Conversation
…formation for endpoints (#24)
* chore(docs): Update comments and instructions in security script * chore: commit to kick cicd
* feat(Deploy-CheckExtension): add domain squatting detection parameters Co-authored-by: Copilot <copilot@github.com> * feat(Deploy-CheckExtension): add CippTenantIdOverride parameter for CIPP reporting Co-authored-by: Copilot <copilot@github.com> * feat(Deploy-CheckExtension): clean stale registry entries for extensions Co-authored-by: Copilot <copilot@github.com> --------- Co-authored-by: Copilot <copilot@github.com>
There was a problem hiding this comment.
Pull request overview
Enhances the existing Check extension deployment task to support additional extension policy/branding controls (including domain-squatting detection and webhook integration), and adds a new inventory script to report device identity provider (AD DS / Entra ID) status.
Changes:
- Expanded
Deploy-CheckExtension.ps1parameters and registry mapping (domain squatting config, webhook events, branding URLs, toolbar pinning, allowlist schema, and additional validations). - Added
Inventory/Get-ComputerIDP.ps1to inventory AD DS / Entra ID join status via CIM +dsregcmd. - Minor updates to workstation security tweaks script header guidance and a formatting fix.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| Task/Windows Workstation Security Tweaks Combined Script.ps1 | Adds usage guidance in the header and fixes a formatting/line issue. |
| Task/Deploy-CheckExtension.ps1 | Adds new extension policy/branding/webhook/domain-squatting options and registry write/cleanup logic. |
| Inventory/Get-ComputerIDP.ps1 | New inventory metascript to report device join/IDP status and identifiers. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| $domainSquattingItems = @( | ||
| @{ Path=$domainSquattingKey; Name='enabled'; Type='DWord'; Value=$DomainSquattingEnabled }, | ||
| @{ Path=$domainSquattingKey; Name='deviationThreshold'; Type='DWord'; Value=$DomainSquattingDeviationThreshold }, | ||
| @{ Path=$domainSquattingKey; Name='Action'; Type='String'; Value=$DomainSquattingAction }, |
There was a problem hiding this comment.
The domain squatting policy key uses value name Action (capital A) while all other policy names in this script use lower camel case (e.g., enabled, deviationThreshold, logDetections). Because Chrome/Edge managed-storage keys become case-sensitive object properties for the extension, this likely creates a different key than intended. Consider changing the value name to lower camel case (e.g., action) to match the rest of the schema.
| @{ Path=$domainSquattingKey; Name='Action'; Type='String'; Value=$DomainSquattingAction }, | |
| @{ Path=$domainSquattingKey; Name='action'; Type='String'; Value=$DomainSquattingAction }, |
| <# | ||
| Summary: Determines the identity provider(s) the endpoint is joined to (AD DS and/or Entra ID) and emits a JSON report with the relevant identifiers. | ||
| Script Type: Device Inventory-Metascript | ||
| Dependencies: Invoke-ImmyCommand | ||
| Author: GitHub Copilot | ||
| #> |
There was a problem hiding this comment.
Header says the script "emits a JSON report", but the implementation outputs a PowerShell hashtable/object and never calls ConvertTo-Json. Either update the header comment to match the actual output, or emit JSON explicitly (and include an appropriate -Depth).
| function Get-DomainJoinData { | ||
| <# Retrieves domain membership info from the endpoint via CIM. #> | ||
| Invoke-ImmyCommand { | ||
| try { | ||
| $system = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop | ||
| [hashtable]@{ | ||
| PartOfDomain = [bool]$system.PartOfDomain | ||
| Domain = $system.Domain | ||
| } | ||
| } catch { | ||
| $null | ||
| } | ||
| } | ||
| } | ||
|
|
||
| function Get-EntraJoinData { | ||
| <# Parses dsregcmd output on the endpoint to capture Entra ID join metadata. #> | ||
| Invoke-ImmyCommand { | ||
| $exe = Join-Path $env:SystemRoot 'System32\dsregcmd.exe' | ||
| if (-not (Test-Path $exe)) { | ||
| return $null | ||
| } | ||
|
|
There was a problem hiding this comment.
This inventory script makes two separate Invoke-ImmyCommand calls (one in Get-DomainJoinData and one in Get-EntraJoinData). If Invoke-ImmyCommand is a remote/agent hop, this adds avoidable overhead. Consider collecting both domain join and dsregcmd status in a single Invoke-ImmyCommand invocation and returning a single object.
| function Get-DomainJoinData { | |
| <# Retrieves domain membership info from the endpoint via CIM. #> | |
| Invoke-ImmyCommand { | |
| try { | |
| $system = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop | |
| [hashtable]@{ | |
| PartOfDomain = [bool]$system.PartOfDomain | |
| Domain = $system.Domain | |
| } | |
| } catch { | |
| $null | |
| } | |
| } | |
| } | |
| function Get-EntraJoinData { | |
| <# Parses dsregcmd output on the endpoint to capture Entra ID join metadata. #> | |
| Invoke-ImmyCommand { | |
| $exe = Join-Path $env:SystemRoot 'System32\dsregcmd.exe' | |
| if (-not (Test-Path $exe)) { | |
| return $null | |
| } | |
| function Get-JoinInventoryData { | |
| <# Retrieves domain membership info and Entra join metadata from the endpoint in a single remote invocation. #> | |
| if ($script:JoinInventoryData) { | |
| return $script:JoinInventoryData | |
| } | |
| $script:JoinInventoryData = Invoke-ImmyCommand { | |
| $domainData = $null | |
| $entraData = $null | |
| try { | |
| $system = Get-CimInstance -ClassName Win32_ComputerSystem -ErrorAction Stop | |
| $domainData = [hashtable]@{ | |
| PartOfDomain = [bool]$system.PartOfDomain | |
| Domain = $system.Domain | |
| } | |
| } catch { | |
| $domainData = $null | |
| } | |
| try { | |
| $exe = Join-Path $env:SystemRoot 'System32\dsregcmd.exe' | |
| if (Test-Path $exe) { | |
| $output = & $exe /status 2>$null | |
| if ($output) { | |
| $parsed = [ordered]@{} | |
| foreach ($line in $output) { | |
| if ($line -match '^\s*([^:]+?)\s*:\s*(.*?)\s*$') { | |
| $key = ($matches[1] -replace '\s+', '') | |
| $value = $matches[2].Trim() | |
| if ($key) { | |
| $parsed[$key] = $value | |
| } | |
| } | |
| } | |
| $entraData = [hashtable]@{ | |
| AzureAdJoined = $parsed['AzureAdJoined'] | |
| TenantId = $parsed['TenantId'] | |
| TenantName = $parsed['TenantName'] | |
| DeviceId = $parsed['DeviceId'] | |
| } | |
| } | |
| } | |
| } catch { | |
| $entraData = $null | |
| } | |
| [hashtable]@{ | |
| Domain = $domainData | |
| Entra = $entraData | |
| } | |
| } | |
| $script:JoinInventoryData | |
| } | |
| function Get-DomainJoinData { | |
| <# Retrieves domain membership info from the combined cached endpoint join data. #> | |
| $joinData = Get-JoinInventoryData | |
| if ($joinData) { | |
| return $joinData.Domain | |
| } | |
| $null | |
| } | |
| function Get-EntraJoinData { | |
| <# Returns Entra ID join metadata from the combined cached endpoint join data. #> | |
| $joinData = Get-JoinInventoryData | |
| if ($joinData) { | |
| return $joinData.Entra | |
| } | |
| return $null |
This pull request introduces significant enhancements and new features to the
Deploy-CheckExtension.ps1script, focusing on expanding configuration options, improving security controls (especially around domain squatting detection), and increasing branding and integration flexibility. It also adds a new script,Get-ComputerIDP.ps1, to inventory device identity provider status. Below are the most important changes grouped by theme:Security and Detection Enhancements:
Branding and UI Customization:
Configuration and Policy Improvements:
Inventory Script Addition:
Inventory/Get-ComputerIDP.ps1to determine if a device is joined to Active Directory, Entra ID, or both, and output a JSON report with relevant identifiers.Minor Corrections:
These changes collectively provide more granular control, better security posture, and improved integration and branding capabilities for extension deployment and inventory scripts.