Device Not coming in MEM portal or are with partially Workload shifted. How fix it? - azure

Question

I Tried below PowerShell.
Created a Powershell Script:
DeleteEnrollment.PS1
## Create Log
Function Write-Log
{
Param
(
[string]$Message
)
$Logfilepath = "C:\ProgramData\Microsoft\CoMgmtFixLog"
$Logfile = "C:\ProgramData\Microsoft\CoMgmtFixLog\CoMgmtFixLog.log"
If (!(Test-Path $Logfilepath))
{
New-Item -ItemType Directory -Path $Logfilepath -Force | Out-Null
}
If (!(Test-Path $Logfile))
{
New-Item -ItemType File -Path $Logfile -Force | Out-Null
}
$Stamp = (Get-Date).toString("yyyy/MM/dd HH:mm:ss")
$mgs = "$Stamp $Message"
Add-Content $Logfile -Value $mgs
}
## Create TimeStamp in Registry
Function Create-Timestamp
{
param
(
[String]$RegKeypath,
[String]$RegKeyName,
[String]$RegKeyValue
)
$ComgmtFixHive = 'HKLM:\SOFTWARE\Policies\Microsoft\CoMgmtFix'
$Step = "$ComgmtFixHive\$RegKeypath"
If (!(Test-Path $ComgmtFixHive))
{
New-Item -Path $ComgmtFixHive -Force | Out-Null
}
If(!(Test-Path $Step))
{
New-Item -Path $Step -Force | Out-Null
}
If($Step -and $RegKeyName -and $RegKeyValue)
{
New-ItemProperty -Path $Step -Name $RegKeyName -Value $RegKeyValue -PropertyType 'String' -force -ea SilentlyContinue | Out-Null
}
New-ItemProperty -Path $Step -Name 'ExecutionTimeStap' -Value (Get-Date).toString("yyyy/MM/dd HH:mm:ss") -PropertyType 'String' -force -ea SilentlyContinue | Out-Null
}
## Script Block ##
$Stamp = (Get-Date).toString("yyyy/MM/dd HH:mm:ss")
Write-Log "=========== Begining of Log - $Stamp =========="
## Retrieving Enrollment GUID
(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\*' | select Pschildname).pschildname | Out-File -FilePath 'C:\ProgramData\Microsoft\CoMgmtFixLog\EnrollmentGUID.txt'
$DeviceEnrollmentID = Get-Content 'C:\ProgramData\Microsoft\CoMgmtFixLog\EnrollmentGUID.txt'
Write-Log "Collected Enrollment GUID : $DeviceEnrollmentID"
Create-Timestamp -RegKeypath 'GetEnrollmentID' -RegKeyName 'EnrollmentID' -RegKeyValue $DeviceEnrollmentID
If (Test-Path "HKLM:\SOFTWARE\Microsoft\EnterpriseResourceManager\Tracked\$DeviceEnrollmentID")
{
Remove-Item -Path HKLM:\SOFTWARE\Microsoft\EnterpriseResourceManager\Tracked\$DeviceEnrollmentID -Recurse -Force
Write-Log "Delected : `"HKLM:\SOFTWARE\Microsoft\EnterpriseResourceManager\Tracked\$DeviceEnrollmentID`" registry."
}
If (Test-Path "HKLM:\SOFTWARE\Microsoft\Enrollments\$DeviceEnrollmentID")
{
Remove-Item -Path HKLM:\SOFTWARE\Microsoft\Enrollments\$DeviceEnrollmentID -Recurse -Force
Write-Log "Delected : `"HKLM:\SOFTWARE\Microsoft\Enrollments\$DeviceEnrollmentID`" registry."
}
## Retrieve Scheduled tasks
Write-Log "Checking and deleting Enrollment Scheduled tasks."
Create-Timestamp -RegKeypath 'ScheduledTaskDeletion'
$AllSchdTasks = Get-ScheduledTask | where TaskPath -eq "\Microsoft\Windows\Enterprisemgmt\$DeviceEnrollmentID\"
ForEach ($AllSchdTask in $AllSchdTasks)
{
$taskname = $AllSchdTask.TaskName
Unregister-ScheduledTask -TaskPath $AllSchdTask.TaskPath -TaskName $taskname -Confirm:$false
Write-Log "Deleting : $taskname"
}
Start-Process "$PSScriptRoot\PsExec.exe" -ArgumentList "-is powershell.exe -command Remove-Item 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\EnterpriseMgmt\$DeviceEnrollmentID' -Recurse -Force" -WindowStyle Hidden
## Removing MDM Certificate
Write-Log "Finding and deleting MDM certificate"
Create-Timestamp -RegKeypath 'MDMCertificateDeletion'
gci cert:\LocalMachine\My -Recurse | Where {$_.Issuer -match 'Microsoft Intune MDM Device CA'} | Remove-Item -Force
$MDMcert = Get-ChildItem cert:\LocalMachine\My -Recurse | Where {$_.Issuer -match 'Microsoft Intune MDM Device CA'}
If($MDMcert)
{
Write-Log "MDM Certificate NOT Deleted"
}
Else
{
Write-Log "MDM Certificate Deleted"
}
## Retrieving existing users
Write-Log "Retrieving Existing user name and deleting Microsoft AAD broker plugin files."
Create-Timestamp -RegKeypath 'DeleteUserFiles'
$UserFolders = Get-ChildItem "C:\Users"
ForEach ($UserFolder in $UserFolders)
{
if ($UserFolder.Name -ne 'adiadmin')
{
if ($UserFolder.Name -ne 'Public')
{
if ($UserFolder.Name -ne 'Default')
{
$username = $UserFolder.Name
Write-Log "Deleting Microsoft.AAD.BrokerPlugin files from $username"
$msaadName = (Get-ChildItem "C:\Users\$username\AppData\Local\Packages" -Recurse -Force -Include Microsoft.AAD.BrokerPlugin* -ea SilentlyContinue).Name
Remove-Item -Path "C:\Users\$username\AppData\Local\Packages\$msaadName\Settings\*" -Force -Recurse -ea SilentlyContinue
Remove-Item -Path "C:\Users\$username\AppData\Local\Packages\$msaadName\AC\TokenBroker\Accounts\*" -Force -Recurse -ea SilentlyContinue
}
}
}
}
## Running dsregcmd /leave
Write-Log "Running dsregcmd /leave command"
Create-Timestamp -RegKeypath 'DsRegcmdLeave'
Start-Process -FilePath "dsregcmd.exe" -ArgumentList "/leave" -Verb RunAs
#.\dsregcmd.exe /leave
## Printing Reboot required regkey
Write-Log "Please restart you computer to proceed with next step."
Create-Timestamp -RegKeypath 'Reboot' -RegKeyName 'IsRebootRequired' -RegKeyValue 'Yes'
#Remove-Item -Path C:\temp\PsExec.exe -Force
Write-Log "=========== End of Log - $Stamp =========="
Created text file(Server.txt) with the device list having the issue.
Executed CoMgmtFix.Ps1 script which does all the work..
Issue in the above steps is I need to delete device from Azure AD manually. If there any way to delete the device entery from Azure AD via Script itself?
Tried the above stesp but need a way to delete device from Azure AD via Script itself.

Answer 1

To delete device from Azure AD:
Include RemoveAzureADDevice PowerShell script command directly.
Before running the command, you must call connect-AzureAD in PowerShell.
Remove-AzureADDevice -objectID <objectID>
To test, I created a virtual machine windows device in my environment and joined with Azure AD.
Get the object ID from AD joined VM properties by visiting Azure Active Directory -> Devices -> All Devices & search for the registered device.
Output:
Note: To remove an Azure AD joined device, you must have "administrative/owner" permissions under Roles & Assignments -> Azure Active Directory
Refer MsDoc