<#
.SYNOPSIS
    Intune Readiness Assessment Script

.DESCRIPTION
    Collects the minimum required device information for an Intune deployment:
    - Computer Name
    - Serial Number
    - Manufacturer
    - Model
    - Windows Edition
    - Windows Build
    - TPM Status
    - Secure Boot Status
    - Domain Join Status
    - Entra ID Join Status
    - Primary User
    - BitLocker Status
    - Installed Applications Count
    - Antivirus Product

.NOTES
    Run as Administrator for best results.
#>

# Stop running if script is not run as Administrator
if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
	Write-Host "ERROR:  Script must be run as administrator" -ForegroundColor Yellow -BackgroundColor Red -NoNewLine
	Write-Host
	Write-Host "Operation aborted."
	exit
}

# Get basic computer information
$ComputerSystem = Get-CimInstance Win32_ComputerSystem
$BIOS = Get-CimInstance Win32_BIOS
$OS = Get-CimInstance Win32_OperatingSystem

# Computer Name
$ComputerName = $env:COMPUTERNAME

# Serial Number
$SerialNumber = $BIOS.SerialNumber

# Manufacturer and Model
$Manufacturer = $ComputerSystem.Manufacturer
$Model = $ComputerSystem.Model

# Windows Information
$WindowsEdition = (Get-ComputerInfo).OsName
$WindowsBuild = (Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' | Select-Object DisplayVersion).DisplayVersion

# TPM Information
try {
    $TPM = Get-Tpm
    if ($TPM.TpmPresent) {
        $TPMStatus = "Present"
        $TPMVersion = ($TPM.ManufacturerVersion)
    }
    else {
        $TPMStatus = "Not Present"
        $TPMVersion = "N/A"
    }
}
catch {
    $TPMStatus = "Unknown"
    $TPMVersion = "Unknown"
}

# Secure Boot
try {
    $SecureBoot = Confirm-SecureBootUEFI
}
catch {
    $SecureBoot = "Unsupported/Legacy BIOS"
}

# Domain Join Status
$DomainJoined = $ComputerSystem.PartOfDomain

# Entra ID Join Status
$AzureADJoined = "Unknown"

try {
    $DsReg = dsregcmd /status

    if ($DsReg -match "AzureAdJoined\s*:\s*YES") {
        $AzureADJoined = "Yes"
    }
    elseif ($DsReg -match "AzureAdJoined\s*:\s*NO") {
        $AzureADJoined = "No"
    }
}
catch {
    $AzureADJoined = "Unable to Determine"
}

# Primary User
$PrimaryUser = (Get-CimInstance Win32_ComputerSystem).UserName

# BitLocker Status
try {
    $BitLockerVolume = Get-BitLockerVolume -MountPoint "C:"
    $BitLockerStatus = $BitLockerVolume.ProtectionStatus

    switch ($BitLockerStatus) {
        1 { $BitLockerStatus = "Protected" }
        0 { $BitLockerStatus = "Not Protected" }
        default { $BitLockerStatus = "Unknown" }
    }
}
catch {
    $BitLockerStatus = "Unknown"
}

# Installed Applications Count
try {
    $AppCount = (
        Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* ,
                         HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* `
            -ErrorAction SilentlyContinue |
        Where-Object { $_.DisplayName } |
        Measure-Object
    ).Count
}
catch {
    $AppCount = "Unknown"
}

# Antivirus Product
try {
    $AV = Get-CimInstance `
        -Namespace "root\SecurityCenter2" `
        -ClassName AntiVirusProduct `
        -ErrorAction Stop

    $AntivirusProduct = ($AV.displayName -join "; ")
}
catch {
    $AntivirusProduct = "Not Detected"
}

# Create Output Object
$Results = [PSCustomObject]@{
    ComputerName      = $ComputerName
    SerialNumber      = $SerialNumber
    Manufacturer      = $Manufacturer
    Model             = $Model
    WindowsEdition    = $WindowsEdition
    WindowsBuild      = $WindowsBuild
    TPMStatus         = $TPMStatus
    TPMVersion        = $TPMVersion
    SecureBootEnabled = $SecureBoot
    DomainJoined      = $DomainJoined
    AzureADJoined     = $AzureADJoined
    PrimaryUser       = $PrimaryUser
    BitLockerStatus   = $BitLockerStatus
    InstalledApps     = $AppCount
    AntivirusProduct  = $AntivirusProduct
}

# Display Results
$Results | Format-List

# Export Results
$OutputFile = "$env:PUBLIC\Documents\Intune_Readiness_$ComputerName.csv"

$Results | Export-Csv -Path $OutputFile -NoTypeInformation

Write-Host ""
Write-Host "Assessment complete." -ForegroundColor Green
Write-Host "Results exported to: $OutputFile" -ForegroundColor Cyan