Invoke-IntuneDiagExtender

Extends Microsoft's Intune device action "Collect diagnostics" by staging
administrator-selected files, complete directory archives and registry
exports in the Windows Temp location that Intune collects. Intended for
Intune Remediations and Windows troubleshooting from Autopilot/OOBE when
script execution is available. It only stages data; it neither starts a
diagnostics request nor uploads data. Then run Intune Collect diagnostics
and download the diagnostic package.

KEY FEATURES
- Recursively searches configured directories for selected file extensions.
 Search paths support PowerShell wildcards (*, ? and bracket expressions)
 and %ENVIRONMENT_VARIABLES%. Hidden files are included; junctions and
 symbolic links are not followed. General extensions apply to all search
 paths, with optional per-location additions such as
 '%windir%\Logs\CBS|.cab,.etl'. Use '*' to collect all extensions, including
 extensionless files. Overlapping matches are deduplicated.
- Collects all files recursively from FullDirectoryLocations without an
 extension filter. Each matching directory is staged as a ZIP archive when
 supported by the available .NET runtime; otherwise files are copied
 individually (empty directories are not preserved). Matching directories
 are archived separately. Directory collection is enabled for
 %windir%\Panther by default; use @() to disable it.
- Exports configured registry keys recursively, including values and
 subkeys, to Windows Registry Editor Version 5.00 (.reg) format. Supports
 HKLM, HKCU, HKCR, HKU and HKCC paths, PowerShell registry-drive notation
 and wildcards. Keys are read-only and the registry is never changed.
 Exports use the registry view of the process bitness. HKCU means the
 executing account (usually SYSTEM); use HKU with a SID pattern to target
 loaded user hives. Registry exports can contain sensitive data, so use
 narrowly scoped paths.
- Writes staged files directly to %windir%\Temp (normally C:\Windows\Temp),
 where Intune collects %windir%\Temp\%computername%*.log. Output names
 include the computer name, a hash of the source path and the original
 file name. A .log suffix is appended without converting file contents;
 rename downloaded files to their original extension to open them, and
 rename .zip.log archives to .zip. A collector log records mappings,
 warnings and errors.
- Continues after file, directory or registry collection errors, logs the
 problem and tries remaining items. Missing paths, drives, environment
 variables, keys or matching files are warnings and do not fail the run.
 Exit code 0 means collection completed without errors; exit code 1 means
 one or more errors occurred, even if other items were collected. An
 unusable destination or collector log is fatal. A failed archive is not
 staged; accessible files are copied individually where possible.

COMPATIBILITY AND OPERATION
Compatible with Windows PowerShell 2.0 and newer, including Windows
PowerShell 5.1, and requires no extra PowerShell modules or external archive
utilities. Run elevated or as SYSTEM; for Intune Remediations, set
"Run this script using the logged-on credentials" to No and enable 64-bit
PowerShell to collect the 64-bit registry view. Intune Remediations require
the Intune Management Extension and may not execute at the earliest OOBE
stage; use the same script from your provisioning workflow if collection
must occur before the extension is ready.

Repeated runs overwrite copies of the same source. Older staged copies whose
sources have disappeared remain until removed; the collector log is
overwritten each run. Source files are not changed or deleted. There are
no size or age limits, so scope locations and extensions carefully to
control disk use, runtime, diagnostic package size and sensitive data.
Active files are copied up to their length when opened and may not be
atomic snapshots. See Get-Help -Full for parameters and examples.