Skip to main content

Monitoring OneDrive status with PowerShell, CyberDrain and NinjaOne

· 4 min read

This post uses code from CyberDrain

Click the link below to check out the original post on CyberDrain.com and support Kelvin's fantastic work for the MSP community.

About this script

So firstly, if you haven't already, hit the giant orange button above to read the original blog post on CyberDrain.com to understand what this script is doing!

The problem with NinjaOne

Many, if not most RMM platforms can run a script to monitor system state. NinjaOne is no different here - but there's a subtle irregularity in their approach that makes this complicated.

Most RMM platforms let you extract the contents of a variable from the script you run as a monitor - Ninja doesn't. It can read from the output of the script but that's all.

The fix

This Script Has Been Updated

This script was updated after being published, if you're using it please compare the version you have with the version available here.

Kelvin's script doesn't output much by default - the default success method generated by creating the directory with New-Item but that's it. To make this work with NinjaOne we need to modify Kelvin's script a little bit, it's quite simple really.

We need to silence that New-Item call by adding | Out-Null to the end and we need to "dump" the contents of the $ODErrors variable to the output.

"Logged in users"

When run with no logged in users the original version of this script would return an error, as NinjaOne lacks the ability to only run a monitor when a user is logged in this is undesirable behaviour, the script has, therefore, been updated to avoid this with a check to ensure a user is logged in.

"Error codes"

The most recent update to this script adds two error codes beyond "successful" (code 0). Error code 1 is used when no users are logged in.

We should end up with this:

Kelvin's script with the fix
$Source = @"
using System;
using System.Runtime.InteropServices;

namespace murrayju.ProcessExtensions
{
public static class ProcessExtensions
{
#region Win32 Constants

private const int CREATE_UNICODE_ENVIRONMENT = 0x00000400;
private const int CREATE_NO_WINDOW = 0x08000000;

private const int CREATE_NEW_CONSOLE = 0x00000010;

private const uint INVALID_SESSION_ID = 0xFFFFFFFF;
private static readonly IntPtr WTS_CURRENT_SERVER_HANDLE = IntPtr.Zero;

#endregion

#region DllImports

[DllImport("advapi32.dll", EntryPoint = "CreateProcessAsUser", SetLastError = true, CharSet = CharSet.Ansi, CallingConvention = CallingConvention.StdCall)]
private static extern bool CreateProcessAsUser(
IntPtr hToken,
String lpApplicationName,
String lpCommandLine,
IntPtr lpProcessAttributes,
IntPtr lpThreadAttributes,
bool bInheritHandle,
uint dwCreationFlags,
IntPtr lpEnvironment,
String lpCurrentDirectory,
ref STARTUPINFO lpStartupInfo,
out PROCESS_INFORMATION lpProcessInformation);

[DllImport("advapi32.dll", EntryPoint = "DuplicateTokenEx")]
private static extern bool DuplicateTokenEx(
IntPtr ExistingTokenHandle,
uint dwDesiredAccess,
IntPtr lpThreadAttributes,
int TokenType,
int ImpersonationLevel,
ref IntPtr DuplicateTokenHandle);

[DllImport("userenv.dll", SetLastError = true)]
private static extern bool CreateEnvironmentBlock(ref IntPtr lpEnvironment, IntPtr hToken, bool bInherit);

[DllImport("userenv.dll", SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
private static extern bool DestroyEnvironmentBlock(IntPtr lpEnvironment);

[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool CloseHandle(IntPtr hSnapshot);

[DllImport("kernel32.dll")]
private static extern uint WTSGetActiveConsoleSessionId();

[DllImport("Wtsapi32.dll")]
private static extern uint WTSQueryUserToken(uint SessionId, ref IntPtr phToken);

[DllImport("wtsapi32.dll", SetLastError = true)]
private static extern int WTSEnumerateSessions(
IntPtr hServer,
int Reserved,
int Version,
ref IntPtr ppSessionInfo,
ref int pCount);

#endregion

#region Win32 Structs

private enum SW
{
SW_HIDE = 0,
SW_SHOWNORMAL = 1,
SW_NORMAL = 1,
SW_SHOWMINIMIZED = 2,
SW_SHOWMAXIMIZED = 3,
SW_MAXIMIZE = 3,
SW_SHOWNOACTIVATE = 4,
SW_SHOW = 5,
SW_MINIMIZE = 6,
SW_SHOWMINNOACTIVE = 7,
SW_SHOWNA = 8,
SW_RESTORE = 9,
SW_SHOWDEFAULT = 10,
SW_MAX = 10
}

private enum WTS_CONNECTSTATE_CLASS
{
WTSActive,
WTSConnected,
WTSConnectQuery,
WTSShadow,
WTSDisconnected,
WTSIdle,
WTSListen,
WTSReset,
WTSDown,
WTSInit
}

[StructLayout(LayoutKind.Sequential)]
private struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public uint dwProcessId;
public uint dwThreadId;
}

private enum SECURITY_IMPERSONATION_LEVEL
{
SecurityAnonymous = 0,
SecurityIdentification = 1,
SecurityImpersonation = 2,
SecurityDelegation = 3,
}

[StructLayout(LayoutKind.Sequential)]
private struct STARTUPINFO
{
public int cb;
public String lpReserved;
public String lpDesktop;
public String lpTitle;
public uint dwX;
public uint dwY;
public uint dwXSize;
public uint dwYSize;
public uint dwXCountChars;
public uint dwYCountChars;
public uint dwFillAttribute;
public uint dwFlags;
public short wShowWindow;
public short cbReserved2;
public IntPtr lpReserved2;
public IntPtr hStdInput;
public IntPtr hStdOutput;
public IntPtr hStdError;
}

private enum TOKEN_TYPE
{
TokenPrimary = 1,
TokenImpersonation = 2
}

[StructLayout(LayoutKind.Sequential)]
private struct WTS_SESSION_INFO
{
public readonly UInt32 SessionID;

[MarshalAs(UnmanagedType.LPStr)]
public readonly String pWinStationName;

public readonly WTS_CONNECTSTATE_CLASS State;
}

#endregion

// Gets the user token from the currently active session
private static bool GetSessionUserToken(ref IntPtr phUserToken)
{
var bResult = false;
var hImpersonationToken = IntPtr.Zero;
var activeSessionId = INVALID_SESSION_ID;
var pSessionInfo = IntPtr.Zero;
var sessionCount = 0;

// Get a handle to the user access token for the current active session.
if (WTSEnumerateSessions(WTS_CURRENT_SERVER_HANDLE, 0, 1, ref pSessionInfo, ref sessionCount) != 0)
{
var arrayElementSize = Marshal.SizeOf(typeof(WTS_SESSION_INFO));
var current = pSessionInfo;

for (var i = 0; i < sessionCount; i++)
{
var si = (WTS_SESSION_INFO)Marshal.PtrToStructure((IntPtr)current, typeof(WTS_SESSION_INFO));
current += arrayElementSize;

if (si.State == WTS_CONNECTSTATE_CLASS.WTSActive)
{
activeSessionId = si.SessionID;
}
}
}

// If enumerating did not work, fall back to the old method
if (activeSessionId == INVALID_SESSION_ID)
{
activeSessionId = WTSGetActiveConsoleSessionId();
}

if (WTSQueryUserToken(activeSessionId, ref hImpersonationToken) != 0)
{
// Convert the impersonation token to a primary token
bResult = DuplicateTokenEx(hImpersonationToken, 0, IntPtr.Zero,
(int)SECURITY_IMPERSONATION_LEVEL.SecurityImpersonation, (int)TOKEN_TYPE.TokenPrimary,
ref phUserToken);

CloseHandle(hImpersonationToken);
}

return bResult;
}

public static bool StartProcessAsCurrentUser(string appPath, string cmdLine = null, string workDir = null, bool visible = true)
{
var hUserToken = IntPtr.Zero;
var startInfo = new STARTUPINFO();
var procInfo = new PROCESS_INFORMATION();
var pEnv = IntPtr.Zero;
int iResultOfCreateProcessAsUser;

startInfo.cb = Marshal.SizeOf(typeof(STARTUPINFO));

try
{
if (!GetSessionUserToken(ref hUserToken))
{
throw new Exception("StartProcessAsCurrentUser: GetSessionUserToken failed.");
}

uint dwCreationFlags = CREATE_UNICODE_ENVIRONMENT | (uint)(visible ? CREATE_NEW_CONSOLE : CREATE_NO_WINDOW);
startInfo.wShowWindow = (short)(visible ? SW.SW_SHOW : SW.SW_HIDE);
startInfo.lpDesktop = "winsta0\\default";

if (!CreateEnvironmentBlock(ref pEnv, hUserToken, false))
{
throw new Exception("StartProcessAsCurrentUser: CreateEnvironmentBlock failed.");
}

if (!CreateProcessAsUser(hUserToken,
appPath, // Application Name
cmdLine, // Command Line
IntPtr.Zero,
IntPtr.Zero,
false,
dwCreationFlags,
pEnv,
workDir, // Working directory
ref startInfo,
out procInfo))
{
throw new Exception("StartProcessAsCurrentUser: CreateProcessAsUser failed.\n");
}

iResultOfCreateProcessAsUser = Marshal.GetLastWin32Error();
}
finally
{
CloseHandle(hUserToken);
if (pEnv != IntPtr.Zero)
{
DestroyEnvironmentBlock(pEnv);
}
CloseHandle(procInfo.hThread);
CloseHandle(procInfo.hProcess);
}
return true;
}
}
}
"@

$User = $Null
$User = Get-CimInstance -ClassName 'Win32_ComputerSystem' | Select-Object -ExpandProperty 'UserName' -ErrorAction Stop

try {
if ($User) {
New-Item 'C:\ProgramData\Microsoft OneDrive' -ItemType directory -Force -ErrorAction SilentlyContinue | Out-Null
Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/rodneyviana/ODSyncService/master/Binaries/PowerShell/OneDriveLib.dll' -OutFile 'C:\programdata\Microsoft OneDrive\OneDriveLib.dll'

Add-Type -ReferencedAssemblies 'System', 'System.Runtime.InteropServices' -TypeDefinition $Source -Language CSharp
$scriptblock = {
Unblock-File 'C:\ProgramData\Microsoft OneDrive\OneDriveLib.dll'
Import-Module 'C:\ProgramData\Microsoft OneDrive\OneDriveLib.dll'
$ODStatus = Get-ODStatus | ConvertTo-JSON | Out-File 'C:\ProgramData\Microsoft OneDrive\OneDriveLogging.txt'
}

[murrayju.ProcessExtensions.ProcessExtensions]::StartProcessAsCurrentUser("C:\Windows\System32\WindowsPowershell\v1.0\Powershell.exe", "-command $($scriptblock)","C:\Windows\System32\WindowsPowershell\v1.0",$false)
Start-Sleep 5
$ErrorList = @("NotInstalled", "ReadOnly", "Error", "OndemandOrUnknown")
$ODStatus = (Get-Content "C:\ProgramData\Microsoft OneDrive\OneDriveLogging.txt" | ConvertFrom-JSON).value
foreach ($ODStat in $ODStatus) {
if ($ODStat.StatusString -in $ErrorList) { $ODerrors = "$($ODStat.LocalPath) is in state $($ODStat.StatusString)" }
}
if (!$ODerrors) {
$ODerrors = "Healthy"
}
$ODErrors
} else {
'NoUserLoggedIn'
}
} catch {
('ScriptError: {0}' -f $_)
exit 1
}

You're going to want to add this as a script in NinjaOne by going to Configuration -> Scripting. This script needs to run as System :-)

Monitoring output in NinjaOne

The next step is deciding what to do with the output of the script in NinjaOne - so a brief digression to talk about script result monitors in NinjaOne.

In NinjaOne we go into Configuration -> Policies -> Policy to add monitor to -> Conditions then we're going to Add a condition this gives us the new condition screen:

NinjaOne New Condition

We want to hit Select a condition and then choose Script Result Condition which should give us the following screen:

NinjaOne New Script Result Condition

So, let's get this setup and running:

  • Evaluation Script: Select the script we uploaded above.
  • Run Every: Select a value appropriate to your needs - we used 10 minutes.
  • Timeout: We left this at the default.
  • Result Code: Not used.
  • With Output: This is where the magic happens, we want this to trigger when the output does not contain "Healthy" or "No User Logged In" - the regex for this (for easy copying) is (NotInstalled|ReadOnly|Error|OndemandOrUnknown|ScriptError) (basically a list of all the other statuses).

That's it - basic OneDrive monitoring. You can catch different cases using the Output filter e.g:

  • To detect "ReadOnly" sync instances set it to trigger when the output contains "ReadOnly".
  • To detect OneDrive not installed set it to trigger when the output contains "NotInstalled".
  • To detect OneDrive in an error state set it to trigger when the output contains "Error".
  • To detect Files on Demand or Unknown sync status set it to trigger when the output contains "OndemandorUnknown".

That's it - feel free to leave a comment if anything is unclear. Thanks to Kelvin for the inspiration on this!