Streamline Microsoft Entra (Azure AD) Connection Checks with PowerShell

Key takeaways

• The script automates the process of checking a device’s connection status with Microsoft Entra, providing crucial security and network information.
• It translates the output of dsregcmd.exe /status into a user-friendly format, making it easier to interpret and act on the data.
• This tool is particularly beneficial for MSPs and IT professionals in managing diverse networks with both cloud and on-premises resources.
• The script supports enhanced IT security by ensuring devices are properly authenticated and compliant with Microsoft Entra’s standards.
• It surpasses traditional methods in efficiency and detail, offering a streamlined approach to checking Azure AD join status.
• Regular use of the script, coupled with comprehensive solutions like NinjaOne, creates a robust framework for network management and security.
• The script is designed for ease of use on Windows 10 and newer versions, but requires administrative privileges for operation.

Understanding the connection status of devices to Microsoft Entra (formerly known as Azure Active Directory or Azure AD) is crucial in today’s IT landscape. For IT professionals and Managed Service Providers (MSPs), having the ability to swiftly and accurately check this status is key to maintaining network security and efficiency.

Background

The PowerShell script provided is an invaluable tool for IT specialists. It enables the retrieval of detailed information regarding a device’s connection status to Microsoft Entra. This is essential because it aids in identifying the type of network join a device has executed, be it Microsoft Entra Joined, Domain Joined, or other states. In an era where cloud services like Azure AD play a pivotal role in organizational IT infrastructure, such tools are indispensable for managing and securing networked devices.

The script:

#Requires -Version 5.1

<#
.SYNOPSIS
    Retrieves details regarding the device's Microsoft Entra/Azure AD connection status.
.DESCRIPTION
    Retrieves details regarding the device's Microsoft Entra/Azure AD connection status.
.EXAMPLE
    (No Parameters)
    
    Join Type: Microsoft Entra Joined

    Tenant Name Tenant ID                            Device Name     Device ID                           
    ----------- ---------                            -----------     ---------                           
    NinjaOne    0e0adb39-f83f-4576-9102-db1b902ca108 KYLE-WIN11-TEST 59fd69ed-4893-41df-9f7d-211d5a0a8986

PARAMETER: -DeviceStateCustomFieldName "ReplaceMe"
    Name of a custom field to store the device state (Microsoft Entra Joined, Domain Joined etc...) in. E.g., deviceState

PARAMETER: -TenantInfoCustomFieldName "ReplaceMe"
    Name of a custom field to store tenant info in. E.g., azureInfo.

.OUTPUTS
    None
.NOTES
    Minimum Supported OS: Windows 10+
    Release Notes: Initial Release
By using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https://www.ninjaone.com/terms-of-use.
    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. 
    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. 
    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. 
    Warranty Disclaimer: The script is provided “as is” and “as available”, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. 
    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. 
    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. 
    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).
#>

[CmdletBinding()]
param (
    [Parameter()]
    [String]$DeviceStateCustomFieldName,
    [Parameter()]
    [String]$TenantInfoCustomFieldName
)

begin {
    # Retrieve custom field name from dynamic script form
    if ($env:joinTypeCustomFieldName -and $env:joinTypeCustomFieldName -notlike "null") { $DeviceStateCustomFieldName = $env:joinTypeCustomFieldName }
    if ($env:tenantInfoCustomFieldName -and $env:tenantInfoCustomFieldName -notlike "null") { $TenantInfoCustomFieldName = $env:tenantInfoCustomFieldName }

    # Turn dsregcmd.exe /status into a much more parseable PowerShell object
    function Get-DSRegCMD {
        $DSReg = dsregcmd.exe /status | Where-Object { $_ -match " : " }

        $properties = @{}

        $DSReg | ForEach-Object {
            $split = ($_ -split '\s:\s').trim()
            $properties[$split[0]] = $split[1]
        }

        [PSCustomObject]$properties
    }
}
process {
    # Retrieve current Azure AD information
    $AzureInfo = Get-DSRegCMD

    $JoinType = if ($AzureInfo.AzureAdJoined -eq "YES" -and $AzureInfo.DomainJoined -eq "NO" -and $AzureInfo.EnterpriseJoined -eq "NO") {
        "Microsoft Entra Joined"
    }
    elseif ($AzureInfo.AzureAdJoined -eq "NO" -and $AzureInfo.DomainJoined -eq "YES" -and $AzureInfo.EnterpriseJoined -eq "NO") {
        "Domain Joined"
    }
    elseif ($AzureInfo.AzureAdJoined -eq "YES" -and $AzureInfo.DomainJoined -eq "YES" -and $AzureInfo.EnterpriseJoined -eq "NO") {
        "Microsoft Entra Hybrid Joined"
    }
    elseif ($AzureInfo.AzureAdJoined -eq "NO" -and $AzureInfo.DomainJoined -eq "YES" -and $AzureInfo.EnterpriseJoined -eq "YES") {
        "On-Premises DRS Joined"
    }
    else {
        "None"
    }

    # Retrieve the most relevant information
    $TenantInfo = [PSCustomObject]@{
        "Tenant Name" = $AzureInfo.TenantName
        "Tenant ID"   = $AzureInfo.TenantId
        "Device Name" = $AzureInfo."Device Name"
        "Device ID"   = $AzureInfo.DeviceId
    }

    # Report results into the activity log
    Write-Host "Join Type: $JoinType"
    $TenantInfo | Format-Table | Out-String | Write-Host

    # Store results into a custom field
    if($DeviceStateCustomFieldName -eq $TenantInfoCustomFieldName -and $DeviceStateCustomFieldName){
        $TenantInfo | Add-Member -MemberType NoteProperty -Name 'Join Type' -Value $JoinType

        Ninja-Property-Set -Name $DeviceStateCustomFieldName -Value ($TenantInfo | Format-List -Property "Tenant Name","Tenant ID","Join Type","Device Name","Device ID" | Out-String)
        exit 0
    }

    if ($DeviceStateCustomFieldName) {
        Ninja-Property-Set -Name $DeviceStateCustomFieldName -Value ($JoinType)
    }

    if ($TenantInfoCustomFieldName) {
        Ninja-Property-Set -Name $TenantInfoCustomFieldName -Value ($TenantInfo | Format-List | Out-String)
    }
}
end {

 

Detailed breakdown

The script operates in a structured manner. Initially, it sets up parameters for custom field names that can be utilized for storing device state and tenant information. It then proceeds to define a function, Get-DSRegCMD, which converts the output of dsregcmd.exe /status (a command-line tool for checking Azure AD registration and connection status) into a more manageable PowerShell object.

Next, the script determines the device’s join type (e.g., Microsoft Entra Joined, Domain Joined) based on the Azure AD information retrieved. It then creates an object, $TenantInfo, containing pertinent details like Tenant Name, Tenant ID, Device Name, and Device ID.

Finally, the script reports these details and stores them in specified custom fields, if those fields are provided.

Potential use cases

Imagine an MSP overseeing a network with a mix of cloud and on-premises resources. Using this script, the MSP can quickly ascertain the connection status of each device in the network, ensuring that all devices are properly integrated with Microsoft Entra for optimal security and compliance.

Comparisons

Traditional methods of checking Azure AD join status involve manual checking or using less sophisticated scripts that might not provide as detailed information. This script automates the process and presents data in a more user-friendly format, saving time and reducing the margin for error.

FAQs

• How does this script differ from using dsregcmd.exe /status directly?
  • The script parses and organizes the output of dsregcmd.exe /status into a more readable and usable format.

• Can this script be used on any Windows device?
  • It’s designed for Windows 10 and newer versions.

• Do I need administrative privileges to run this script?
  • Yes, administrative privileges are generally required to execute such scripts that interact with system configurations.

Implications

Utilizing this script enhances IT security by ensuring devices are properly connected and authenticated with Microsoft Entra. It aids in compliance and security management, key aspects in protecting organizational data.

Recommendations

Best practices include running this script regularly to monitor and verify the connection status of all devices, particularly in environments with frequent changes in network architecture or device deployment.

Final thoughts

Incorporating tools like NinjaOne alongside this PowerShell script can provide comprehensive management and security solutions. NinjaOne’s capabilities in remote monitoring and management complement the insights obtained from the script, offering a more holistic view of device status and network health, ensuring businesses stay ahead in the ever-evolving IT landscape.