|
$intune = @(Get-GraphPaged -Uri $uri)
|
||||||
|
} catch {
|
||||||
|
$m = Get-OffboardGraphErr $_
|
||||||
|
if ($m -match '403|Forbidden') {
|
||||||
|
return @{ __status = 403; error = 'Keine Berechtigung fuer die Geraete-Suche. Scope "DeviceManagementManagedDevices.Read.All" muss in den Read/Write-Scopes stehen UND per Admin-Consent zugestimmt sein (siehe docs/App-Registration.md). Nach dem Ergaenzen: ab- und neu anmelden.' }
|
||||||
|
}
|
||||||
|
return @{ __status = 500; error = "Graph-Fehler bei der Suche: $m" }
|
||||||
|
}
|
||||||
|
if ($intune.Count -eq 0) { return @{ items = @(); count = 0 } }
|
||||||
|
|
||||||
|
# Entra-Objekt (fuer Delete) + Autopilot-Identity (fuer Delete) per Batch nachladen.
|
||||||
|
$reqs = @()
|
||||||
|
$idx = 0
|
||||||
|
foreach ($d in $intune) {
|
||||||
|
$aad = [string]$d.azureADDeviceId
|
||||||
|
$ser = [string]$d.serialNumber
|
||||||
|
if ($aad -and $aad -ne '00000000-0000-0000-0000-000000000000') {
|
||||||
|
$f = [Uri]::EscapeDataString("deviceId eq '$aad'")
|
||||||
|
$reqs += @{ id = "e$idx"; method = 'GET'; url = "/devices?`$filter=$f&`$select=id,deviceId,displayName,accountEnabled&`$top=1" }
|
||||||
|
}
|
||||||
|
if ($ser) {
|
||||||
|
$sf = [Uri]::EscapeDataString("contains(serialNumber,'$($ser -replace "'","''")')")
|
||||||
|
$reqs += @{ id = "a$idx"; method = 'GET'; url = "/deviceManagement/windowsAutopilotDeviceIdentities?`$filter=$sf&`$top=1" }
|
||||||
|
}
|
||||||
|
$idx++
|
||||||
|
}
|
||||||
|
$batch = if ($reqs.Count -gt 0) { Invoke-GraphBatch -Requests $reqs } else { @{} }
|
||||||
|
|
||||||
|
$items = @()
|
||||||
|
$idx = 0
|
||||||
|
foreach ($d in $intune) {
|
||||||
|
$entra = $null; $autop = $null
|
||||||
|
$er = $batch["e$idx"]; if ($er -and [int]$er.status -eq 200) { $entra = @($er.body.value)[0] }
|
||||||
|
$ar = $batch["a$idx"]; if ($ar -and [int]$ar.status -eq 200) { $autop = @($ar.body.value)[0] }
|
||||||
|
$items += [pscustomobject]@{
|
||||||
|
deviceName = [string]$d.deviceName
|
||||||
|
serialNumber = [string]$d.serialNumber
|
||||||
|
operatingSystem = [string]$d.operatingSystem
|
||||||
|
osVersion = [string]$d.osVersion
|
||||||
|
primaryUser = [string]$d.userPrincipalName
|
||||||
|
lastSync = $d.lastSyncDateTime
|
||||||
|
ownership = [string]$d.managedDeviceOwnerType
|
||||||
|
coManaged = ([string]$d.managementAgent -match 'configurationManager')
|
||||||
|
intuneDeviceId = [string]$d.id
|
||||||
|
azureADDeviceId = [string]$d.azureADDeviceId
|
||||||
|
entraObjectId = if ($entra) { [string]$entra.id } else { '' }
|
||||||
|
entraEnabled = if ($entra) { [bool]$entra.accountEnabled } else { $null }
|
||||||
|
autopilotId = if ($autop) { [string]$autop.id } else { '' }
|
||||||
|
inIntune = $true
|
||||||
|
inEntra = [bool]$entra
|
||||||
|
inAutopilot = [bool]$autop
|
||||||
|
}
|
||||||
|
$idx++
|
||||||
|
}
|
||||||
|
return @{ items = @($items); count = $items.Count }
|
||||||
|
}
|
||||||
|
|
||||||
|
# Recovery-Keys eines Geraets holen (vor dem Loeschen). Body:
|
||||||
|
# { intuneDeviceId, azureADDeviceId, operatingSystem }
|
||||||
|
function Get-OffboardKeysEndpoint {
|
||||||
|
param($Body)
|
||||||
|
$err = Test-Connected
|
||||||
|
if ($err) { return $err }
|
||||||
|
|
||||||
|
$intuneId = [string](Get-PolicyProp $Body 'intuneDeviceId')
|
||||||
|
$aad = [string](Get-PolicyProp $Body 'azureADDeviceId')
|
||||||
|
$os = [string](Get-PolicyProp $Body 'operatingSystem')
|
||||||
|
|
||||||
|
$bitlocker = @()
|
||||||
|
$fileVault = $null
|
||||||
|
$laps = $null
|
||||||
|
$notes = @()
|
||||||
|
|
||||||
|
if ($os -eq 'Windows' -and $aad) {
|
||||||
|
try {
|
||||||
|
$keyIds = @(Get-GraphPaged -Uri "https://graph.microsoft.com/beta/informationProtection/bitlocker/recoveryKeys?`$filter=deviceId eq '$aad'")
|
||||||
|
foreach ($k in $keyIds) {
|
||||||
|
try {
|
||||||
|
$kd = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/informationProtection/bitlocker/recoveryKeys/$($k.id)?`$select=key,volumeType" -Method GET
|
||||||
|
if ($kd.key) { $bitlocker += @{ volumeType = [string]$kd.volumeType; key = [string]$kd.key } }
|
||||||
|
} catch {}
|
||||||
|
}
|
||||||
|
if ($bitlocker.Count -eq 0) { $notes += 'Kein BitLocker-Key gefunden.' }
|
||||||
|
} catch {
|
||||||
|
$m = Get-OffboardGraphErr $_
|
||||||
|
$notes += if ($m -match '403') { 'BitLocker: Zugriff verweigert (BitlockerKey.Read.All noetig).' } else { "BitLocker: $m" }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
elseif ($os -eq 'macOS' -and $intuneId) {
|
||||||
|
try {
|
||||||
|
$fv = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/managedDevices('$intuneId')/getFileVaultKey" -Method GET
|
||||||
|
if ($fv.value) { $fileVault = [string]$fv.value } else { $notes += 'Kein FileVault-Key gefunden.' }
|
||||||
|
} catch { $notes += "FileVault: $(Get-OffboardGraphErr $_)" }
|
||||||
|
}
|
||||||
|
|
||||||
|
# LAPS (jede Plattform, ueber die Entra-Device-Id).
|
||||||
|
if ($aad) {
|
||||||
|
try {
|
||||||
|
$resp = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/directory/deviceLocalCredentials/$aad`?`$select=credentials" -Method GET
|
||||||
|
$creds = @($resp.credentials)
|
||||||
|
if ($creds.Count -gt 0) {
|
||||||
|
$latest = $creds | Sort-Object -Property backupDateTime -Descending | Select-Object -First 1
|
||||||
|
$pw = [System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String([string]$latest.passwordBase64))
|
||||||
|
$laps = @{ account = [string]$latest.accountName; password = $pw }
|
||||||
|
}
|
||||||
|
} catch {
|
||||||
|
$m = Get-OffboardGraphErr $_
|
||||||
|
if ($m -notmatch '404') { $notes += "LAPS: $m" }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
return @{ ok = $true; keys = @{ bitlocker = @($bitlocker); fileVault = $fileVault; laps = $laps; notes = @($notes) } }
|
||||||
|
}
|
||||||
|
|
||||||
|
# Offboarding ausfuehren. Body:
|
||||||
|
# devices = [ { deviceName, intuneDeviceId, entraObjectId, autopilotId } ]
|
||||||
|
# services = { entra: 'delete'|'disable'|'none', intune: bool, autopilot: bool }
|
||||||
|
function Invoke-OffboardExecuteEndpoint {
|
||||||
|
param($Body)
|
||||||
|
$err = Test-Connected
|
||||||
|
if ($err) { return $err }
|
||||||
|
if ($script:State.ReadOnly) { return @{ __status = 403; error = 'Read-Only-Modus: Offboarding ist deaktiviert.' } }
|
||||||
|
|
||||||
|
$devices = @(Get-PolicyProp $Body 'devices') | Where-Object { $_ }
|
||||||
|
$svc = Get-PolicyProp $Body 'services'
|
||||||
|
if (@($devices).Count -eq 0) { return @{ __status = 400; error = 'Keine Geraete uebergeben' } }
|
||||||
|
|
||||||
|
$entraAction = [string](Get-PolicyProp $svc 'entra')
|
||||||
|
$doIntune = [bool](Get-PolicyProp $svc 'intune')
|
||||||
|
$doAutopilot = [bool](Get-PolicyProp $svc 'autopilot')
|
||||||
|
|
||||||
|
$reqs = @()
|
||||||
|
$meta = @{}
|
||||||
|
$n = 0
|
||||||
|
foreach ($d in $devices) {
|
||||||
|
$name = [string](Get-PolicyProp $d 'deviceName')
|
||||||
|
$iid = [string](Get-PolicyProp $d 'intuneDeviceId')
|
||||||
|
$eid = [string](Get-PolicyProp $d 'entraObjectId')
|
||||||
|
$aid = [string](Get-PolicyProp $d 'autopilotId')
|
||||||
|
|
||||||
|
if ($entraAction -eq 'delete' -and $eid) {
|
||||||
|
$rid = "r$n"; $reqs += @{ id = $rid; method = 'DELETE'; url = "/devices/$eid" }
|
||||||
|
$meta[$rid] = @{ name = $name; svc = 'Entra ID'; action = 'geloescht' }; $n++
|
||||||
|
} elseif ($entraAction -eq 'disable' -and $eid) {
|
||||||
|
$rid = "r$n"; $reqs += @{ id = $rid; method = 'PATCH'; url = "/devices/$eid"; body = @{ accountEnabled = $false }; headers = @{ 'Content-Type' = 'application/json' } }
|
||||||
|
$meta[$rid] = @{ name = $name; svc = 'Entra ID'; action = 'deaktiviert' }; $n++
|
||||||
|
}
|
||||||
|
if ($doIntune -and $iid) {
|
||||||
|
$rid = "r$n"; $reqs += @{ id = $rid; method = 'DELETE'; url = "/deviceManagement/managedDevices/$iid" }
|
||||||
|
$meta[$rid] = @{ name = $name; svc = 'Intune'; action = 'geloescht' }; $n++
|
||||||
|
}
|
||||||
|
if ($doAutopilot -and $aid) {
|
||||||
|
$rid = "r$n"; $reqs += @{ id = $rid; method = 'DELETE'; url = "/deviceManagement/windowsAutopilotDeviceIdentities/$aid" }
|
||||||
|
$meta[$rid] = @{ name = $name; svc = 'Autopilot'; action = 'geloescht' }; $n++
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if ($reqs.Count -eq 0) { return @{ __status = 400; error = 'Keine ausfuehrbaren Aktionen (fehlende IDs oder nichts ausgewaehlt).' } }
|
||||||
|
|
||||||
|
Write-Host "[OFFBOARD] Fuehre $($reqs.Count) Aktion(en) fuer $(@($devices).Count) Geraet(e) aus..." -ForegroundColor Yellow
|
||||||
|
$batch = Invoke-GraphBatch -Requests $reqs
|
||||||
|
|
||||||
|
$results = @()
|
||||||
|
foreach ($rid in ($meta.Keys | Sort-Object { [int]($_ -replace '\D','') })) {
|
||||||
|
$m = $meta[$rid]
|
||||||
|
$r = $batch[$rid]
|
||||||
|
$status = if ($r) { [int]$r.status } else { 0 }
|
||||||
|
$ok = $status -in @(200, 204)
|
||||||
|
$errMsg = ''
|
||||||
|
if (-not $ok) {
|
||||||
|
$code = ''
|
||||||
|
try { $code = [string]$r.body.error.code } catch {}
|
||||||
|
if ($status -eq 403 -and $code -match 'multipleAdminApproval|protectedOperation') {
|
||||||
|
$errMsg = 'Erfordert Multi-Admin-Approval'
|
||||||
|
} elseif ($status -eq 403) {
|
||||||
|
$errMsg = "403 - fehlende Rolle/Berechtigung fuer $($m.svc)"
|
||||||
|
} elseif ($status -eq 0) {
|
||||||
|
$errMsg = 'Keine Antwort'
|
||||||
|
} else {
|
||||||
|
$errMsg = "HTTP $status" + $(if ($code) { " ($code)" } else { '' })
|
||||||
|
}
|
||||||
|
}
|
||||||
|
$results += [pscustomobject]@{
|
||||||
|
deviceName = $m.name; service = $m.svc; action = $m.action
|
||||||
|
success = $ok; error = $errMsg
|
||||||
|
}
|
||||||
|
}
|
||||||
|
$okCount = @($results | Where-Object { $_.success }).Count
|
||||||
|
Write-Host " -> $okCount/$($results.Count) erfolgreich" -ForegroundColor DarkGray
|
||||||
|
return @{ ok = $true; successCount = $okCount; total = $results.Count; results = @($results) }
|
||||||
|
}
|
||||||
+383
-13
@@ -1,7 +1,7 @@
|
|||||||
# Import/Export von Intune-Policies.
|
# Import/Export von Intune-Policies.
|
||||||
# Unterstuetzte Typen: Compliance Policies, Configuration Profiles (Templates)
|
# Unterstuetzte Typen: Compliance Policies, Configuration Profiles (Templates),
|
||||||
# und Settings Catalog. Nutzt die bestehende Microsoft-Graph-Verbindung
|
# Settings Catalog und Administrative Vorlagen (ADMX / groupPolicyConfigurations).
|
||||||
# (Connect-MgGraph via Api.ps1).
|
# Nutzt die bestehende Microsoft-Graph-Verbindung (Connect-MgGraph via Api.ps1).
|
||||||
#
|
#
|
||||||
# Zwei Export-Wege, beide aus derselben Aktion:
|
# Zwei Export-Wege, beide aus derselben Aktion:
|
||||||
# 1. Browser-Download — der Endpoint liefert die Export-Objekte im Response,
|
# 1. Browser-Download — der Endpoint liefert die Export-Objekte im Response,
|
||||||
@@ -73,6 +73,20 @@ function Get-PolicyTypeConfig {
|
|||||||
Label = 'Settings Catalog'
|
Label = 'Settings Catalog'
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
'administrativetemplate' {
|
||||||
|
return @{
|
||||||
|
Key = 'administrativetemplate'
|
||||||
|
Collection = 'groupPolicyConfigurations'
|
||||||
|
NameField = 'displayName'
|
||||||
|
# Sonderfall: die konfigurierten Werte liegen nicht inline in der
|
||||||
|
# Policy, sondern in der definitionValues-Subcollection. Deshalb
|
||||||
|
# kein simples $expand -> eigene Behandlung in Get-GraphPolicyDetail.
|
||||||
|
ExportExpand = $null
|
||||||
|
ExportType = 'AdministrativeTemplate'
|
||||||
|
FilePrefix = 'AdminTemplate'
|
||||||
|
Label = 'Administrative Vorlage'
|
||||||
|
}
|
||||||
|
}
|
||||||
default { return $null }
|
default { return $null }
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -80,7 +94,7 @@ function Get-PolicyTypeConfig {
|
|||||||
# ExportType (aus Datei/Envelope) -> Typ-Config. Reverse-Lookup fuer den Import.
|
# ExportType (aus Datei/Envelope) -> Typ-Config. Reverse-Lookup fuer den Import.
|
||||||
function Get-PolicyTypeConfigByExportType {
|
function Get-PolicyTypeConfigByExportType {
|
||||||
param([string]$ExportType)
|
param([string]$ExportType)
|
||||||
foreach ($key in @('compliance','configuration','settingscatalog')) {
|
foreach ($key in @('compliance','configuration','settingscatalog','administrativetemplate')) {
|
||||||
$cfg = Get-PolicyTypeConfig $key
|
$cfg = Get-PolicyTypeConfig $key
|
||||||
if ($cfg.ExportType -eq $ExportType) { return $cfg }
|
if ($cfg.ExportType -eq $ExportType) { return $cfg }
|
||||||
}
|
}
|
||||||
@@ -105,6 +119,15 @@ function Get-PolicyProp {
|
|||||||
return $null
|
return $null
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Property setzen — Hashtable ODER PSCustomObject (fuer Import-Umbenennung).
|
||||||
|
function Set-PolicyProp {
|
||||||
|
param($Obj, [string]$Name, $Value)
|
||||||
|
if ($null -eq $Obj) { return }
|
||||||
|
if ($Obj -is [System.Collections.IDictionary]) { $Obj[$Name] = $Value; return }
|
||||||
|
if ($Obj.PSObject.Properties[$Name]) { $Obj.$Name = $Value }
|
||||||
|
else { $Obj | Add-Member -NotePropertyName $Name -NotePropertyValue $Value -Force }
|
||||||
|
}
|
||||||
|
|
||||||
# Grobe Plattform-Bezeichnung fuer die Listenanzeige.
|
# Grobe Plattform-Bezeichnung fuer die Listenanzeige.
|
||||||
function Get-PolicyPlatformLabel {
|
function Get-PolicyPlatformLabel {
|
||||||
param($Raw, [string]$Type)
|
param($Raw, [string]$Type)
|
||||||
@@ -112,6 +135,8 @@ function Get-PolicyPlatformLabel {
|
|||||||
$p = Get-PolicyProp $Raw 'platforms'
|
$p = Get-PolicyProp $Raw 'platforms'
|
||||||
return [string]$p
|
return [string]$p
|
||||||
}
|
}
|
||||||
|
# Administrative Vorlagen (groupPolicyConfigurations) sind reine Windows-Policies.
|
||||||
|
if (([string]$Type).ToLower() -eq 'administrativetemplate') { return 'Windows' }
|
||||||
$t = [string](Get-PolicyProp $Raw '@odata.type')
|
$t = [string](Get-PolicyProp $Raw '@odata.type')
|
||||||
switch -Regex ($t) {
|
switch -Regex ($t) {
|
||||||
'windows' { return 'Windows' }
|
'windows' { return 'Windows' }
|
||||||
@@ -158,6 +183,18 @@ function Get-GraphPolicyDetail {
|
|||||||
)
|
)
|
||||||
$cfg = Get-PolicyTypeConfig $Type
|
$cfg = Get-PolicyTypeConfig $Type
|
||||||
if (-not $cfg) { throw "Unbekannter Policy-Typ: $Type" }
|
if (-not $cfg) { throw "Unbekannter Policy-Typ: $Type" }
|
||||||
|
|
||||||
|
# Administrative Vorlagen: Basis-Objekt holen und die konfigurierten Werte
|
||||||
|
# (definitionValues inkl. Definition + Presentation-Werten) separat expandieren.
|
||||||
|
if ($cfg.Key -eq 'administrativetemplate') {
|
||||||
|
$base = Invoke-MgGraphRequestRetry -Uri "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id" -Method GET
|
||||||
|
$dvUri = "https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations/$Id/definitionValues?`$expand=definition(`$select=id,classType,displayName,policyType,version),presentationValues(`$expand=presentation)"
|
||||||
|
$dvs = @(Get-GraphPaged -Uri $dvUri)
|
||||||
|
if ($base -is [System.Collections.IDictionary]) { $base['definitionValues'] = $dvs }
|
||||||
|
else { $base | Add-Member -NotePropertyName definitionValues -NotePropertyValue $dvs -Force }
|
||||||
|
return $base
|
||||||
|
}
|
||||||
|
|
||||||
$uri = "https://graph.microsoft.com/beta/deviceManagement/$($cfg.Collection)/$Id"
|
$uri = "https://graph.microsoft.com/beta/deviceManagement/$($cfg.Collection)/$Id"
|
||||||
if ($cfg.ExportExpand) { $uri += "?`$expand=$($cfg.ExportExpand)" }
|
if ($cfg.ExportExpand) { $uri += "?`$expand=$($cfg.ExportExpand)" }
|
||||||
return Invoke-MgGraphRequestRetry -Uri $uri -Method GET
|
return Invoke-MgGraphRequestRetry -Uri $uri -Method GET
|
||||||
@@ -183,6 +220,53 @@ function ConvertTo-ImportBody {
|
|||||||
return $body
|
return $body
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Settings-Catalog-Payloads haben verschachtelte Properties, die laut Graph-
|
||||||
|
# Schema Arrays sein MUESSEN (settings, children, *SettingCollectionValue, values).
|
||||||
|
# Ein JSON-Roundtrip unter Windows PowerShell 5.1 entpackt Ein-Element-Arrays zu
|
||||||
|
# Einzelobjekten -> Graph antwortet mit 400 "... does not match schema". Diese
|
||||||
|
# Funktion baut den Baum rekursiv neu auf und packt betroffene Felder wieder in
|
||||||
|
# Arrays. Idempotent: bereits korrekte Arrays bleiben unveraendert.
|
||||||
|
function Repair-SettingsCatalogArrays {
|
||||||
|
param($Node)
|
||||||
|
$arrayKeys = @('settings','children','groupSettingCollectionValue','simpleSettingCollectionValue','values')
|
||||||
|
|
||||||
|
# Array-Property normalisieren: $null -> @() (Graph-Schema: Collections sind
|
||||||
|
# Nullable=False, ein 'children': null wird abgelehnt), Einzelobjekt -> @(obj).
|
||||||
|
# Inline (nicht als Funktion), sonst entpackt der Return ein Ein-Element-Array.
|
||||||
|
if ($Node -is [System.Collections.IDictionary]) {
|
||||||
|
$out = [ordered]@{}
|
||||||
|
foreach ($k in @($Node.Keys)) {
|
||||||
|
$fixed = Repair-SettingsCatalogArrays $Node[$k]
|
||||||
|
if ($k -in $arrayKeys) {
|
||||||
|
if ($null -eq $fixed) { $fixed = @() }
|
||||||
|
elseif (-not ($fixed -is [System.Collections.IList])) { $fixed = @($fixed) }
|
||||||
|
}
|
||||||
|
$out[$k] = $fixed
|
||||||
|
}
|
||||||
|
return $out
|
||||||
|
}
|
||||||
|
if ($Node -is [System.Management.Automation.PSCustomObject]) {
|
||||||
|
$out = [ordered]@{}
|
||||||
|
foreach ($p in $Node.PSObject.Properties) {
|
||||||
|
$fixed = Repair-SettingsCatalogArrays $p.Value
|
||||||
|
if ($p.Name -in $arrayKeys) {
|
||||||
|
if ($null -eq $fixed) { $fixed = @() }
|
||||||
|
elseif (-not ($fixed -is [System.Collections.IList])) { $fixed = @($fixed) }
|
||||||
|
}
|
||||||
|
$out[$p.Name] = $fixed
|
||||||
|
}
|
||||||
|
return $out
|
||||||
|
}
|
||||||
|
if (($Node -is [System.Collections.IEnumerable]) -and -not ($Node -is [string])) {
|
||||||
|
# Kein Komma-Operator: ein Ein-Element-Array wird beim Return zwar zum
|
||||||
|
# Skalar entpackt, aber jede Array-Property wird vom Parent ohnehin wieder
|
||||||
|
# in @(...) gewrappt. Ein fuehrendes ',' wuerde das Top-Level-settings-
|
||||||
|
# Array faelschlich in ein Extra-Array verschachteln.
|
||||||
|
return @($Node | ForEach-Object { Repair-SettingsCatalogArrays $_ })
|
||||||
|
}
|
||||||
|
return $Node
|
||||||
|
}
|
||||||
|
|
||||||
function New-DefaultComplianceScheduledActions {
|
function New-DefaultComplianceScheduledActions {
|
||||||
# Compliance Policies verlangen beim Anlegen mindestens einen
|
# Compliance Policies verlangen beim Anlegen mindestens einen
|
||||||
# scheduledActionsForRule-Block, sonst antwortet Graph mit 400.
|
# scheduledActionsForRule-Block, sonst antwortet Graph mit 400.
|
||||||
@@ -247,18 +331,106 @@ function Import-GraphSettingsCatalogPolicy {
|
|||||||
throw 'Settings-Catalog-Policy benoetigt ein "name"-Feld fuer den Import.'
|
throw 'Settings-Catalog-Policy benoetigt ein "name"-Feld fuer den Import.'
|
||||||
}
|
}
|
||||||
# 'settings' MUSS mitgeschickt werden — kommt aus dem $expand=settings-Export.
|
# 'settings' MUSS mitgeschickt werden — kommt aus dem $expand=settings-Export.
|
||||||
if (-not $body.ContainsKey('settings')) { $body['settings'] = @() }
|
# Zusaetzlich Array-Properties reparieren (PS-5.1-Roundtrip-Schaden), sonst
|
||||||
|
# 400 "Property children ... does not match schema".
|
||||||
|
if ($body.ContainsKey('settings') -and $null -ne $body['settings']) {
|
||||||
|
$body['settings'] = @(Repair-SettingsCatalogArrays $body['settings'])
|
||||||
|
# Beim GET liefert Graph die Setting-Wrapper ohne '@odata.type' und mit
|
||||||
|
# read-only 'id'. Der POST verlangt aber den Wrapper-Typ; die 'id' muss
|
||||||
|
# weg -> sonst 400 "Property settings ... does not match schema".
|
||||||
|
foreach ($s in $body['settings']) {
|
||||||
|
if ($s -is [System.Collections.IDictionary]) {
|
||||||
|
if ($s.Contains('id')) { [void]$s.Remove('id') }
|
||||||
|
if (-not $s.Contains('@odata.type')) {
|
||||||
|
$s['@odata.type'] = '#microsoft.graph.deviceManagementConfigurationSetting'
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
$body['settings'] = @()
|
||||||
|
}
|
||||||
$json = $body | ConvertTo-Json -Depth 50
|
$json = $body | ConvertTo-Json -Depth 50
|
||||||
return Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -Method POST -Body $json -ContentType 'application/json'
|
return Invoke-MgGraphRequestRetry -Uri 'https://graph.microsoft.com/beta/deviceManagement/configurationPolicies' -Method POST -Body $json -ContentType 'application/json'
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function Import-GraphAdministrativeTemplate {
|
||||||
|
param([Parameter(Mandatory=$true)]$Policy)
|
||||||
|
|
||||||
|
$displayName = [string](Get-PolicyProp $Policy 'displayName')
|
||||||
|
if (-not $displayName) { throw 'Administrative Vorlage benoetigt "displayName" fuer den Import.' }
|
||||||
|
|
||||||
|
$defRoot = 'https://graph.microsoft.com/beta/deviceManagement/groupPolicyDefinitions'
|
||||||
|
$cfgRoot = 'https://graph.microsoft.com/beta/deviceManagement/groupPolicyConfigurations'
|
||||||
|
|
||||||
|
# 1) Leere Konfigurations-Huelle anlegen (definitionValues folgen einzeln).
|
||||||
|
$shell = @{
|
||||||
|
displayName = $displayName
|
||||||
|
description = [string](Get-PolicyProp $Policy 'description')
|
||||||
|
roleScopeTagIds = @('0')
|
||||||
|
}
|
||||||
|
$created = Invoke-MgGraphRequestRetry -Uri $cfgRoot -Method POST -Body ($shell | ConvertTo-Json -Depth 10) -ContentType 'application/json'
|
||||||
|
$newId = [string](Get-PolicyProp $created 'id')
|
||||||
|
if (-not $newId) { throw 'Anlegen der Administrative-Vorlage-Huelle lieferte keine Id.' }
|
||||||
|
|
||||||
|
# 2) Jeden definitionValue einzeln anhaengen. Definition + Presentations werden
|
||||||
|
# per @odata.bind referenziert — die IDs eingebauter ADMX-Vorlagen sind
|
||||||
|
# tenantuebergreifend identisch, daher tenantunabhaengig einsetzbar.
|
||||||
|
$errors = @()
|
||||||
|
foreach ($dv in @(Get-PolicyProp $Policy 'definitionValues')) {
|
||||||
|
if (-not $dv) { continue }
|
||||||
|
$def = Get-PolicyProp $dv 'definition'
|
||||||
|
$defId = [string](Get-PolicyProp $def 'id')
|
||||||
|
if (-not $defId) {
|
||||||
|
$errors += 'definitionValue ohne Definition-Id uebersprungen'
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
$presVals = @()
|
||||||
|
foreach ($pv in @(Get-PolicyProp $dv 'presentationValues')) {
|
||||||
|
if (-not $pv) { continue }
|
||||||
|
$pres = Get-PolicyProp $pv 'presentation'
|
||||||
|
$presId = [string](Get-PolicyProp $pres 'id')
|
||||||
|
$entry = [ordered]@{
|
||||||
|
'@odata.type' = [string](Get-PolicyProp $pv '@odata.type')
|
||||||
|
'presentation@odata.bind' = "$defRoot('$defId')/presentations('$presId')"
|
||||||
|
}
|
||||||
|
# Je nach Presentation-Typ traegt der Wert in 'value' ODER 'values'.
|
||||||
|
foreach ($vk in @('value','values')) {
|
||||||
|
$vv = Get-PolicyProp $pv $vk
|
||||||
|
if ($null -ne $vv) { $entry[$vk] = $vv }
|
||||||
|
}
|
||||||
|
$presVals += $entry
|
||||||
|
}
|
||||||
|
|
||||||
|
$body = [ordered]@{
|
||||||
|
enabled = [bool](Get-PolicyProp $dv 'enabled')
|
||||||
|
'definition@odata.bind' = "$defRoot('$defId')"
|
||||||
|
presentationValues = @($presVals)
|
||||||
|
}
|
||||||
|
try {
|
||||||
|
Invoke-MgGraphRequestRetry -Uri "$cfgRoot/$newId/definitionValues" -Method POST -Body ($body | ConvertTo-Json -Depth 50) -ContentType 'application/json' | Out-Null
|
||||||
|
} catch {
|
||||||
|
$m = $_.Exception.Message
|
||||||
|
try { if ($_.ErrorDetails.Message) { $m = $_.ErrorDetails.Message } } catch {}
|
||||||
|
$dn = [string](Get-PolicyProp $def 'displayName'); if (-not $dn) { $dn = $defId }
|
||||||
|
$errors += "${dn}: $m"
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($errors.Count -gt 0) {
|
||||||
|
throw ("Huelle angelegt (Id $newId), aber $($errors.Count) Einstellung(en) fehlgeschlagen: " + ($errors -join ' | '))
|
||||||
|
}
|
||||||
|
return $created
|
||||||
|
}
|
||||||
|
|
||||||
# Dispatcht anhand des ExportType auf den passenden Import.
|
# Dispatcht anhand des ExportType auf den passenden Import.
|
||||||
function Import-GraphPolicyByExportType {
|
function Import-GraphPolicyByExportType {
|
||||||
param([string]$ExportType, $Policy)
|
param([string]$ExportType, $Policy)
|
||||||
switch ($ExportType) {
|
switch ($ExportType) {
|
||||||
'CompliancePolicy' { return Import-GraphCompliancePolicy -Policy $Policy }
|
'CompliancePolicy' { return Import-GraphCompliancePolicy -Policy $Policy }
|
||||||
'ConfigurationProfile' { return Import-GraphConfigurationProfile -Policy $Policy }
|
'ConfigurationProfile' { return Import-GraphConfigurationProfile -Policy $Policy }
|
||||||
'SettingsCatalog' { return Import-GraphSettingsCatalogPolicy -Policy $Policy }
|
'SettingsCatalog' { return Import-GraphSettingsCatalogPolicy -Policy $Policy }
|
||||||
|
'AdministrativeTemplate' { return Import-GraphAdministrativeTemplate -Policy $Policy }
|
||||||
default { throw "Unbekannter exportType: $ExportType" }
|
default { throw "Unbekannter exportType: $ExportType" }
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
@@ -288,6 +460,11 @@ function Get-SettingsCatalogPoliciesEndpoint {
|
|||||||
return @{ ok = $true; items = @(Get-GraphPolicyList -Type 'settingscatalog') }
|
return @{ ok = $true; items = @(Get-GraphPolicyList -Type 'settingscatalog') }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
function Get-AdministrativeTemplatesEndpoint {
|
||||||
|
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||||
|
return @{ ok = $true; items = @(Get-GraphPolicyList -Type 'administrativetemplate') }
|
||||||
|
}
|
||||||
|
|
||||||
# Export: liefert die Export-Objekte im Response (Browser-Download) UND legt sie
|
# Export: liefert die Export-Objekte im Response (Browser-Download) UND legt sie
|
||||||
# zusaetzlich als JSON im Server-Archiv ab. Body: { type, ids }.
|
# zusaetzlich als JSON im Server-Archiv ab. Body: { type, ids }.
|
||||||
function Export-PoliciesEndpoint {
|
function Export-PoliciesEndpoint {
|
||||||
@@ -368,10 +545,14 @@ function Import-PoliciesEndpoint {
|
|||||||
param($Body)
|
param($Body)
|
||||||
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||||
|
|
||||||
$uploaded = @(Get-PolicyProp $Body 'policies')
|
# @(Get-PolicyProp ...) auf ein fehlendes Feld liefert $null -> @($null) hat
|
||||||
$fileNames = @(Get-PolicyProp $Body 'fileNames')
|
# Count 1 (ein Null-Element), kein leeres Array. Ohne Filter wuerde die
|
||||||
|
# Archiv-Schleife einmal mit $fileName = $null laufen und auf das Verzeichnis
|
||||||
|
# selbst zugreifen (DirectoryNotFoundException). Daher Null/Leer rausfiltern.
|
||||||
|
$uploaded = @(Get-PolicyProp $Body 'policies') | Where-Object { $_ }
|
||||||
|
$fileNames = @(Get-PolicyProp $Body 'fileNames') | Where-Object { $_ }
|
||||||
|
|
||||||
if ($uploaded.Count -eq 0 -and $fileNames.Count -eq 0) {
|
if (@($uploaded).Count -eq 0 -and @($fileNames).Count -eq 0) {
|
||||||
return @{ __status = 400; error = 'Keine Policies zum Importieren uebergeben' }
|
return @{ __status = 400; error = 'Keine Policies zum Importieren uebergeben' }
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -380,7 +561,10 @@ function Import-PoliciesEndpoint {
|
|||||||
# 1) Hochgeladene Envelopes
|
# 1) Hochgeladene Envelopes
|
||||||
foreach ($env in $uploaded) {
|
foreach ($env in $uploaded) {
|
||||||
if (-not $env) { continue }
|
if (-not $env) { continue }
|
||||||
|
# Envelope-Formate akzeptieren beide Typ-Felder: 'exportType' (Export-
|
||||||
|
# Download) und 'policyType' (Git-Snapshot).
|
||||||
$exportType = [string](Get-PolicyProp $env 'exportType')
|
$exportType = [string](Get-PolicyProp $env 'exportType')
|
||||||
|
if (-not $exportType) { $exportType = [string](Get-PolicyProp $env 'policyType') }
|
||||||
$policy = Get-PolicyProp $env 'policy'
|
$policy = Get-PolicyProp $env 'policy'
|
||||||
$policyName = Get-PolicyProp $env 'policyName'
|
$policyName = Get-PolicyProp $env 'policyName'
|
||||||
if (-not $policyName) { $policyName = Get-PolicyDisplayName $policy }
|
if (-not $policyName) { $policyName = Get-PolicyDisplayName $policy }
|
||||||
@@ -388,6 +572,14 @@ function Import-PoliciesEndpoint {
|
|||||||
$results += @{ policyName = [string]$policyName; success = $false; error = 'Envelope ohne "policy"-Feld' }
|
$results += @{ policyName = [string]$policyName; success = $false; error = 'Envelope ohne "policy"-Feld' }
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
|
# Optionale Umbenennung: das richtige Namensfeld je Typ setzen.
|
||||||
|
$newName = [string](Get-PolicyProp $env 'newName')
|
||||||
|
if ($newName -and $newName.Trim()) {
|
||||||
|
$cfg = Get-PolicyTypeConfigByExportType $exportType
|
||||||
|
$nameField = if ($cfg) { $cfg.NameField } else { 'displayName' }
|
||||||
|
Set-PolicyProp $policy $nameField $newName.Trim()
|
||||||
|
$policyName = $newName.Trim()
|
||||||
|
}
|
||||||
try {
|
try {
|
||||||
$imported = Import-GraphPolicyByExportType -ExportType $exportType -Policy $policy
|
$imported = Import-GraphPolicyByExportType -ExportType $exportType -Policy $policy
|
||||||
$results += @{ policyName = [string]$policyName; exportType = $exportType; success = $true; newId = [string](Get-PolicyProp $imported 'id') }
|
$results += @{ policyName = [string]$policyName; exportType = $exportType; success = $true; newId = [string](Get-PolicyProp $imported 'id') }
|
||||||
@@ -401,9 +593,10 @@ function Import-PoliciesEndpoint {
|
|||||||
# 2) Dateien aus dem Server-Archiv
|
# 2) Dateien aus dem Server-Archiv
|
||||||
$exportDir = Get-PolicyExportDir
|
$exportDir = Get-PolicyExportDir
|
||||||
foreach ($fileName in $fileNames) {
|
foreach ($fileName in $fileNames) {
|
||||||
$safe = ($fileName -replace '[\\/]', '')
|
if ([string]::IsNullOrWhiteSpace([string]$fileName)) { continue }
|
||||||
|
$safe = ([string]$fileName -replace '[\\/]', '')
|
||||||
$filePath = Join-Path $exportDir $safe
|
$filePath = Join-Path $exportDir $safe
|
||||||
if (-not (Test-Path $filePath)) {
|
if ([string]::IsNullOrWhiteSpace($safe) -or -not (Test-Path $filePath -PathType Leaf)) {
|
||||||
$results += @{ fileName = $fileName; success = $false; error = 'Datei nicht gefunden' }
|
$results += @{ fileName = $fileName; success = $false; error = 'Datei nicht gefunden' }
|
||||||
continue
|
continue
|
||||||
}
|
}
|
||||||
@@ -411,6 +604,7 @@ function Import-PoliciesEndpoint {
|
|||||||
try {
|
try {
|
||||||
$content = Get-Content $filePath -Raw | ConvertFrom-Json
|
$content = Get-Content $filePath -Raw | ConvertFrom-Json
|
||||||
$exportType = [string](Get-PolicyProp $content 'exportType')
|
$exportType = [string](Get-PolicyProp $content 'exportType')
|
||||||
|
if (-not $exportType) { $exportType = [string](Get-PolicyProp $content 'policyType') }
|
||||||
$policy = Get-PolicyProp $content 'policy'
|
$policy = Get-PolicyProp $content 'policy'
|
||||||
$policyName = Get-PolicyDisplayName $policy
|
$policyName = Get-PolicyDisplayName $policy
|
||||||
$imported = Import-GraphPolicyByExportType -ExportType $exportType -Policy $policy
|
$imported = Import-GraphPolicyByExportType -ExportType $exportType -Policy $policy
|
||||||
@@ -425,3 +619,179 @@ function Import-PoliciesEndpoint {
|
|||||||
$ok = @($results | Where-Object { $_.success }).Count
|
$ok = @($results | Where-Object { $_.success }).Count
|
||||||
return @{ ok = $true; importedCount = $ok; results = @($results) }
|
return @{ ok = $true; importedCount = $ok; results = @($results) }
|
||||||
}
|
}
|
||||||
|
|
||||||
|
# Weist importierten Policies Gruppen zu (Include + Exclude). Body:
|
||||||
|
# items = [ { exportType, id, policyName, include:[groupId], exclude:[groupId] } ]
|
||||||
|
# Nutzt die typ-spezifische /assign-Action. Zuweisungen sind pro Policy.
|
||||||
|
function Invoke-PolicyAssignEndpoint {
|
||||||
|
param($Body)
|
||||||
|
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||||
|
|
||||||
|
$items = @(Get-PolicyProp $Body 'items') | Where-Object { $_ }
|
||||||
|
if (@($items).Count -eq 0) { return @{ __status = 400; error = 'Keine Zuweisungen uebergeben' } }
|
||||||
|
|
||||||
|
$results = @()
|
||||||
|
foreach ($it in $items) {
|
||||||
|
$exportType = [string](Get-PolicyProp $it 'exportType')
|
||||||
|
$id = [string](Get-PolicyProp $it 'id')
|
||||||
|
$name = [string](Get-PolicyProp $it 'policyName')
|
||||||
|
$include = @(Get-PolicyProp $it 'include') | Where-Object { $_ }
|
||||||
|
$exclude = @(Get-PolicyProp $it 'exclude') | Where-Object { $_ }
|
||||||
|
$cfg = Get-PolicyTypeConfigByExportType $exportType
|
||||||
|
|
||||||
|
if (-not $cfg) { $results += @{ id = $id; policyName = $name; success = $false; error = "Unbekannter exportType: $exportType" }; continue }
|
||||||
|
if (-not $id) { $results += @{ policyName = $name; success = $false; error = 'Policy-Id fehlt' }; continue }
|
||||||
|
if (@($include).Count -eq 0 -and @($exclude).Count -eq 0) {
|
||||||
|
$results += @{ id = $id; policyName = $name; success = $true; skipped = $true }
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
|
||||||
|
$assignments = @()
|
||||||
|
foreach ($g in $include) {
|
||||||
|
$assignments += @{ target = @{ '@odata.type' = '#microsoft.graph.groupAssignmentTarget'; groupId = [string]$g } }
|
||||||
|
}
|
||||||
|
foreach ($g in $exclude) {
|
||||||
|
$assignments += @{ target = @{ '@odata.type' = '#microsoft.graph.exclusionGroupAssignmentTarget'; groupId = [string]$g } }
|
||||||
|
}
|
||||||
|
$json = @{ assignments = @($assignments) } | ConvertTo-Json -Depth 10
|
||||||
|
$uri = "https://graph.microsoft.com/beta/deviceManagement/$($cfg.Collection)/$id/assign"
|
||||||
|
try {
|
||||||
|
Invoke-MgGraphRequestRetry -Uri $uri -Method POST -Body $json -ContentType 'application/json' | Out-Null
|
||||||
|
$results += @{ id = $id; policyName = $name; success = $true; includeCount = @($include).Count; excludeCount = @($exclude).Count }
|
||||||
|
} catch {
|
||||||
|
$m = $_.Exception.Message
|
||||||
|
try { if ($_.ErrorDetails.Message) { $m = $_.ErrorDetails.Message } } catch {}
|
||||||
|
$results += @{ id = $id; policyName = $name; success = $false; error = $m }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$ok = @($results | Where-Object { $_.success -and -not $_.skipped }).Count
|
||||||
|
return @{ ok = $true; assignedCount = $ok; results = @($results) }
|
||||||
|
}
|
||||||
|
|
||||||
|
# ============================================================
|
||||||
|
# Policy-Snapshot nach Git (voller Export, stabile Dateinamen)
|
||||||
|
# ============================================================
|
||||||
|
|
||||||
|
# Rekursiv nach Schluesseln sortieren -> deterministische JSON-Ausgabe, damit
|
||||||
|
# unveraenderte Policies keine Diff-Noise durch wechselnde Key-Reihenfolge
|
||||||
|
# erzeugen (Invoke-MgGraphRequest liefert ungeordnete Hashtables).
|
||||||
|
function ConvertTo-StableObject {
|
||||||
|
param($InputObject)
|
||||||
|
if ($InputObject -is [System.Collections.IDictionary]) {
|
||||||
|
$ordered = [ordered]@{}
|
||||||
|
foreach ($k in ($InputObject.Keys | Sort-Object)) {
|
||||||
|
$ordered[$k] = ConvertTo-StableObject $InputObject[$k]
|
||||||
|
}
|
||||||
|
return $ordered
|
||||||
|
}
|
||||||
|
if (($InputObject -is [System.Collections.IEnumerable]) -and -not ($InputObject -is [string])) {
|
||||||
|
# Array-Reihenfolge bleibt erhalten (ist bei Policies bedeutungstragend).
|
||||||
|
return @($InputObject | ForEach-Object { ConvertTo-StableObject $_ })
|
||||||
|
}
|
||||||
|
return $InputObject
|
||||||
|
}
|
||||||
|
|
||||||
|
function Invoke-Git {
|
||||||
|
param([Parameter(Mandatory=$true)][string]$RepoPath, [Parameter(Mandatory=$true)][string[]]$GitArgs)
|
||||||
|
$out = & git -C $RepoPath @GitArgs 2>&1
|
||||||
|
return @{ exit = $LASTEXITCODE; out = (@($out) -join "`n").Trim() }
|
||||||
|
}
|
||||||
|
|
||||||
|
function Get-PolicySnapshotFolderName {
|
||||||
|
# Tenant-Unterordner im Repo: Label (Multi-Tenant) sonst TenantId sonst 'default'.
|
||||||
|
$active = Get-ActiveConnection -Settings $script:Settings
|
||||||
|
$name = if ($active.label) { $active.label } elseif ($script:State.TenantId) { [string]$script:State.TenantId } else { 'default' }
|
||||||
|
$safe = ($name -replace '[^\w\-\.]', '_')
|
||||||
|
if ([string]::IsNullOrWhiteSpace($safe)) { $safe = 'default' }
|
||||||
|
return $safe
|
||||||
|
}
|
||||||
|
|
||||||
|
function Invoke-PolicyGitSnapshotEndpoint {
|
||||||
|
try { Assert-GraphConnected } catch { return @{ __status = 401; error = 'Nicht mit Microsoft Graph verbunden' } }
|
||||||
|
|
||||||
|
$cfg = $script:Settings.policyBackup
|
||||||
|
$repo = if ($cfg -and $cfg.gitRepoPath) { [string]$cfg.gitRepoPath } else { '' }
|
||||||
|
$doPush = if ($cfg -and $cfg.push) { [bool]$cfg.push } else { $false }
|
||||||
|
if ([string]::IsNullOrWhiteSpace($repo)) {
|
||||||
|
return @{ __status = 400; error = 'Kein Git-Repo-Pfad konfiguriert (Einstellungen -> Policy-Backup).' }
|
||||||
|
}
|
||||||
|
|
||||||
|
# git verfuegbar?
|
||||||
|
try { $null = & git --version 2>&1; if ($LASTEXITCODE -ne 0) { throw 'x' } }
|
||||||
|
catch { return @{ __status = 500; error = 'git ist nicht installiert oder nicht im PATH.' } }
|
||||||
|
|
||||||
|
# Repo-Ordner + .git sicherstellen
|
||||||
|
if (-not (Test-Path $repo)) { New-Item -ItemType Directory -Path $repo -Force | Out-Null }
|
||||||
|
if (-not (Test-Path (Join-Path $repo '.git'))) {
|
||||||
|
$r = Invoke-Git -RepoPath $repo -GitArgs @('init')
|
||||||
|
if ($r.exit -ne 0) { return @{ __status = 500; error = "git init fehlgeschlagen: $($r.out)" } }
|
||||||
|
}
|
||||||
|
# Commit-Identitaet sicherstellen (frisches Repo hat evtl. keine).
|
||||||
|
if ([string]::IsNullOrWhiteSpace((Invoke-Git -RepoPath $repo -GitArgs @('config','user.email')).out)) {
|
||||||
|
Invoke-Git -RepoPath $repo -GitArgs @('config','user.email','intune-manager@localhost') | Out-Null
|
||||||
|
Invoke-Git -RepoPath $repo -GitArgs @('config','user.name','Intune Manager') | Out-Null
|
||||||
|
}
|
||||||
|
|
||||||
|
$tenantFolder = Get-PolicySnapshotFolderName
|
||||||
|
$tenantDir = Join-Path $repo $tenantFolder
|
||||||
|
# Tenant-Ordner komplett neu aufbauen -> entfernte Policies verschwinden (Diff).
|
||||||
|
if (Test-Path $tenantDir) { Remove-Item $tenantDir -Recurse -Force }
|
||||||
|
New-Item -ItemType Directory -Path $tenantDir -Force | Out-Null
|
||||||
|
|
||||||
|
$types = @('settingscatalog','compliance','configuration','administrativetemplate')
|
||||||
|
$total = 0
|
||||||
|
$perType = [ordered]@{}
|
||||||
|
foreach ($type in $types) {
|
||||||
|
$tcfg = Get-PolicyTypeConfig $type
|
||||||
|
$list = @(Get-GraphPolicyList -Type $type)
|
||||||
|
$perType[$tcfg.ExportType] = $list.Count
|
||||||
|
if ($list.Count -eq 0) { continue }
|
||||||
|
$typeDir = Join-Path $tenantDir $type
|
||||||
|
New-Item -ItemType Directory -Path $typeDir -Force | Out-Null
|
||||||
|
foreach ($item in $list) {
|
||||||
|
$id = [string]$item.id
|
||||||
|
$detail = $null
|
||||||
|
try { $detail = Get-GraphPolicyDetail -Type $type -Id $id } catch { continue }
|
||||||
|
$name = [string]$item.name
|
||||||
|
$safe = ($name -replace '[^\w\-\.]', '_'); if (-not $safe) { $safe = $id }
|
||||||
|
$short = if ($id.Length -ge 8) { $id.Substring(0,8) } else { $id }
|
||||||
|
$fname = "$($safe)__$($short).json"
|
||||||
|
$envelope = [ordered]@{
|
||||||
|
policyType = $tcfg.ExportType
|
||||||
|
policyName = $name
|
||||||
|
policy = $detail
|
||||||
|
}
|
||||||
|
# stabile (sortierte) Ausgabe, ohne Zeitstempel -> saubere Diffs
|
||||||
|
(ConvertTo-StableObject $envelope) | ConvertTo-Json -Depth 50 | Set-Content -Path (Join-Path $typeDir $fname) -Encoding UTF8
|
||||||
|
$total++
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
$add = Invoke-Git -RepoPath $repo -GitArgs @('add','-A')
|
||||||
|
if ($add.exit -ne 0) { return @{ __status = 500; error = "git add fehlgeschlagen: $($add.out)" } }
|
||||||
|
|
||||||
|
if ([string]::IsNullOrWhiteSpace((Invoke-Git -RepoPath $repo -GitArgs @('status','--porcelain')).out)) {
|
||||||
|
return @{ ok = $true; changed = $false; committed = $false; total = $total; perType = $perType; tenant = $tenantFolder; message = 'Keine Aenderungen seit dem letzten Snapshot.' }
|
||||||
|
}
|
||||||
|
|
||||||
|
$msg = "Policy-Snapshot $tenantFolder $(Get-Date -Format 'yyyy-MM-dd HH:mm')"
|
||||||
|
$commit = Invoke-Git -RepoPath $repo -GitArgs @('commit','-m',$msg)
|
||||||
|
if ($commit.exit -ne 0) { return @{ __status = 500; error = "git commit fehlgeschlagen: $($commit.out)" } }
|
||||||
|
$hash = (Invoke-Git -RepoPath $repo -GitArgs @('rev-parse','--short','HEAD')).out
|
||||||
|
|
||||||
|
$pushed = $false; $pushError = $null
|
||||||
|
if ($doPush) {
|
||||||
|
$push = Invoke-Git -RepoPath $repo -GitArgs @('push')
|
||||||
|
if ($push.exit -eq 0) { $pushed = $true } else { $pushError = $push.out }
|
||||||
|
}
|
||||||
|
|
||||||
|
$summary = "Snapshot committet: $total Policies ($hash)"
|
||||||
|
if ($doPush) { $summary += if ($pushed) { ', gepusht' } else { ', Push fehlgeschlagen' } }
|
||||||
|
return @{
|
||||||
|
ok = $true; changed = $true; committed = $true
|
||||||
|
total = $total; perType = $perType; tenant = $tenantFolder
|
||||||
|
commit = $hash; pushed = $pushed; pushError = $pushError
|
||||||
|
message = $summary
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|||||||
+446
-18
@@ -194,9 +194,11 @@ document.getElementById('tenantSwitch')?.addEventListener('change', async e => {
|
|||||||
State.readOnly = !!s.readOnly;
|
State.readOnly = !!s.readOnly;
|
||||||
applyReadOnlyMode();
|
applyReadOnlyMode();
|
||||||
renderConnection();
|
renderConnection();
|
||||||
// Frontend-Caches anderer Tabs verwerfen (anderer Tenant = andere Daten).
|
// Anderer Tenant = andere Daten: ALLE datentragenden Frontend-Caches
|
||||||
if (typeof ReportState !== 'undefined') ReportState.items = [];
|
// verwerfen, sonst ueberspringen die Load-Guards (appsLoaded/loadedModes)
|
||||||
if (typeof PolState !== 'undefined') { PolState.items = []; PolState.selected?.clear?.(); }
|
// das Neuladen und die UI zeigt weiter den vorherigen Tenant.
|
||||||
|
if (typeof stopDevicePolling === 'function') stopDevicePolling();
|
||||||
|
resetClientState();
|
||||||
switchMainView('apps');
|
switchMainView('apps');
|
||||||
if (s.connected) {
|
if (s.connected) {
|
||||||
toast('Verbunden mit ' + (s.tenantLabel || s.account || 'Mandant'), 'ok', 'Mandant gewechselt');
|
toast('Verbunden mit ' + (s.tenantLabel || s.account || 'Mandant'), 'ok', 'Mandant gewechselt');
|
||||||
@@ -345,17 +347,8 @@ document.getElementById('btnDisconnect').addEventListener('click', async () => {
|
|||||||
connectInFlight = false;
|
connectInFlight = false;
|
||||||
try {
|
try {
|
||||||
await api('/api/disconnect', { method: 'POST' });
|
await api('/api/disconnect', { method: 'POST' });
|
||||||
Object.assign(State, {
|
Object.assign(State, { connected: false, account: null });
|
||||||
connected: false, account: null,
|
resetClientState();
|
||||||
targets: [], apps: [], session: [],
|
|
||||||
appsLoaded: false,
|
|
||||||
});
|
|
||||||
State.selectedTargetIds.clear();
|
|
||||||
State.membershipCache.clear();
|
|
||||||
State.loadedModes.clear();
|
|
||||||
State.appDetails.clear();
|
|
||||||
State.expandedApps.clear();
|
|
||||||
State.modeCache.clear();
|
|
||||||
renderConnection();
|
renderConnection();
|
||||||
renderTargets();
|
renderTargets();
|
||||||
renderPinnedTargets();
|
renderPinnedTargets();
|
||||||
@@ -368,6 +361,25 @@ document.getElementById('btnDisconnect').addEventListener('click', async () => {
|
|||||||
}
|
}
|
||||||
});
|
});
|
||||||
|
|
||||||
|
// Alle datentragenden Frontend-Caches verwerfen (Apps, Targets, Gruppen-
|
||||||
|
// Mitglieder, Report, Policies, Devices). Beruehrt NICHT connected/account —
|
||||||
|
// das setzt der jeweilige Aufrufer (Disconnect vs. Tenant-Wechsel) selbst.
|
||||||
|
// Wird beim Tenant-Wechsel benoetigt, sonst zeigen die Load-Guards
|
||||||
|
// (appsLoaded / loadedModes) noch die Daten des vorherigen Tenants.
|
||||||
|
function resetClientState() {
|
||||||
|
Object.assign(State, { targets: [], apps: [], session: [], appsLoaded: false });
|
||||||
|
State.selectedTargetIds.clear();
|
||||||
|
State.membershipCache.clear();
|
||||||
|
State.loadedModes.clear();
|
||||||
|
State.appDetails.clear();
|
||||||
|
State.expandedApps.clear();
|
||||||
|
State.modeCache.clear();
|
||||||
|
State.expandedGroups = new Map();
|
||||||
|
if (typeof ReportState !== 'undefined') ReportState.items = [];
|
||||||
|
if (typeof PolState !== 'undefined') { PolState.items = []; PolState.selected?.clear?.(); }
|
||||||
|
if (typeof DevState !== 'undefined') { DevState.items = []; DevState.filtered = []; DevState.selected = null; }
|
||||||
|
}
|
||||||
|
|
||||||
async function autoLoadAfterConnect() {
|
async function autoLoadAfterConnect() {
|
||||||
// Load default mode targets + apps in parallel
|
// Load default mode targets + apps in parallel
|
||||||
const tasks = [];
|
const tasks = [];
|
||||||
@@ -4119,6 +4131,11 @@ function fillSettingsForm(s) {
|
|||||||
document.getElementById('setAvailSuffix').value = av.suffix || '';
|
document.getElementById('setAvailSuffix').value = av.suffix || '';
|
||||||
updateAvailPreview();
|
updateAvailPreview();
|
||||||
|
|
||||||
|
// Policy-Backup (Git)
|
||||||
|
const pb = s.policyBackup || {};
|
||||||
|
document.getElementById('setPolicyGitPath').value = pb.gitRepoPath || '';
|
||||||
|
document.getElementById('setPolicyGitPush').checked = !!pb.push;
|
||||||
|
|
||||||
// Branding-Logo Preview
|
// Branding-Logo Preview
|
||||||
fillLogoPreview(s.branding);
|
fillLogoPreview(s.branding);
|
||||||
|
|
||||||
@@ -4219,6 +4236,10 @@ function readSettingsForm() {
|
|||||||
detailPanel: document.getElementById('setColDetailPanelHex').value.trim() || ThemeDefaults.detailPanel,
|
detailPanel: document.getElementById('setColDetailPanelHex').value.trim() || ThemeDefaults.detailPanel,
|
||||||
},
|
},
|
||||||
},
|
},
|
||||||
|
policyBackup: {
|
||||||
|
gitRepoPath: document.getElementById('setPolicyGitPath').value.trim(),
|
||||||
|
push: document.getElementById('setPolicyGitPush').checked,
|
||||||
|
},
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
||||||
@@ -4600,6 +4621,7 @@ function switchMainView(view) {
|
|||||||
const reportView = document.getElementById('appReportView');
|
const reportView = document.getElementById('appReportView');
|
||||||
const devView = document.getElementById('devView');
|
const devView = document.getElementById('devView');
|
||||||
const polView = document.getElementById('policiesView');
|
const polView = document.getElementById('policiesView');
|
||||||
|
const offView = document.getElementById('offView');
|
||||||
document.querySelectorAll('#topbarNav .nav-tab').forEach(t => {
|
document.querySelectorAll('#topbarNav .nav-tab').forEach(t => {
|
||||||
t.classList.toggle('active', t.dataset.view === view);
|
t.classList.toggle('active', t.dataset.view === view);
|
||||||
t.setAttribute('aria-selected', t.dataset.view === view ? 'true' : 'false');
|
t.setAttribute('aria-selected', t.dataset.view === view ? 'true' : 'false');
|
||||||
@@ -4609,12 +4631,13 @@ function switchMainView(view) {
|
|||||||
reportView.classList.toggle('hidden', view !== 'report');
|
reportView.classList.toggle('hidden', view !== 'report');
|
||||||
devView .classList.toggle('hidden', view !== 'devices');
|
devView .classList.toggle('hidden', view !== 'devices');
|
||||||
polView .classList.toggle('hidden', view !== 'policies');
|
polView .classList.toggle('hidden', view !== 'policies');
|
||||||
|
if (offView) offView.classList.toggle('hidden', view !== 'offboard');
|
||||||
}
|
}
|
||||||
|
|
||||||
document.querySelectorAll('#topbarNav .nav-tab').forEach(btn => {
|
document.querySelectorAll('#topbarNav .nav-tab').forEach(btn => {
|
||||||
btn.addEventListener('click', () => {
|
btn.addEventListener('click', () => {
|
||||||
const view = btn.dataset.view;
|
const view = btn.dataset.view;
|
||||||
if ((view === 'groups' || view === 'report' || view === 'devices' || view === 'policies') && !State.connected) {
|
if ((view === 'groups' || view === 'report' || view === 'devices' || view === 'policies' || view === 'offboard') && !State.connected) {
|
||||||
toast('Bitte zuerst verbinden.', 'warn');
|
toast('Bitte zuerst verbinden.', 'warn');
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
@@ -4623,6 +4646,7 @@ document.querySelectorAll('#topbarNav .nav-tab').forEach(btn => {
|
|||||||
if (view === 'report' && ReportState.items.length === 0) loadAppReport();
|
if (view === 'report' && ReportState.items.length === 0) loadAppReport();
|
||||||
if (view === 'devices') { devLoadAll(); setTimeout(() => document.getElementById('devSearch').focus(), 80); }
|
if (view === 'devices') { devLoadAll(); setTimeout(() => document.getElementById('devSearch').focus(), 80); }
|
||||||
if (view === 'policies' && PolState.items.length === 0) loadPolicies();
|
if (view === 'policies' && PolState.items.length === 0) loadPolicies();
|
||||||
|
if (view === 'offboard') setTimeout(() => document.getElementById('offSearch').focus(), 80);
|
||||||
});
|
});
|
||||||
});
|
});
|
||||||
|
|
||||||
@@ -5751,6 +5775,7 @@ async function loadPolicies() {
|
|||||||
['/api/policies/settingscatalog', 'Settings Catalog'],
|
['/api/policies/settingscatalog', 'Settings Catalog'],
|
||||||
['/api/policies/compliance', 'Compliance'],
|
['/api/policies/compliance', 'Compliance'],
|
||||||
['/api/policies/configuration', 'Konfigurationsprofile'],
|
['/api/policies/configuration', 'Konfigurationsprofile'],
|
||||||
|
['/api/policies/administrativetemplate', 'Administrative Vorlagen'],
|
||||||
];
|
];
|
||||||
const settled = await Promise.allSettled(endpoints.map(([url]) => api(url)));
|
const settled = await Promise.allSettled(endpoints.map(([url]) => api(url)));
|
||||||
let items = [];
|
let items = [];
|
||||||
@@ -5891,12 +5916,20 @@ async function polExportSelected() {
|
|||||||
// Datei-Inhalt -> Liste von Envelopes { exportType, policy, ... }
|
// Datei-Inhalt -> Liste von Envelopes { exportType, policy, ... }
|
||||||
function polExtractEnvelopes(parsed, fileName) {
|
function polExtractEnvelopes(parsed, fileName) {
|
||||||
if (parsed && Array.isArray(parsed.policies)) return parsed.policies;
|
if (parsed && Array.isArray(parsed.policies)) return parsed.policies;
|
||||||
if (parsed && parsed.exportType && parsed.policy) return [parsed];
|
// Beide Typ-Felder akzeptieren: exportType (Export-Download) + policyType (Git-Snapshot).
|
||||||
|
if (parsed && (parsed.exportType || parsed.policyType) && parsed.policy) return [parsed];
|
||||||
if (parsed && parsed.policy) return [parsed]; // nachsichtig
|
if (parsed && parsed.policy) return [parsed]; // nachsichtig
|
||||||
toast(`${fileName}: unbekanntes Policy-Format.`, 'err');
|
toast(`${fileName}: unbekanntes Policy-Format.`, 'err');
|
||||||
return [];
|
return [];
|
||||||
}
|
}
|
||||||
|
|
||||||
|
let _polImportEnvelopes = [];
|
||||||
|
|
||||||
|
function polEnvName(env) {
|
||||||
|
return env.policyName || (env.policy && (env.policy.name || env.policy.displayName)) || '(ohne Name)';
|
||||||
|
}
|
||||||
|
|
||||||
|
// Dateien einlesen -> Rename-Dialog oeffnen (der eigentliche Import folgt dort).
|
||||||
async function polHandleImportFiles(fileList) {
|
async function polHandleImportFiles(fileList) {
|
||||||
const files = [...fileList];
|
const files = [...fileList];
|
||||||
if (!files.length) return;
|
if (!files.length) return;
|
||||||
@@ -5908,10 +5941,36 @@ async function polHandleImportFiles(fileList) {
|
|||||||
envelopes = envelopes.concat(polExtractEnvelopes(parsed, f.name));
|
envelopes = envelopes.concat(polExtractEnvelopes(parsed, f.name));
|
||||||
}
|
}
|
||||||
if (!envelopes.length) return;
|
if (!envelopes.length) return;
|
||||||
if (!window.confirm(`${envelopes.length} Policy(s) als NEUE Policies im verbundenen Tenant anlegen?\n\nBestehende Policies werden dabei nicht verändert.`)) return;
|
_polImportEnvelopes = envelopes;
|
||||||
|
renderPolImportList();
|
||||||
|
openModal('modalPolImport');
|
||||||
|
}
|
||||||
|
|
||||||
|
function renderPolImportList() {
|
||||||
|
const list = document.getElementById('polImportList');
|
||||||
|
if (!list) return;
|
||||||
|
list.innerHTML = _polImportEnvelopes.map((env, i) => {
|
||||||
|
const type = env.exportType || env.policyType || '';
|
||||||
|
return `<div class="pol-import-row">
|
||||||
|
<input class="input pol-import-name" data-idx="${i}" value="${escapeHtml(polEnvName(env))}" placeholder="Policy-Name">
|
||||||
|
<span class="pol-type-badge">${escapeHtml(POL_TYPE_LABELS[type] || type || 'Policy')}</span>
|
||||||
|
</div>`;
|
||||||
|
}).join('');
|
||||||
|
const info = document.getElementById('polImportInfo');
|
||||||
|
if (info) info.textContent = `${_polImportEnvelopes.length} Policy(s)`;
|
||||||
|
}
|
||||||
|
|
||||||
|
async function polDoImport() {
|
||||||
|
// Geänderte Namen übernehmen (nur wenn nicht leer und wirklich anders).
|
||||||
|
_polImportEnvelopes.forEach((env, i) => {
|
||||||
|
const input = document.querySelector(`.pol-import-name[data-idx="${i}"]`);
|
||||||
|
const nn = input ? input.value.trim() : '';
|
||||||
|
if (nn && nn !== polEnvName(env)) env.newName = nn; else delete env.newName;
|
||||||
|
});
|
||||||
|
closeModal('modalPolImport');
|
||||||
setLoading('Importiere Policies…');
|
setLoading('Importiere Policies…');
|
||||||
try {
|
try {
|
||||||
const res = await api('/api/policies/import', { method: 'POST', body: { policies: envelopes }, timeoutMs: 180000 });
|
const res = await api('/api/policies/import', { method: 'POST', body: { policies: _polImportEnvelopes }, timeoutMs: 180000 });
|
||||||
const results = res.results || [];
|
const results = res.results || [];
|
||||||
const ok = results.filter(r => r.success);
|
const ok = results.filter(r => r.success);
|
||||||
const fail = results.filter(r => !r.success);
|
const fail = results.filter(r => !r.success);
|
||||||
@@ -5922,15 +5981,215 @@ async function polHandleImportFiles(fileList) {
|
|||||||
toast(`${ok.length} Policy(s) importiert.`, 'ok', 'Import');
|
toast(`${ok.length} Policy(s) importiert.`, 'ok', 'Import');
|
||||||
}
|
}
|
||||||
await loadPolicies();
|
await loadPolicies();
|
||||||
|
// Nach erfolgreichem Import optional Gruppen zuweisen (pro Policy).
|
||||||
|
const assignable = ok.filter(r => r.newId);
|
||||||
|
if (assignable.length && !State.readOnly) openPolAssignModal(assignable);
|
||||||
} catch (e) {
|
} catch (e) {
|
||||||
toast('Import fehlgeschlagen: ' + e.message, 'err');
|
toast('Import fehlgeschlagen: ' + e.message, 'err');
|
||||||
} finally {
|
} finally {
|
||||||
clearLoading();
|
clearLoading();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
document.getElementById('polImportConfirm')?.addEventListener('click', polDoImport);
|
||||||
|
|
||||||
|
// =============================================================
|
||||||
|
// Post-Import: Policies pro Stück Include-/Exclude-Gruppen zuweisen
|
||||||
|
// =============================================================
|
||||||
|
const PolAssignState = { policies: [] };
|
||||||
|
const POL_TYPE_LABELS = {
|
||||||
|
SettingsCatalog: 'Settings Catalog',
|
||||||
|
CompliancePolicy: 'Compliance',
|
||||||
|
ConfigurationProfile: 'Konfigurationsprofil',
|
||||||
|
AdministrativeTemplate: 'Administrative Vorlage',
|
||||||
|
};
|
||||||
|
|
||||||
|
function openPolAssignModal(assignable) {
|
||||||
|
PolAssignState.policies = assignable.map(r => ({
|
||||||
|
id: r.newId,
|
||||||
|
name: r.policyName || '(ohne Name)',
|
||||||
|
exportType: r.exportType || '',
|
||||||
|
include: [],
|
||||||
|
exclude: [],
|
||||||
|
}));
|
||||||
|
renderPolAssignList();
|
||||||
|
openModal('modalPolAssign');
|
||||||
|
}
|
||||||
|
|
||||||
|
function renderPolAssignList() {
|
||||||
|
const list = document.getElementById('polAssignList');
|
||||||
|
if (!list) return;
|
||||||
|
list.innerHTML = PolAssignState.policies.map((p, i) => `
|
||||||
|
<div class="pol-assign-row" data-idx="${i}">
|
||||||
|
<div class="pol-assign-head">
|
||||||
|
<span class="pol-name">${escapeHtml(p.name)}</span>
|
||||||
|
<span class="pol-type-badge">${escapeHtml(POL_TYPE_LABELS[p.exportType] || p.exportType || 'Policy')}</span>
|
||||||
|
</div>
|
||||||
|
<div class="pol-assign-pickers">
|
||||||
|
${['include', 'exclude'].map(kind => `
|
||||||
|
<div class="pol-assign-picker" data-kind="${kind}">
|
||||||
|
<label class="lbl">${kind === 'include' ? 'Include-Gruppen' : 'Exclude-Gruppen'}</label>
|
||||||
|
<div class="pol-assign-chips" data-idx="${i}" data-kind="${kind}"></div>
|
||||||
|
<div class="pol-assign-search-wrap">
|
||||||
|
<input type="text" class="input pol-assign-search" data-idx="${i}" data-kind="${kind}" placeholder="Gruppe suchen…" autocomplete="off">
|
||||||
|
<div class="pol-assign-dropdown hidden" data-idx="${i}" data-kind="${kind}"></div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
`).join('')}
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
`).join('');
|
||||||
|
PolAssignState.policies.forEach((_, i) => {
|
||||||
|
renderPolAssignChips(i, 'include');
|
||||||
|
renderPolAssignChips(i, 'exclude');
|
||||||
|
});
|
||||||
|
updatePolAssignInfo();
|
||||||
|
}
|
||||||
|
|
||||||
|
function renderPolAssignChips(idx, kind) {
|
||||||
|
const box = document.querySelector(`.pol-assign-chips[data-idx="${idx}"][data-kind="${kind}"]`);
|
||||||
|
if (!box) return;
|
||||||
|
const arr = PolAssignState.policies[idx][kind];
|
||||||
|
box.innerHTML = arr.map((g, j) => `
|
||||||
|
<span class="pol-assign-chip ${kind === 'exclude' ? 'exclude' : ''}">
|
||||||
|
${escapeHtml(g.name)}
|
||||||
|
<button type="button" data-idx="${idx}" data-kind="${kind}" data-j="${j}" title="Entfernen">×</button>
|
||||||
|
</span>
|
||||||
|
`).join('');
|
||||||
|
updatePolAssignInfo();
|
||||||
|
}
|
||||||
|
|
||||||
|
function updatePolAssignInfo() {
|
||||||
|
const info = document.getElementById('polAssignInfo');
|
||||||
|
if (!info) return;
|
||||||
|
const n = PolAssignState.policies.filter(p => p.include.length || p.exclude.length).length;
|
||||||
|
info.textContent = n ? `${n} Policy(s) mit Zuweisung` : 'Keine Zuweisung gewählt';
|
||||||
|
}
|
||||||
|
|
||||||
|
let _polAssignSearchTimer = null;
|
||||||
|
function polAssignHideDropdowns() {
|
||||||
|
document.querySelectorAll('.pol-assign-dropdown').forEach(d => { d.classList.add('hidden'); d.innerHTML = ''; });
|
||||||
|
}
|
||||||
|
|
||||||
|
// Suche (debounced) — Event-Delegation auf der Liste.
|
||||||
|
document.getElementById('polAssignList')?.addEventListener('input', e => {
|
||||||
|
const input = e.target.closest('.pol-assign-search');
|
||||||
|
if (!input) return;
|
||||||
|
const idx = input.dataset.idx, kind = input.dataset.kind;
|
||||||
|
const dd = document.querySelector(`.pol-assign-dropdown[data-idx="${idx}"][data-kind="${kind}"]`);
|
||||||
|
const q = input.value.trim();
|
||||||
|
clearTimeout(_polAssignSearchTimer);
|
||||||
|
if (q.length < 2) { if (dd) { dd.classList.add('hidden'); dd.innerHTML = ''; } return; }
|
||||||
|
if (dd) { dd.classList.remove('hidden'); dd.innerHTML = '<div class="msg">Suche…</div>'; }
|
||||||
|
_polAssignSearchTimer = setTimeout(async () => {
|
||||||
|
try {
|
||||||
|
const data = await api(`/api/groups/search?q=${encodeURIComponent(q)}`);
|
||||||
|
const items = (data.items || []).slice(0, 25);
|
||||||
|
if (!dd) return;
|
||||||
|
if (!items.length) { dd.innerHTML = '<div class="msg">Keine Gruppen gefunden.</div>'; return; }
|
||||||
|
dd.innerHTML = items.map(g => `
|
||||||
|
<div class="opt" data-id="${escapeHtml(g.Id)}" data-name="${escapeHtml(g.DisplayName)}">
|
||||||
|
<div>${escapeHtml(g.DisplayName)}</div>
|
||||||
|
${g.Description ? `<div class="desc">${escapeHtml(g.Description)}</div>` : ''}
|
||||||
|
</div>`).join('');
|
||||||
|
} catch (err) {
|
||||||
|
if (dd) dd.innerHTML = `<div class="msg">Suche fehlgeschlagen: ${escapeHtml(err.message)}</div>`;
|
||||||
|
}
|
||||||
|
}, 300);
|
||||||
|
});
|
||||||
|
|
||||||
|
// Klick auf ein Suchergebnis -> als Chip hinzufügen. Klick auf Chip-× -> entfernen.
|
||||||
|
document.getElementById('polAssignList')?.addEventListener('click', e => {
|
||||||
|
const opt = e.target.closest('.pol-assign-dropdown .opt');
|
||||||
|
if (opt) {
|
||||||
|
const dd = opt.closest('.pol-assign-dropdown');
|
||||||
|
const idx = +dd.dataset.idx, kind = dd.dataset.kind;
|
||||||
|
const id = opt.dataset.id, name = opt.dataset.name;
|
||||||
|
const p = PolAssignState.policies[idx];
|
||||||
|
const other = kind === 'include' ? 'exclude' : 'include';
|
||||||
|
// Nicht doppelt, und nicht gleichzeitig include+exclude derselben Gruppe.
|
||||||
|
if (!p[kind].some(g => g.id === id) && !p[other].some(g => g.id === id)) {
|
||||||
|
p[kind].push({ id, name });
|
||||||
|
renderPolAssignChips(idx, kind);
|
||||||
|
}
|
||||||
|
const input = document.querySelector(`.pol-assign-search[data-idx="${idx}"][data-kind="${kind}"]`);
|
||||||
|
if (input) input.value = '';
|
||||||
|
dd.classList.add('hidden'); dd.innerHTML = '';
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
const rm = e.target.closest('.pol-assign-chip button');
|
||||||
|
if (rm) {
|
||||||
|
const idx = +rm.dataset.idx, kind = rm.dataset.kind, j = +rm.dataset.j;
|
||||||
|
PolAssignState.policies[idx][kind].splice(j, 1);
|
||||||
|
renderPolAssignChips(idx, kind);
|
||||||
|
}
|
||||||
|
});
|
||||||
|
document.addEventListener('click', e => {
|
||||||
|
if (!e.target.closest('.pol-assign-search-wrap')) polAssignHideDropdowns();
|
||||||
|
});
|
||||||
|
|
||||||
|
document.getElementById('polAssignApply')?.addEventListener('click', async () => {
|
||||||
|
const items = PolAssignState.policies
|
||||||
|
.filter(p => p.include.length || p.exclude.length)
|
||||||
|
.map(p => ({
|
||||||
|
exportType: p.exportType,
|
||||||
|
id: p.id,
|
||||||
|
policyName: p.name,
|
||||||
|
include: p.include.map(g => g.id),
|
||||||
|
exclude: p.exclude.map(g => g.id),
|
||||||
|
}));
|
||||||
|
if (!items.length) { closeModal('modalPolAssign'); return; }
|
||||||
|
setLoading('Weise Gruppen zu…');
|
||||||
|
try {
|
||||||
|
const res = await api('/api/policies/assign', { method: 'POST', body: { items }, timeoutMs: 120000 });
|
||||||
|
const results = res.results || [];
|
||||||
|
const fail = results.filter(r => !r.success);
|
||||||
|
if (fail.length) {
|
||||||
|
const first = fail[0];
|
||||||
|
toast(`${res.assignedCount || 0} zugewiesen, ${fail.length} fehlgeschlagen. z.B. "${first.policyName || '?'}": ${first.error || 'Fehler'}`, 'err', 'Zuweisung');
|
||||||
|
} else {
|
||||||
|
toast(`${res.assignedCount || 0} Policy(s) zugewiesen.`, 'ok', 'Zuweisung');
|
||||||
|
}
|
||||||
|
closeModal('modalPolAssign');
|
||||||
|
} catch (e) {
|
||||||
|
toast('Zuweisung fehlgeschlagen: ' + e.message, 'err');
|
||||||
|
} finally {
|
||||||
|
clearLoading();
|
||||||
|
}
|
||||||
|
});
|
||||||
|
|
||||||
|
// Alle Policies als Snapshot in den konfigurierten Git-Ordner schreiben + committen.
|
||||||
|
async function polGitSnapshot() {
|
||||||
|
setLoading('Erstelle Policy-Snapshot & committe…');
|
||||||
|
try {
|
||||||
|
const res = await api('/api/policies/git-snapshot', { method: 'POST', timeoutMs: 300000 });
|
||||||
|
if (res.changed === false) {
|
||||||
|
toast(res.message || 'Keine Änderungen seit dem letzten Snapshot.', 'info', 'Git-Snapshot');
|
||||||
|
} else {
|
||||||
|
let msg = res.message || `Snapshot committet (${res.total} Policies).`;
|
||||||
|
if (res.pushError) msg += ` — Push-Fehler: ${res.pushError}`;
|
||||||
|
toast(msg, res.pushError ? 'warn' : 'ok', 'Git-Snapshot');
|
||||||
|
}
|
||||||
|
} catch (e) {
|
||||||
|
toast('Snapshot fehlgeschlagen: ' + e.message, 'err');
|
||||||
|
} finally {
|
||||||
|
clearLoading();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Ordner-Auswahl für den Git-Repo-Pfad (Einstellungen).
|
||||||
|
async function pickPolicyGitFolder() {
|
||||||
|
try {
|
||||||
|
const res = await api('/api/pickfolder', { method: 'POST', body: { title: 'Git-Repo-Ordner für Policy-Backup wählen' } });
|
||||||
|
if (res && res.path) document.getElementById('setPolicyGitPath').value = res.path;
|
||||||
|
} catch (e) {
|
||||||
|
toast('Ordner-Auswahl fehlgeschlagen: ' + e.message, 'err');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
document.getElementById('btnPickPolicyGit')?.addEventListener('click', pickPolicyGitFolder);
|
||||||
|
|
||||||
// --- Policies: Event-Wiring ---
|
// --- Policies: Event-Wiring ---
|
||||||
document.getElementById('btnPolRefresh')?.addEventListener('click', loadPolicies);
|
document.getElementById('btnPolRefresh')?.addEventListener('click', loadPolicies);
|
||||||
|
document.getElementById('btnPolGitSnapshot')?.addEventListener('click', polGitSnapshot);
|
||||||
document.getElementById('btnPolExport')?.addEventListener('click', polExportSelected);
|
document.getElementById('btnPolExport')?.addEventListener('click', polExportSelected);
|
||||||
document.getElementById('btnPolImport')?.addEventListener('click', () => document.getElementById('polImportFile').click());
|
document.getElementById('btnPolImport')?.addEventListener('click', () => document.getElementById('polImportFile').click());
|
||||||
document.getElementById('polImportFile')?.addEventListener('change', e => {
|
document.getElementById('polImportFile')?.addEventListener('change', e => {
|
||||||
@@ -5959,3 +6218,172 @@ document.querySelectorAll('#polTable th.sortable').forEach(th => {
|
|||||||
renderPolicies();
|
renderPolicies();
|
||||||
});
|
});
|
||||||
});
|
});
|
||||||
|
|
||||||
|
// =============================================================
|
||||||
|
// OFFBOARDING: Geräte aus Intune / Autopilot / Entra entfernen
|
||||||
|
// =============================================================
|
||||||
|
const OffState = { items: [], selected: new Set() };
|
||||||
|
function offKey(d) { return d.intuneDeviceId; }
|
||||||
|
function offSelectedDevices() { return OffState.items.filter(d => OffState.selected.has(offKey(d))); }
|
||||||
|
|
||||||
|
async function offSearch() {
|
||||||
|
const q = document.getElementById('offSearch').value.trim();
|
||||||
|
const type = document.getElementById('offSearchType').value;
|
||||||
|
if (q.length < 2) { toast('Mindestens 2 Zeichen.', 'warn'); return; }
|
||||||
|
const body = document.getElementById('offBody');
|
||||||
|
body.innerHTML = `<tr><td colspan="7" class="pol-hint"><span class="spinner" style="width:14px;height:14px;border-width:2px;"></span> Suche…</td></tr>`;
|
||||||
|
try {
|
||||||
|
const res = await api(`/api/offboard/search?query=${encodeURIComponent(q)}&type=${type}`, { timeoutMs: 60000 });
|
||||||
|
OffState.items = res.items || [];
|
||||||
|
OffState.selected = new Set();
|
||||||
|
renderOff();
|
||||||
|
} catch (e) {
|
||||||
|
toast('Suche fehlgeschlagen: ' + e.message, 'err');
|
||||||
|
body.innerHTML = `<tr><td colspan="7" class="pol-empty">Fehler bei der Suche.</td></tr>`;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function offSvcBadges(d) {
|
||||||
|
const b = [];
|
||||||
|
if (d.inIntune) b.push('<span class="off-badge">Intune</span>');
|
||||||
|
if (d.inEntra) b.push('<span class="off-badge">Entra</span>');
|
||||||
|
if (d.inAutopilot) b.push('<span class="off-badge">Autopilot</span>');
|
||||||
|
if (d.coManaged) b.push('<span class="off-badge warn">Co-Mgmt</span>');
|
||||||
|
return b.join(' ') || '—';
|
||||||
|
}
|
||||||
|
|
||||||
|
function renderOff() {
|
||||||
|
const body = document.getElementById('offBody');
|
||||||
|
if (!OffState.items.length) {
|
||||||
|
body.innerHTML = `<tr><td colspan="7" class="pol-empty">Keine Geräte gefunden.</td></tr>`;
|
||||||
|
offUpdateSel();
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
body.innerHTML = OffState.items.map(d => {
|
||||||
|
const k = offKey(d);
|
||||||
|
const checked = OffState.selected.has(k) ? 'checked' : '';
|
||||||
|
return `<tr data-key="${escapeHtml(k)}">
|
||||||
|
<td><input type="checkbox" class="off-row-check" data-key="${escapeHtml(k)}" ${checked}></td>
|
||||||
|
<td>${escapeHtml(d.deviceName || '—')}</td>
|
||||||
|
<td>${escapeHtml(d.serialNumber || '—')}</td>
|
||||||
|
<td>${escapeHtml(((d.operatingSystem || '') + ' ' + (d.osVersion || '')).trim() || '—')}</td>
|
||||||
|
<td>${escapeHtml(d.primaryUser || '—')}</td>
|
||||||
|
<td>${polFmtDate(d.lastSync)}</td>
|
||||||
|
<td>${offSvcBadges(d)}</td>
|
||||||
|
</tr>`;
|
||||||
|
}).join('');
|
||||||
|
body.querySelectorAll('.off-row-check').forEach(cb => {
|
||||||
|
cb.addEventListener('change', () => {
|
||||||
|
if (cb.checked) OffState.selected.add(cb.dataset.key); else OffState.selected.delete(cb.dataset.key);
|
||||||
|
offUpdateSel();
|
||||||
|
});
|
||||||
|
});
|
||||||
|
body.querySelectorAll('tr[data-key]').forEach(tr => {
|
||||||
|
tr.addEventListener('click', e => {
|
||||||
|
if (e.target.classList.contains('off-row-check')) return;
|
||||||
|
const cb = tr.querySelector('.off-row-check');
|
||||||
|
cb.checked = !cb.checked;
|
||||||
|
cb.dispatchEvent(new Event('change'));
|
||||||
|
});
|
||||||
|
});
|
||||||
|
offUpdateSel();
|
||||||
|
}
|
||||||
|
|
||||||
|
function offUpdateSel() {
|
||||||
|
const n = OffState.selected.size;
|
||||||
|
document.getElementById('offSelCount').textContent = `${n} ausgewählt`;
|
||||||
|
document.getElementById('offBtn').disabled = n === 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
function openOffboardModal() {
|
||||||
|
const devs = offSelectedDevices();
|
||||||
|
if (!devs.length) return;
|
||||||
|
document.getElementById('offConfirmList').innerHTML = devs.map(d => `
|
||||||
|
<div class="off-confirm-row"><b>${escapeHtml(d.deviceName || '—')}</b>
|
||||||
|
— Intune: ${d.intuneDeviceId ? '✓' : '–'}, Entra: ${d.entraObjectId ? '✓' : '–'}, Autopilot: ${d.autopilotId ? '✓' : '–'}</div>
|
||||||
|
`).join('');
|
||||||
|
document.getElementById('offModalInfo').textContent = `${devs.length} Gerät(e)`;
|
||||||
|
document.getElementById('offConfirmChk').checked = false;
|
||||||
|
document.getElementById('offExecuteBtn').disabled = true;
|
||||||
|
document.getElementById('offResults').innerHTML = '';
|
||||||
|
document.getElementById('offKeys').innerHTML = '<div class="lbl">Recovery-Keys</div><div class="muted">Wird geladen…</div>';
|
||||||
|
openModal('modalOffboard');
|
||||||
|
offLoadKeys(devs);
|
||||||
|
}
|
||||||
|
|
||||||
|
async function offLoadKeys(devs) {
|
||||||
|
const box = document.getElementById('offKeys');
|
||||||
|
const parts = [];
|
||||||
|
for (const d of devs) {
|
||||||
|
try {
|
||||||
|
const res = await api('/api/offboard/keys', {
|
||||||
|
method: 'POST',
|
||||||
|
body: { intuneDeviceId: d.intuneDeviceId, azureADDeviceId: d.azureADDeviceId, operatingSystem: d.operatingSystem },
|
||||||
|
timeoutMs: 60000,
|
||||||
|
});
|
||||||
|
const k = res.keys || {};
|
||||||
|
let html = `<div class="off-key-dev"><b>${escapeHtml(d.deviceName || '—')}</b>`;
|
||||||
|
(k.bitlocker || []).forEach(b => { html += `<div class="off-key">BitLocker${b.volumeType ? ' (' + escapeHtml(b.volumeType) + ')' : ''}: <code>${escapeHtml(b.key)}</code></div>`; });
|
||||||
|
if (k.fileVault) html += `<div class="off-key">FileVault: <code>${escapeHtml(k.fileVault)}</code></div>`;
|
||||||
|
if (k.laps) html += `<div class="off-key">LAPS${k.laps.account ? ' (' + escapeHtml(k.laps.account) + ')' : ''}: <code>${escapeHtml(k.laps.password)}</code></div>`;
|
||||||
|
if (k.notes && k.notes.length) html += `<div class="muted">${k.notes.map(escapeHtml).join(' · ')}</div>`;
|
||||||
|
html += '</div>';
|
||||||
|
parts.push(html);
|
||||||
|
} catch (e) {
|
||||||
|
parts.push(`<div class="off-key-dev"><b>${escapeHtml(d.deviceName || '—')}</b> <span class="muted">Keys-Fehler: ${escapeHtml(e.message)}</span></div>`);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
box.innerHTML = `<div class="lbl">🔑 Recovery-Keys — vor dem Löschen sichern!</div>${parts.join('')}`;
|
||||||
|
}
|
||||||
|
|
||||||
|
async function offExecute() {
|
||||||
|
const devs = offSelectedDevices();
|
||||||
|
if (!devs.length) return;
|
||||||
|
const services = {
|
||||||
|
entra: document.querySelector('input[name="offEntra"]:checked').value,
|
||||||
|
intune: document.getElementById('offSvcIntune').checked,
|
||||||
|
autopilot: document.getElementById('offSvcAutopilot').checked,
|
||||||
|
};
|
||||||
|
if (services.entra === 'none' && !services.intune && !services.autopilot) {
|
||||||
|
toast('Keinen Dienst ausgewählt.', 'warn');
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
const payload = devs.map(d => ({
|
||||||
|
deviceName: d.deviceName, intuneDeviceId: d.intuneDeviceId,
|
||||||
|
entraObjectId: d.entraObjectId, autopilotId: d.autopilotId,
|
||||||
|
}));
|
||||||
|
document.getElementById('offExecuteBtn').disabled = true;
|
||||||
|
setLoading('Offboarding läuft…');
|
||||||
|
try {
|
||||||
|
const res = await api('/api/offboard/execute', { method: 'POST', body: { devices: payload, services }, timeoutMs: 180000 });
|
||||||
|
const results = res.results || [];
|
||||||
|
document.getElementById('offResults').innerHTML =
|
||||||
|
`<div class="lbl">Ergebnis (${res.successCount}/${res.total})</div>` +
|
||||||
|
results.map(r => `<div class="off-result ${r.success ? 'ok' : 'fail'}">${r.success ? '✓' : '✗'} ${escapeHtml(r.deviceName)} — ${escapeHtml(r.service)} ${escapeHtml(r.action)}${r.error ? ': ' + escapeHtml(r.error) : ''}</div>`).join('');
|
||||||
|
toast(`${res.successCount}/${res.total} Aktionen erfolgreich.`, res.successCount === res.total ? 'ok' : 'warn', 'Offboarding');
|
||||||
|
// Erfolgreich vollständig offgeboardete Geräte aus der Liste nehmen.
|
||||||
|
const doneNames = new Set(results.filter(r => r.success).map(r => r.deviceName));
|
||||||
|
if (doneNames.size) {
|
||||||
|
OffState.items = OffState.items.filter(d => !doneNames.has(d.deviceName) || results.some(r => r.deviceName === d.deviceName && !r.success));
|
||||||
|
OffState.selected = new Set();
|
||||||
|
renderOff();
|
||||||
|
}
|
||||||
|
} catch (e) {
|
||||||
|
toast('Offboarding fehlgeschlagen: ' + e.message, 'err');
|
||||||
|
document.getElementById('offExecuteBtn').disabled = false;
|
||||||
|
} finally {
|
||||||
|
clearLoading();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
document.getElementById('offSearchBtn')?.addEventListener('click', offSearch);
|
||||||
|
document.getElementById('offSearch')?.addEventListener('keydown', e => { if (e.key === 'Enter') offSearch(); });
|
||||||
|
document.getElementById('offCheckAll')?.addEventListener('change', e => {
|
||||||
|
OffState.items.forEach(d => { const k = offKey(d); if (e.target.checked) OffState.selected.add(k); else OffState.selected.delete(k); });
|
||||||
|
renderOff();
|
||||||
|
});
|
||||||
|
document.getElementById('offBtn')?.addEventListener('click', openOffboardModal);
|
||||||
|
document.getElementById('offConfirmChk')?.addEventListener('change', e => {
|
||||||
|
document.getElementById('offExecuteBtn').disabled = !e.target.checked;
|
||||||
|
});
|
||||||
|
document.getElementById('offExecuteBtn')?.addEventListener('click', offExecute);
|
||||||
|
|||||||
+203
@@ -37,6 +37,7 @@
|
|||||||
<button class="nav-tab" data-view="report" aria-selected="false">App Report</button>
|
<button class="nav-tab" data-view="report" aria-selected="false">App Report</button>
|
||||||
<button class="nav-tab" data-view="devices" aria-selected="false">Geräte</button>
|
<button class="nav-tab" data-view="devices" aria-selected="false">Geräte</button>
|
||||||
<button class="nav-tab" data-view="policies" aria-selected="false">Policies</button>
|
<button class="nav-tab" data-view="policies" aria-selected="false">Policies</button>
|
||||||
|
<button class="nav-tab" data-view="offboard" aria-selected="false">Offboarding</button>
|
||||||
</nav>
|
</nav>
|
||||||
|
|
||||||
<div class="header-actions">
|
<div class="header-actions">
|
||||||
@@ -572,6 +573,7 @@
|
|||||||
<option value="settingscatalog">Settings Catalog</option>
|
<option value="settingscatalog">Settings Catalog</option>
|
||||||
<option value="compliance">Compliance</option>
|
<option value="compliance">Compliance</option>
|
||||||
<option value="configuration">Konfigurationsprofil</option>
|
<option value="configuration">Konfigurationsprofil</option>
|
||||||
|
<option value="administrativetemplate">Administrative Vorlage</option>
|
||||||
</select>
|
</select>
|
||||||
<span class="pol-toolbar-spacer" style="flex:1;"></span>
|
<span class="pol-toolbar-spacer" style="flex:1;"></span>
|
||||||
<button class="btn btn-secondary btn-sm" id="btnPolRefresh" title="Policies neu laden">
|
<button class="btn btn-secondary btn-sm" id="btnPolRefresh" title="Policies neu laden">
|
||||||
@@ -583,6 +585,10 @@
|
|||||||
Import…
|
Import…
|
||||||
</button>
|
</button>
|
||||||
<input type="file" id="polImportFile" accept=".json,application/json" multiple style="display:none;">
|
<input type="file" id="polImportFile" accept=".json,application/json" multiple style="display:none;">
|
||||||
|
<button class="btn btn-secondary btn-sm" id="btnPolGitSnapshot" title="Alle Policies als Snapshot in den konfigurierten Git-Ordner schreiben und committen">
|
||||||
|
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><circle cx="12" cy="12" r="3"/><line x1="12" y1="3" x2="12" y2="9"/><line x1="12" y1="15" x2="12" y2="21"/><circle cx="12" cy="3" r="1"/><circle cx="12" cy="21" r="1"/></svg>
|
||||||
|
Git-Snapshot
|
||||||
|
</button>
|
||||||
<button class="btn btn-primary btn-sm" id="btnPolExport" disabled title="Ausgewählte Policies als JSON exportieren">
|
<button class="btn btn-primary btn-sm" id="btnPolExport" disabled title="Ausgewählte Policies als JSON exportieren">
|
||||||
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
|
<svg width="13" height="13" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4"/><polyline points="7 10 12 15 17 10"/><line x1="12" y1="15" x2="12" y2="3"/></svg>
|
||||||
Export (<span id="polSelCount">0</span>)
|
Export (<span id="polSelCount">0</span>)
|
||||||
@@ -606,6 +612,44 @@
|
|||||||
</div>
|
</div>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
|
<!-- ======================= OFFBOARDING ======================= -->
|
||||||
|
<section class="off-view hidden" id="offView">
|
||||||
|
<div class="off-bar">
|
||||||
|
<select id="offSearchType" class="input" style="height:34px;max-width:170px;">
|
||||||
|
<option value="name">Gerätename</option>
|
||||||
|
<option value="serial">Seriennummer</option>
|
||||||
|
</select>
|
||||||
|
<input id="offSearch" class="input" placeholder="Suchen… (Enter)" style="max-width:320px;height:34px;">
|
||||||
|
<button class="btn btn-secondary btn-sm" id="offSearchBtn">Suchen</button>
|
||||||
|
<span class="off-bar-spacer" style="flex:1;"></span>
|
||||||
|
<span id="offSelCount" class="muted">0 ausgewählt</span>
|
||||||
|
<button class="btn btn-danger btn-sm" id="offBtn" disabled>Offboarding…</button>
|
||||||
|
</div>
|
||||||
|
<div class="off-note muted">
|
||||||
|
Entfernt Geräte aus <b>Intune</b>, <b>Autopilot</b> und <b>Entra ID</b>. BitLocker-/FileVault-Keys und
|
||||||
|
LAPS-Passwörter werden vor dem Löschen angezeigt. Benötigt zusätzliche Berechtigungen & Admin-Rollen
|
||||||
|
(siehe <code>docs/App-Registration.md</code>) — im Read-Only-Modus gesperrt.
|
||||||
|
</div>
|
||||||
|
<div class="off-table-wrap">
|
||||||
|
<table class="pol-table off-table" id="offTable">
|
||||||
|
<thead>
|
||||||
|
<tr>
|
||||||
|
<th style="width:34px;"><input type="checkbox" id="offCheckAll"></th>
|
||||||
|
<th>Gerät</th>
|
||||||
|
<th>Seriennr.</th>
|
||||||
|
<th>OS</th>
|
||||||
|
<th>Benutzer</th>
|
||||||
|
<th>Letzter Sync</th>
|
||||||
|
<th>Dienste</th>
|
||||||
|
</tr>
|
||||||
|
</thead>
|
||||||
|
<tbody id="offBody">
|
||||||
|
<tr><td colspan="7" class="pol-hint">Nach Geräten suchen…</td></tr>
|
||||||
|
</tbody>
|
||||||
|
</table>
|
||||||
|
</div>
|
||||||
|
</section>
|
||||||
|
|
||||||
<!-- MODAL: Wipe -->
|
<!-- MODAL: Wipe -->
|
||||||
<div class="modal-backdrop hidden" id="wipeModalBackdrop">
|
<div class="modal-backdrop hidden" id="wipeModalBackdrop">
|
||||||
<div class="modal" style="max-width:420px;">
|
<div class="modal" style="max-width:420px;">
|
||||||
@@ -808,6 +852,146 @@
|
|||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|
||||||
|
<!-- MODAL: Policy-Import (optional umbenennen) -->
|
||||||
|
<div id="modalPolImport" class="modal hidden">
|
||||||
|
<div class="modal-backdrop" data-close></div>
|
||||||
|
<div class="modal-box modal-lg">
|
||||||
|
<div class="modal-head">
|
||||||
|
<h3>Policies importieren</h3>
|
||||||
|
<button class="modal-close" data-close aria-label="Schließen">×</button>
|
||||||
|
</div>
|
||||||
|
<div class="modal-body">
|
||||||
|
<div class="form-hint" style="margin-bottom:12px;">
|
||||||
|
Namen können vor dem Import angepasst werden. Die Policies werden als
|
||||||
|
<b>Neuanlage</b> im verbundenen Tenant erstellt — bestehende bleiben unverändert.
|
||||||
|
</div>
|
||||||
|
<div id="polImportList"></div>
|
||||||
|
</div>
|
||||||
|
<div class="modal-foot">
|
||||||
|
<span id="polImportInfo" class="muted" style="margin-right:auto;"></span>
|
||||||
|
<button class="btn btn-secondary" data-close>Abbrechen</button>
|
||||||
|
<button class="btn btn-primary" id="polImportConfirm">Importieren</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- MODAL: Policy-Zuweisung nach Import -->
|
||||||
|
<div id="modalPolAssign" class="modal hidden">
|
||||||
|
<div class="modal-backdrop" data-close></div>
|
||||||
|
<div class="modal-box modal-lg">
|
||||||
|
<div class="modal-head">
|
||||||
|
<h3>Importierte Policies zuweisen</h3>
|
||||||
|
<button class="modal-close" data-close aria-label="Schließen">×</button>
|
||||||
|
</div>
|
||||||
|
<div class="modal-body">
|
||||||
|
<div class="form-hint" style="margin-bottom:12px;">
|
||||||
|
Optional: jeder importierten Policy Include- und/oder Exclude-Gruppen im aktuellen Tenant zuweisen.
|
||||||
|
Felder leer lassen = keine Zuweisung. Original-Zuweisungen des Quell-Tenants werden nicht übernommen.
|
||||||
|
</div>
|
||||||
|
<div id="polAssignList"></div>
|
||||||
|
</div>
|
||||||
|
<div class="modal-foot">
|
||||||
|
<span id="polAssignInfo" class="muted" style="margin-right:auto;"></span>
|
||||||
|
<button class="btn btn-secondary" data-close>Überspringen</button>
|
||||||
|
<button class="btn btn-primary" id="polAssignApply">Zuweisen</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<!-- MODAL: Geräte-Offboarding -->
|
||||||
|
<div id="modalOffboard" class="modal hidden">
|
||||||
|
<div class="modal-backdrop" data-close></div>
|
||||||
|
<div class="modal-box modal-lg">
|
||||||
|
<div class="modal-head">
|
||||||
|
<h3>Geräte offboarden</h3>
|
||||||
|
<button class="modal-close" data-close aria-label="Schließen">×</button>
|
||||||
|
</div>
|
||||||
|
<div class="modal-body">
|
||||||
|
<div class="off-warn">⚠ Entfernt die Geräte aus den gewählten Diensten. Löschen ist <b>nicht umkehrbar</b>. Recovery-Keys unbedingt vorher sichern.</div>
|
||||||
|
<div id="offConfirmList" class="off-confirm-list"></div>
|
||||||
|
|
||||||
|
<div class="off-services">
|
||||||
|
<div class="lbl">Dienste</div>
|
||||||
|
<div class="off-svc-row">
|
||||||
|
<span class="off-svc-label">Entra ID:</span>
|
||||||
|
<label class="off-radio"><input type="radio" name="offEntra" value="none" checked> nichts tun</label>
|
||||||
|
<label class="off-radio"><input type="radio" name="offEntra" value="disable"> deaktivieren</label>
|
||||||
|
<label class="off-radio"><input type="radio" name="offEntra" value="delete"> löschen</label>
|
||||||
|
</div>
|
||||||
|
<label class="check-chip"><input type="checkbox" id="offSvcIntune" checked><span>Aus Intune löschen</span></label>
|
||||||
|
<label class="check-chip"><input type="checkbox" id="offSvcAutopilot"><span>Aus Autopilot löschen</span></label>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div id="offKeys" class="off-keys"></div>
|
||||||
|
|
||||||
|
<label class="check-chip off-confirm-chip"><input type="checkbox" id="offConfirmChk"><span>Ich verstehe, dass die Geräte gelöscht/entfernt werden.</span></label>
|
||||||
|
<div id="offResults"></div>
|
||||||
|
</div>
|
||||||
|
<div class="modal-foot">
|
||||||
|
<span id="offModalInfo" class="muted" style="margin-right:auto;"></span>
|
||||||
|
<button class="btn btn-secondary" data-close>Abbrechen</button>
|
||||||
|
<button class="btn btn-danger" id="offExecuteBtn" disabled>Offboarding ausführen</button>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
<style>
|
||||||
|
/* Nutzt die Theme-Variablen der App -> passt sich Light/Dark automatisch an. */
|
||||||
|
.pol-assign-row { border:1px solid var(--hairline); border-radius:8px; padding:12px 14px; margin-bottom:12px; overflow-wrap:anywhere; }
|
||||||
|
.pol-assign-head { display:flex; align-items:baseline; gap:8px; margin-bottom:10px; flex-wrap:wrap; }
|
||||||
|
.pol-assign-head .pol-name { font-weight:600; color:var(--ink); min-width:0; word-break:break-word; overflow-wrap:anywhere; }
|
||||||
|
.pol-assign-head .pol-type-badge { flex:0 0 auto; }
|
||||||
|
.pol-assign-pickers { display:flex; gap:16px; flex-wrap:wrap; }
|
||||||
|
.pol-assign-picker { flex:1; min-width:220px; }
|
||||||
|
.pol-assign-picker > .lbl { display:block; font-size:12px; margin-bottom:4px; color:var(--body); }
|
||||||
|
.pol-assign-picker[data-kind="exclude"] > .lbl { color:var(--pink); }
|
||||||
|
.pol-assign-chips { display:flex; flex-wrap:wrap; gap:6px; margin-bottom:6px; }
|
||||||
|
.pol-assign-chip { display:inline-flex; align-items:center; gap:6px; padding:2px 8px; border-radius:12px;
|
||||||
|
background:var(--surface-strong); color:var(--ink); font-size:12px; }
|
||||||
|
.pol-assign-chip.exclude { background:rgba(236,72,153,0.18); color:var(--ink); }
|
||||||
|
.pol-assign-chip button { border:none; background:none; cursor:pointer; font-size:14px; line-height:1; padding:0; color:var(--muted); }
|
||||||
|
.pol-assign-chip button:hover { color:var(--ink); }
|
||||||
|
.pol-assign-search-wrap { position:relative; }
|
||||||
|
.pol-assign-dropdown { position:absolute; z-index:20; left:0; right:0; top:100%; margin-top:2px;
|
||||||
|
background:var(--canvas); border:1px solid var(--hairline); border-radius:6px;
|
||||||
|
max-height:200px; overflow-y:auto; box-shadow:0 6px 18px rgba(0,0,0,.25); }
|
||||||
|
.pol-assign-dropdown .opt { padding:6px 10px; cursor:pointer; font-size:13px; color:var(--body); }
|
||||||
|
.pol-assign-dropdown .opt:hover { background:var(--surface-soft); }
|
||||||
|
.pol-assign-dropdown .opt .desc { font-size:11px; color:var(--muted); }
|
||||||
|
.pol-assign-dropdown .msg { padding:6px 10px; font-size:12px; color:var(--muted); }
|
||||||
|
.pol-import-row { display:flex; align-items:center; gap:10px; padding:8px 0; border-bottom:1px solid var(--hairline); }
|
||||||
|
.pol-import-row:last-child { border-bottom:none; }
|
||||||
|
.pol-import-name { flex:1; min-width:0; }
|
||||||
|
.pol-import-row .pol-type-badge { flex:0 0 auto; }
|
||||||
|
/* Offboarding */
|
||||||
|
.off-view { padding:16px 20px; }
|
||||||
|
.off-bar { display:flex; align-items:center; gap:10px; margin-bottom:10px; flex-wrap:wrap; }
|
||||||
|
.off-note { font-size:12.5px; margin-bottom:12px; line-height:1.5; }
|
||||||
|
.off-table-wrap { overflow-x:auto; }
|
||||||
|
.off-table td, .off-table th { white-space:nowrap; }
|
||||||
|
.off-badge { display:inline-block; padding:1px 7px; border-radius:10px; font-size:11px; background:var(--surface-strong); color:var(--ink); margin-right:3px; }
|
||||||
|
.off-badge.warn { background:rgba(245,158,11,0.22); }
|
||||||
|
.off-warn { background:rgba(239,68,68,0.14); border:1px solid rgba(239,68,68,0.35); color:var(--ink);
|
||||||
|
border-radius:8px; padding:10px 12px; font-size:13px; margin-bottom:12px; }
|
||||||
|
.off-confirm-list { margin-bottom:12px; }
|
||||||
|
.off-confirm-row { font-size:13px; padding:4px 0; border-bottom:1px solid var(--hairline); overflow-wrap:anywhere; }
|
||||||
|
.off-confirm-row:last-child { border-bottom:none; }
|
||||||
|
.off-services { margin:12px 0; padding:12px; border:1px solid var(--hairline); border-radius:8px; }
|
||||||
|
.off-services .lbl { display:block; font-size:12px; color:var(--body); margin-bottom:8px; }
|
||||||
|
.off-svc-row { display:flex; align-items:center; gap:14px; flex-wrap:wrap; margin-bottom:10px; }
|
||||||
|
.off-svc-label { font-size:13px; color:var(--ink); font-weight:600; }
|
||||||
|
.off-radio { display:inline-flex; align-items:center; gap:5px; font-size:13px; cursor:pointer; }
|
||||||
|
.off-keys { margin:12px 0; }
|
||||||
|
.off-keys .lbl { display:block; font-size:12px; color:var(--pink); margin-bottom:6px; }
|
||||||
|
.off-key-dev { border:1px solid var(--hairline); border-radius:6px; padding:8px 10px; margin-bottom:6px; font-size:12.5px; overflow-wrap:anywhere; }
|
||||||
|
.off-key { margin-top:3px; }
|
||||||
|
.off-key code { background:var(--surface-strong); color:var(--ink); padding:1px 5px; border-radius:4px; user-select:all; }
|
||||||
|
.off-confirm-chip { margin-top:8px; }
|
||||||
|
.off-result { font-size:13px; padding:3px 0; overflow-wrap:anywhere; }
|
||||||
|
.off-result.ok { color:var(--success); }
|
||||||
|
.off-result.fail { color:var(--error); }
|
||||||
|
#offResults .lbl { display:block; font-size:12px; color:var(--body); margin:10px 0 4px; }
|
||||||
|
</style>
|
||||||
|
|
||||||
<!-- MODAL: Hilfe -->
|
<!-- MODAL: Hilfe -->
|
||||||
<div id="modalHelp" class="modal hidden">
|
<div id="modalHelp" class="modal hidden">
|
||||||
<div class="modal-backdrop" data-close></div>
|
<div class="modal-backdrop" data-close></div>
|
||||||
@@ -1033,6 +1217,25 @@
|
|||||||
<div class="form-hint">Vorschau: <code id="setAvailPreview" class="set-preview"></code></div>
|
<div class="form-hint">Vorschau: <code id="setAvailPreview" class="set-preview"></code></div>
|
||||||
</section>
|
</section>
|
||||||
|
|
||||||
|
<section class="settings-sec">
|
||||||
|
<div class="settings-sec-head">
|
||||||
|
<h4>Policy-Backup (Git)</h4>
|
||||||
|
<div class="settings-sec-sub">Lokaler Git-Ordner für Policy-Snapshots. Der „Git-Snapshot"-Button im Policies-Tab schreibt alle Policies als JSON dorthin und committet sie (optional Push).</div>
|
||||||
|
</div>
|
||||||
|
<div class="form-group">
|
||||||
|
<label class="lbl" for="setPolicyGitPath">Git-Repo-Ordner (lokal)</label>
|
||||||
|
<div class="form-row" style="gap:8px;align-items:center;">
|
||||||
|
<input type="text" id="setPolicyGitPath" class="input mono" placeholder="z. B. C:\Intune-Backup" spellcheck="false" autocomplete="off" style="flex:1;">
|
||||||
|
<button type="button" class="btn btn-secondary btn-sm" id="btnPickPolicyGit">Ordner…</button>
|
||||||
|
</div>
|
||||||
|
<div class="form-hint">Wird bei Bedarf angelegt und als Git-Repo initialisiert. Leer = Funktion deaktiviert.</div>
|
||||||
|
</div>
|
||||||
|
<div class="form-group">
|
||||||
|
<label class="check-chip"><input type="checkbox" id="setPolicyGitPush"><span>Nach dem Commit automatisch <code>git push</code></span></label>
|
||||||
|
<div class="form-hint">Nutzt deinen vorhandenen Git-Credential-Helper (Remote muss im Repo konfiguriert sein). Kein Token in der App.</div>
|
||||||
|
</div>
|
||||||
|
</section>
|
||||||
|
|
||||||
<section class="settings-sec">
|
<section class="settings-sec">
|
||||||
<div class="settings-sec-head">
|
<div class="settings-sec-head">
|
||||||
<h4>Branding — Logo</h4>
|
<h4>Branding — Logo</h4>
|
||||||
|
|||||||
Reference in New Issue
Block a user