diff --git a/Manuals/3.2.1 (ALPHA)/Manual-Mac.md b/Manuals/3.2.1 (ALPHA)/Manual-Mac.md deleted file mode 100644 index df2edbd..0000000 --- a/Manuals/3.2.1 (ALPHA)/Manual-Mac.md +++ /dev/null @@ -1,513 +0,0 @@ -# Compliance Utility manual -###### Version 3.2.1 (macOS)

- -**Contents** - -* [Description](#description) - * [MIT License](#mit-license) - * [Microsoft Privacy Statement](#microsoft-privacy-statement) -* [Requirements](#requirements) - * [Internet access](#internet-access) - * [PowerShell](#ms-powershell) - * [Graph PowerShell module](#graph-module) - * [Exchange Online PowerShell module](#exchange-online-module) -* [Installation](#installation) - * [Check installation](#check-installation) -* [Uninstall](#uninstall) -* [User experience](#experience) -* [Features / Parameters](#features-parameters) - * [INFORMATION](#information) - * [HELP](#help-win) - * [RESET](#reset) - * [RECORD PROBLEM](#record-problem) - * [COLLECT](#collect) - * [Labels and polcies](#labels-and-policies) - * [DLP rules and policies](#dlp-rules-and-policies) - * [User license details](#user-license-details) - * [COMPRESS LOGS](#compress-logs) - * [EXIT](#exit) -* [Script log file](#script-log-file) -* [Log files and folders](#log-files) -* [Support](#support) - * [Microsoft Support Policy](#support-policy) - * [How to file issues and get help](#get-help) - -## Description - -The 'Compliance Utility' is a powerful tool that helps troubleshoot and diagnose sensitivity labels, policies, settings and more. Whether you need to fix issues or reset configurations, this tool has you covered. - -Have you ever used the Sensitivity button in a [Microsoft 365 App](https://www.microsoft.com/en-us/microsoft-365/products-apps-services)? If so, you've used the [Office's built-in labeling experience](https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide). If something is not working as expected with your DLP policies, sensitivity labels or you don't see any labels at all the 'Compliance Utility' will help you. - -> **Note** -> -> If you want to use the 'Compliance Utility' on Microsoft Windows, you can find the corresponding online manual [here](Manual-Win.md). - -### MIT License - -Copyright © Microsoft Corporation. - -Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - -### Microsoft Privacy Statement - -Your privacy is important to us. [This privacy statement](https://privacy.microsoft.com/en-US/privacystatement) explains the personal data Microsoft processes, how Microsoft processes it, and for what purposes. - -## Requirements - -Before you can use the 'Compliance Utility' make sure that your environment fulfils the following requierements. Please update your environment if necessary. - -The 'Compliance Utility' supports the following operating systems: - -* Apple macOS ([three most recent major versions](https://support.microsoft.com/en-us/office/upgrade-macos-to-continue-receiving-microsoft-365-and-office-for-mac-updates-16b8414f-08ec-4b24-8c91-10a918f649f8)) - -The 'Compliance Utility' supports the following Office and Microsoft 365 editions: - -* Microsoft 365 for Mac ([most recently released version](https://learn.microsoft.com/en-us/officeupdates/update-history-office-for-mac#release-history-for-office-for-mac)) -* Microsoft Office 2021 for Mac -* Microsoft Office 2019 for Mac - -> **Note** -> -> Please refer to the [Microsoft product lifecycle](https://learn.microsoft.com/en-us/lifecycle/products/?expanded=m365&terms=mac&products=office) page to find out which versions of Office are still supported. - -### Internet access - -The 'Compliance Utility' uses additional sources from the Internet to make its functionality fully available. - -> [!WARNING] -> Unexpected errors may occur, and some features may be limited, if there is no connection to the Internet. - -### PowerShell - -Please follow the instructions for [installing PowerShell on macOS](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-macos?view=powershell-7.4) to install it using your preferred method. Nevertheless the [installation via direct download](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-macos?view=powershell-7.4#installation-via-direct-download) is recommended. - -> **Note** -> -> PowerShell must be installed with local administrative privileges. Please request assistance from your administrator if necessary. - -### Graph PowerShell module - -The [Graph PowerShell module](https://www.powershellgallery.com/packages/Microsoft.Graph) is required to proceed the option [User license details](#user-license-details) from the [COLLECT](#collect) menu. - -If you do not have this module installed, the 'Compliance Utility' will try to install the current version from [PowerShell Gallery](https://www.powershellgallery.com/packages/Microsoft.Graph). - -### Exchange Online PowerShell module - -The [Exchange Online PowerShell module](https://learn.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps) is required to proceed the options [Labels and policies](#labels-and-policies) and [DLP rules and policies](#dlp-rules-and-policies) from the menu [COLLECT](#collect). - -If you do not have this module installed, the 'Compliance Utility' will try to install the current version from [PowerShell Gallery](https://www.powershellgallery.com/packages/ExchangeOnlineManagement). - -# Installation - -The 'Compliance Utility' is available on [PowerShell Gallery](https://www.powershellgallery.com/packages/ComplianceUtility/). To start the installation, you must first execute the `pwsh` command in a Terminal window to start a PowerShell session. Then type the following command and press enter to start the installation of the 'Compliance Utility': - -``` -Install-Module -Name ComplianceUtility -AllowClobber -Scope CurrentUser -``` - -If you have local administrative privileges, you can run the following command instead: - -``` -Install-Module -Name ComplianceUtility -AllowClobber -Scope AllUsers -``` - -> **Note** -> -> If you do not have a required component installed on your computer, you will be prompted to do so. You may need to confirm the installation of PowerShell Gallery as a trusted repository. - -#### Allow signed PowerShell scripts - -If PowerShell script execution is restricted in your environment, you must first remove this restriction in order to be able to run the 'Compliance Utility'. To do this, run the `Set-ExecutionPolicy` command with the following parameters: - -``` -Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -Force -``` - -The 'Compliance Utility' is code-signed with a Microsoft certificate. - -### Check installation - -To verify if the installation was successful, you can call the `Get-Module` cmdlet with the following parameter: - -``` -Get-Module -Name ComplianceUtility -ListAvailable -``` - -If you find an entry like the following, the installation was successful: - -``` - Directory: C:\Users\\Documents\WindowsPowerShell\Modules - -ModuleType Version Name ExportedCommands ----------- ------- ---- ---------------- -Script 3.2.1 ComplianceUtility {ComplianceUtility, CompUtil, UnifiedLabelingSupportTool} -``` - -# Uninstall - -If you want to completely uninstall the 'Compliance Utility', you must execute the following command: - -``` -Uninstall-Module -Name ComplianceUtility -AllVersions -``` - -If you want to uninstall a specific version, for example version 3.2.0, you must execute the following command: - -``` -Uninstall-Module -Name ComplianceUtility -RequiredVersion 3.2.0 -``` - -> **Note** -> -> Under certain circumstances, you may need to run the uninstallation with administrator privileges. Please request assistance from your administrator if necessary. - -# User experience - -First you need to execute the command `pwsh` in a Terminal window to start a PowerShell session. Then type the following command and press enter to start the 'Compliance Utility': - -``` -ComplianceUtility -``` - -When you start the 'Compliance Utility', you'll see the following menu: - -``` -ComplianceUtility: - - [I] INFORMATION - [M] MIT LICENSE - [H] HELP - [R] RESET - [P] RECORD PROBLEM - [C] COLLECT - [Z] COMPRESS LOGS - [X] EXIT - -Please select an option and press enter: -``` - -> [!TIP] -> For better readability, it is recommended to change the Terminal/PowerShell window settings to the "Pro" profile. - -> **Note** -> -> When the 'Compliance Utility' is started for the first time and an installation of the 'Unified Labeling Support Tool' is found, it is removed. - -If you select `[C] COLLECT`, a submenu will be expanded, and you can collapse it by selecting option `[C] COLLECT` again: - -``` - [C] COLLECT - ├──[L] Labels and policies - ├──[D] DLP rules and policies - └──[U] User license details -``` - -> **Note** -> -> * With an exception of the [User license details](#user-license-details) entry, you need to run the 'Compliance Utility' in an administrative PowerShell window as a user with local administrative privileges to proceed with any option from this submenu. Please contact your administrator if necessary. -> * You need to know your Microsoft 365 global administrator account information to proceed, as you will be asked for your credentials. - -You can also start the 'Compliance Utility' within the command line. Use the following command line parameter to see a short summary of all available command line parameters: - -``` -ComplianceUtility -Information -``` - -To see a complete list of all command line parameters with description, execute the following command (command line help): - -``` -Get-Help ComplianceUtility -Detailed -``` - -To see the help for a single command line parameter, for example for `-CompressLogs`, run the following command: - -``` -Get-Help ComplianceUtility -Parameter CompressLogs -``` - -# Features / Parameters - -The 'Compliance Utility' provides the following parameters: - -**Syntax:** - -``` -ComplianceUtility - [-Information] - [-License] - [-Help] - [-Reset] - [-RecordProblem] - [-CollectAIPServiceConfiguration] - [-CollectProtectionTemplates] - [-CollectEndpointURLs] - [-CollectLabelsAndPolicies] - [-CollectDLPRulesAndPolicies] - [-CollectUserLicenseDetails] - [-SkipUpdates] - [-CompressLogs] - [-Menu] - -``` - -> **Note** -> -> Features/Parameters `-CollectAIPServiceConfiguration`, `-CollectProtectionTemplates` and `-CollectEndpointURLs` are not available. They would require the [AIPService module](https://learn.microsoft.com/en-us/powershell/module/aipservice/?view=azureipps), which is not yet supported on PowerShell 7.x. - -Description of all features and parameters (feature / parameter): - -### [I] INFORMATION / -Information - -This shows syntax, description and version information. - -### [M] MIT LICENSE / -License - -This displays the [MIT License](#mit-license). - -### [H] HELP / -Help - -This opens the online manual. - -### [R] RESET / -Reset - -> [!IMPORTANT] -> Before you proceed with this option, please close all open applications. - -This option removes all relevant policies, labels and settings. - -> **Note** -> -> When resetting, the message "'Terminal' wants to access data from other applications" may appear. As no personal information is collected, only the settings are cleaned up, this has no effect on how you confirm the message. - -Valid arguments are: "Default", or "Silent": - -**Default:** - -This argument removes all relevant policies, labels and settings: - -``` -ComplianceUtility -Reset Default -``` - -With the above command the following file folders will be cleaned up: - -``` -~/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/CLP -~/Library/Containers/com.microsoft.Excel/Data/Library/Application Support/Microsoft/Office/CLP -~/Library/Containers/com.microsoft.PowerPoint/Data/Library/Application Support/Microsoft/Office/CLP -~/Library/Containers/com.microsoft.Outlook/Data/Library/Application Support/Microsoft/Office/CLP -~/Library/Containers/com.microsoft.Word/Data/Library/Logs -~/Library/Containers/com.microsoft.Excel/Data/Library/Logs -~/Library/Containers/com.microsoft.PowerPoint/Data/Library/Logs -~/Library/Containers/com.microsoft.Outlook/Data/Library/Logs -~/Library/Containers/com.microsoft.protection.rms-sharing-mac/Data/Library/Logs -~/Library/Group Containers/UBF8T346G9.Office/mip_policy/mip/logs -``` - -**Silent:** - -This command line parameter argument does the same as `-Reset Default`, but does not print any output - unless an error occurs when attempting to reset: - -``` -ComplianceUtility -Reset Silent -``` - -If a silent reset triggers an error, you can use the additional parameter `-Verbose` to find out more about the cause of the error: - -``` -ComplianceUtility -Reset Silent -Verbose -``` - -You can also review the [Script.log](#script-log-file) file for errors of silent reset. - -### [P] RECORD PROBLEM / -RecordProblem - -> [!IMPORTANT] -> Before you proceed with this option, please close all open applications. - -As a first step, this parameter activates the required logging and then prompts you to reproduce the problem. While you’re doing so, the 'Compliance Utility' collects and records data. Once you have reproduced the problem, all collected files will be stored into the default logs folder (`~/Documents/ComplianceUtility`). Every time you call this option, a new unique subfolder will be created in the logs-folder that reflects the date and time when it was created. - -In the event that you accidentally close the PowerShell window while logging is enabled, the 'Compliance Utility' disables logging the next time you start it. - -> **Note** -> -> When collecting basic [system information](#system-information), the message "'Terminal' wants to access data from other applications" may appear. Since no personal information is collected, only hardware and software data, this has no effect on how you confirm the message. - -### [L] Labels and policies / -CollectLabelsAndPolicies - -This parameter collects Information Protection labels, policies (with detailled actions and rules), auto-label policies and rules from your [Microsoft Purview compliance portal](https://learn.microsoft.com/en-us/microsoft-365/compliance/microsoft-365-compliance-center?view=o365-worldwide) by using the [Exchange Online PowerShell module](#exchange-online-module). - -The results are written to the log files ([Labels.xml](#labels-and-policies-xml), [LabelsDetailedActions.xml](#labels-and-policies-xml), [LabelPolicies.xml](#labels-and-policies-xml), [LabelRules.xml](#labels-and-policies-xml), [AutoLabelPolicies.xml](#labels-and-policies-xml) and [AutoLabelRules.xml](#labels-and-policies-xml)) in the subfolder "Collect\LabelsAndPolicies" of the Logs folder. - -> [!TIP] -> You can use the resulting .xml files to create exact copies of the label and policy settings for troubleshooting purposes, e.g. in test environments. - -### [D] DLP rules and policies / -CollectDLPRulesAndPolicies - -This parameter collects DLP rules and policies, sensitive information type details, rule packages, keyword dictionaries and exact data match schemas from the [Microsoft Purview compliance portal](https://learn.microsoft.com/en-us/microsoft-365/compliance/microsoft-365-compliance-center?view=o365-worldwide) by using the [Exchange Online PowerShell module](#exchange-online-module). - -The results are written to the log files [DlpPolicy.xml](#dlp-rules-xml), [DlpRule.xml](#dlp-rules-xml), [DlpPolicyDistributionStatus.xml](#dlp-rules-xml), [DlpSensitiveInformationType.xml](#dlp-rules-xml), [DlpSensitiveInformationTypeRulePackage.xml](#dlp-rules-xml), [DlpKeywordDictionary.xml](#dlp-rules-xml) and [DlpEdmSchema.xml](#dlp-rules-xml) in the subfolder "Collect\DLPRulesAndPolicies" of the Logs folder. - -### [U] User license details - -This parameter collects the user license details by the [Graph PowerShell module](#graph-module). - -The results are written to the log file [UserLicenseDetails.log](#user-license-log) in the subfolder "Collect" of the Logs folder. - -> **Note** -> -> You must log in with the corresponding Microsoft 365 user account for which you want to check the license details. - -### [Z] COMPRESS LOGS / -CompressLogs - -This command line parameter should always be used at the very end of a scenario. - -This parameter compresses all collected log files and folders into a .zip archive, and the corresponding file is saved to your desktop. In addition, the default logs folder (`~/Documents/ComplianceUtility`) is cleaned. - -### [X] EXIT / - - -This option will asks you whether you want to exit the menu after a confirmation prompt. - -### - / -SkipUpdates - -> [!IMPORTANT] -> Use this parameter only if you are sure that all PowerShell modules are up to date. - -This parameter skips the update check mechanism for entries of the [COLLECT](#collect) menu. - -### - / -Menu - -This will start the 'Compliance Utility' with the default menu. - -### \ - -The 'Compliance Utility' supports the common parameters: Verbose, Debug, ErrorAction, ErrorVariable, WarningAction, WarningVariable, OutBuffer, PipelineVariable, and OutVariable. For more information, see [about_CommonParameters](https:/go.microsoft.com/fwlink/?LinkID=113216). - -# Script log file - -The 'Compliance Utility' creates the following log file. The log file gives an overview of the executed commands and provides a control mechanism to review the results. - -**Script.log** - -This log file collects the actions that has been taken and lists the results. It also logs general environment information from the used client machine, like the Apple macOS edition or PowerShell version. - -# Log files and folders - -The 'Compliance Utility' collects the following log files and folders. - -> **Note** -> -> Not all log files are collected or recorded at all times. It depends on your environment which logs, or traces can be recorded. - -**RECORD PROBLEM** - -Log files and folders collected by the [RECORD PROBLEM](#record-problem) option: - -
    -
  • - -**Office/App CLP logging** - -``` -~/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/Office/CLP -~/Library/Containers/com.microsoft.Excel/Data/Library/Application Support/Microsoft/Office/CLP -~/Library/Containers/com.microsoft.PowerPoint/Data/Library/Application Support/Microsoft/Office/CLP -~/Library/Containers/com.microsoft.Outlook/Data/Library/Application Support/Microsoft/Office/CLP -~/Library/Group Containers/UBF8T346G9.Office/mip_policy/mip/logs -~/Library/Containers/com.microsoft.protection.rms-sharing-mac/Data/Library/Logs -``` - -
  • - -**Office diagnostic logging** - -
    • - -``` -~/Library/Containers/com.microsoft.Word/Data/Library/Logs -~/Library/Containers/com.microsoft.Excel/Data/Library/Logs -~/Library/Containers/com.microsoft.PowerPoint/Data/Library/Logs -~/Library/Containers/com.microsoft.Outlook/Data/Library/Logs -``` - - -
  • - -**SystemInformation.log** - -
    • - -This file contains basic system information.
    - -For more information, please see the following documentation: [system_profiler](https://en.wikipedia.org/wiki/System_profiler). - -
- -**COLLECT** - -Log files collected by the sub-entries of the [COLLECT](#collect) menu. Results are written in the subfolder "Collect" of the Logs folder: - -
    -
  • - -**Labels.xml, LabelsDetailedActions.xml, LabelPolicies.xml, LabelRules.xml, AutoLabelPolicies.xml, AutoLabelRules.xml** - -
    • - -These files are created by the collect option [Labels and policies](#labels-and-policies).
    - -For more information, please see the following documentation: [Get-Label](https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance/get-label?view=exchange-ps), [Get-LabelPolicy](https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance/get-labelpolicy?view=exchange-ps), [Get-AutoSensitivityLabelPolicy](https://learn.microsoft.com/en-us/powershell/module/exchange/get-autosensitivitylabelpolicy) and [Get-AutoSensitivityLabelRule](https://learn.microsoft.com/en-us/powershell/module/exchange/get-autosensitivitylabelrule). - -
  • - -**DlpPolicy.xml, DlpRule.xml, DlpPolicyDistributionStatus.xml, DlpSensitiveInformationType.xml, DlpSensitiveInformationTypeRulePackage.xml, DlpKeywordDictionary.xml and DlpEdmSchema.xml** - -
    • - -These files are created by the collect option [DLP rules and policies](#dlp-rules-and-policies).
    - -For more information, please see the following documentation: [Get-DlpCompliancePolicy](https://learn.microsoft.com/en-us/powershell/module/exchange/get-dlpcompliancepolicy?view=exchange-ps), [Get-DlpComplianceRule](https://learn.microsoft.com/en-us/powershell/module/exchange/get-dlpcompliancerule?view=exchange-ps), [Get-DlpSensitiveInformationType](https://learn.microsoft.com/en-us/powershell/module/exchange/get-dlpsensitiveinformationtype), [Get-DlpSensitiveInformationTypeRulePackage](https://learn.microsoft.com/en-us/powershell/module/exchange/get-dlpsensitiveinformationtyperulepackage), [Get-DlpKeywordDictionary](https://learn.microsoft.com/en-us/powershell/module/exchange/get-dlpkeyworddictionary), and [Get-DlpEdmSchema](https://learn.microsoft.com/en-us/powershell/module/exchange/get-dlpedmschema). - -
  • - -**UserLicenseDetails.log** - -
    • - -This parameter collects the [User license details](#user-license-details) by [Microsoft Graph](https://www.powershellgallery.com/packages/Microsoft.Graph).
    - -For more information, please see the following documentation: -[Get-MgUserLicenseDetail](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/get-mguserlicensedetail), [Get-MgSubscribedSku](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.directorymanagement/get-mgsubscribedsku) and [Product names and service plan identifiers for licensing](https://learn.microsoft.com/en-us/entra/identity/users/licensing-service-plan-reference). - -
- -# Support - -When creating the 'Compliance Utility', great care was taken to ensure quality and functionality. Extensive tests were carried out before publication to intercept and handle any errors. However, there is no guarantee that an error will not occur in a wide variety of configurations and environments. - -Should you ever encounter a problem with the 'Compliance Utility', please visit the [support page](https://github.com/microsoft/ComplianceUtility/blob/main/SUPPORT.md) on the project site. - -### Microsoft Support Policy - -Under this policy, the 'Compliance Utility' remains in support if the following criteria are met: - -* You're using the [lastet version](https://aka.ms/ComplianceUtility/Latest) of the 'Compliance Utility'. -* You must be licensed with a product or service that uses a [Microsoft Information Protection subscription](https://learn.microsoft.com/en-us/office365/servicedescriptions/azure-information-protection#available-plans). - -### How to file issues and get help - -The 'Compliance Utility' uses GitHub [Issues](https://github.com/microsoft/ComplianceUtility/issues) to track problems and feature requests. - -Please check for [known issues](https://github.com/microsoft/ComplianceUtility/blob/main/SUPPORT.md#known-issues) before submitting new issues to avoid duplicates. - -For new issues, file your bug or feature request as a [new Issue](https://github.com/microsoft/ComplianceUtility/issues/new). Please describe the Issue as detailed as possible. A screenshot of the error and/or a step-by-step description of how to reproduce a problem would be very helpful for this. - -
-
-
- -Copyright Microsoft® Corporation. diff --git a/Manuals/3.2.1 (ALPHA)/Manual-Win.md b/Manuals/3.2.1 (ALPHA)/Manual-Win.md deleted file mode 100644 index f220f4a..0000000 --- a/Manuals/3.2.1 (ALPHA)/Manual-Win.md +++ /dev/null @@ -1,1031 +0,0 @@ -# Compliance Utility manual -###### Version 3.2.1 (Windows)

- -**Contents** - -* [Description](#description) - * [MIT License](#mit-license) - * [Microsoft Privacy Statement](#microsoft-privacy-statement) -* [Requirements](#requirements) - * [Internet access](#internet-access) - * [AIPService module](#aipservice-module) - * [Graph PowerShell module](#graph-module) - * [Exchange Online PowerShell module](#exchange-online-module) - * [PowerShell](#ms-powershell) - * [Purview Information Protection module](#pip-module) -* [Installation](#installation) - * [Manual installation](#manual-installaltion) - * [Check installation](#check-installation) -* [Uninstall](#uninstall) -* [User experience](#experience) -* [Features / Parameters](#features-parameters) - * [INFORMATION](#information) - * [HELP](#help-win) - * [RESET](#reset) - * [RECORD PROBLEM](#record-problem) - * [COLLECT](#collect) - * [AIP service configuration](#aip-service-config) - * [Protection templates](#protection-templates) - * [Endpoint URLs](#endpoint-urls) - * [Labels and polcies](#labels-and-policies) - * [DLP rules and policies](#dlp-rules-and-policies) - * [User license details](#user-license-details) - * [COMPRESS LOGS](#compress-logs) - * [EXIT](#exit) -* [Script log file](#script-log-file) -* [Log files and folders](#log-files) -* [Support](#support) - * [Microsoft Support Policy](#support-policy) - * [How to file issues and get help](#get-help) - -## Description - -The 'Compliance Utility' is a powerful tool that helps troubleshoot and diagnose sensitivity labels, policies, settings and more. Whether you need to fix issues or reset configurations, this tool has you covered. - -Have you ever used the Sensitivity button in a [Microsoft 365 App](https://www.microsoft.com/en-us/microsoft-365/products-apps-services) or applied a sensitivity label by right-clicking on a file? If so, you've either used the [Office's built-in labeling experience](https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide) or the [Purview Information Protection client](https://www.microsoft.com/en-us/download/details.aspx?id=53018). If something is not working as expected with your DLP policies, sensitivity labels or you don't see any labels at all the 'Compliance Utility' will help you. - -With the 'Compliance Utility', you can run the most common options without local administrative privileges: -[RESET](#reset), [RECORD PROBLEM](#record-problem), and COLLECT [Endpoint URLs](#endpoint-urls). - -However, if you run the 'Compliance Utility' with local administrative privileges, you will get some more collected logs ([RECORD PROBLEM](#record-problem)) and a complete [RESET](#reset) of all settings, instead of just user-specific settings being reset. By the way: The latter option is sufficient in most cases to reset [Microsoft 365 Apps](https://www.microsoft.com/en-us/microsoft-365/products-apps-services), while a complete reset is usually useful for all other applications. - -> **Note** -> -> If you want to use the 'Compliance Utility' on Apple macOS, you can find the corresponding online manual [here](Manual-Mac.md). - -### MIT License - -Copyright © Microsoft Corporation. - -Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: - -The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. - -THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - -### Microsoft Privacy Statement - -Your privacy is important to us. [This privacy statement](https://privacy.microsoft.com/en-US/privacystatement) explains the personal data Microsoft processes, how Microsoft processes it, and for what purposes. - -## Requirements - -Before you can use the 'Compliance Utility' make sure that your environment fulfils the following requierements. Please update your environment if necessary. - -The 'Compliance Utility' supports the following PowerShell editions: - -* Windows [PowerShell 5.1](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-windows?view=powershell-5.1) (recommended) -* [PowerShell 7.4](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-windows?view=powershell-7.4) (or higher) - -> **Note** -> -> [Differences between Windows PowerShell 5.1 and PowerShell 7.x](https://learn.microsoft.com/en-us/powershell/scripting/whats-new/differences-from-windows-powershell?view=powershell-7.4) - -The 'Compliance Utility' supports the following Windows versions: - -* Windows 11 -* Windows 10 -* Windows Server 2022 -* Windows Server 2019 -* Windows Server 2016 -* Windows Server 2012 R2 and Windows Server 2012 - -The 'Compliance Utility' supports the following Office and Microsoft 365 editions: - -* Microsoft 365 Apps (versions listed in the table of [supported versions](https://learn.microsoft.com/en-us/officeupdates/update-history-microsoft365-apps-by-date#supported-versions) for Microsoft 365 Apps) -* Microsoft Office 2021 LTSC -* Microsoft Office 2019 -* Microsoft Office 2016 - -For information on support for the version of Office you are using, please refer to [Product and Services Lifecycle Information](https://learn.microsoft.com/en-us/lifecycle/products/?terms=Office). - -### Internet access - -The 'Compliance Utility' uses additional sources from the Internet to make its functionality fully available. - -> [!WARNING] -> Unexpected errors may occur, and some features may be limited, if there is no connection to the Internet. - -### AIPService module - -The [AIPService module](https://learn.microsoft.com/en-us/powershell/module/aipservice/?view=azureipps) is required to proceed the options [AIP service configuration](#aip-service-config), [Protection templates](#protection-templates), and [Endpoint URLs](#endpoint-urls) from the [COLLECT](#collect) menu. - -If you do not have this module installed, the 'Compliance Utility' will try to install the current version from [PowerShell Gallery](https://www.powershellgallery.com/packages/AIPService). - -> **Note** -> -> The AIPService module does not yet support PowerShell 7.x. Therefore, unexpected errors may occur because the AIPService module is executed in [compatibility mode](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_windows_powershell_compatibility?view=powershell-7.4) in PowerShell 7.x. - -### Graph PowerShell module - -The [Graph PowerShell module](https://learn.microsoft.com/en-us/graph/overview) is required to proceed the option [User license details](#user-license-details) from the [COLLECT](#collect) menu. - -If you do not have this module installed, the 'Compliance Utility' will try to install the current version from [PowerShell Gallery](https://www.powershellgallery.com/packages/Microsoft.Graph). - -### Exchange Online PowerShell module - -The [Exchange Online PowerShell module](https://learn.microsoft.com/en-us/powershell/exchange/exchange-online-powershell-v2?view=exchange-ps#release-notes) is required to proceed the options [Labels and policies](#labels-and-policies) and [DLP rules and policies](#dlp-rules-and-policies) from the menu [COLLECT](#collect). - -If you do not have this module installed, the 'Compliance Utility' will try to install the current version from [PowerShell Gallery](https://www.powershellgallery.com/packages/ExchangeOnlineManagement). - -### PowerShell (optional) - -Please follow the instructions for [installing PowerShell on Windows](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-windows?view=powershell-7.4) to install it using your preferred method if you want to use the 'Compliance Utility' on [PowerShell 7.4](https://learn.microsoft.com/en-us/powershell/scripting/install/installing-powershell-on-windows?view=powershell-7.4) (or higher). - -### Purview Information Protection module (optional) - -The Purview Information Protection module is installed with the [Purview Information Protection client](https://www.microsoft.com/en-us/download/details.aspx?id=53018) (previously 'Azure Information Protection unified labeling client'). It is used with the [RESET](#reset) feature (by [Clear-AIPAuthentication](https://docs.microsoft.com/en-us/powershell/module/azureinformationprotection/Clear-AIPAuthentication?view=azureipps)) if a corresponding installation of the 'Purview Information Protection client' (or an 'Azure Information Protection unified labeling client') is found. - -If you have not yet done so: [Install or upgrade the information protection client](https://learn.microsoft.com/en-us/purview/information-protection-client?tabs=devices%2Cinstall-client-exe%2Cclassification-file-types%2Cexcluded-folders#install-or-upgrade-the-information-protection-client) now and make sure that you always have the latest version of the 'Purview Information Protection client' installed by checking its [client version release history](https://learn.microsoft.com/en-us/azure/information-protection/rms-client/unifiedlabelingclient-version-release-history#servicing-information-and-timelines) - -> [!CAUTION] -> The Azure Information Protection (AIP) Unified Labeling add-in for Office has been retired on April 11th, 2024. -> -> To continue using sensitivity labels powered by Microsoft Purview Information Protection in Office applications, you must transition to the built-in labeling experience in Microsoft 365 Apps. -> -> **Important retirement milestones:** -> -> * April 11th, 2024 - New Client: Release of the Microsoft Purview Information Protection client for preview on the Microsoft Download Center. This client version 3.0 does not include the AIP Add-in for Office. To continue using the Information Protection Scanner, Viewer and File Labeler, your organization must upgrade and deploy the new client package. -> * April 11th, 2024 - Previous Client: AIP Unified Labeling add-in is retired and no longer in support. Extensions to continue using the AIP add-in are granted on a case-to-case basis; please reach out to Microsoft Support or your account team. -> * May 2024: AIP Unified Labeling add-in permanently disabled in Office. AIP Unified Labeling add-in for Office clients will be blocked from using the add-in and download of label policy will fail for all clients without extensions. -> -> **What you need to do to prepare:** -> -> For detailed migration steps, refer to our playbook: [From bolt-on to built-in – Migrate from Azure Information Protection Add-in.](https://microsoft.github.io/ComplianceCxE/playbooks/AIP2MIPPlaybook/) -> -> For the announcement and FAQs of the retirement, refer to our blog: [Retirement notification for the Azure Information Protection Unified Labeling add-in for Office.](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/retirement-notification-for-the-azure-information-protection/ba-p/3791908) - -> **Note** -> -> Purview Information Protection module does not support PowerShell 7.x. Therefore, unexpected errors may occur because the Purview Information Protection module is executed in [compatibility mode](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_windows_powershell_compatibility?view=powershell-7.4) in PowerShell 7.x. - -# Installation - -The 'Compliance Utility' is available on [PowerShell Gallery](https://www.powershellgallery.com/packages/ComplianceUtility/) and the fastest and easiest way to install it with user privileges is to run the following command in PowerShell: - -``` -Install-Module -Name ComplianceUtility -AllowClobber -Scope CurrentUser -``` - -If you have local administrative privileges, you can run the following command instead: - -``` -Install-Module -Name ComplianceUtility -AllowClobber -``` - -> **Note** -> -> If you do not have a required component installed, you will be prompted to do so. You may need to confirm the installation of NuGet Provider and PowerShell Gallery as a trusted repository, and you may also need to confirm the installation of [PowerShellGet](https://docs.microsoft.com/en-us/powershell/scripting/gallery/installing-psget?view=powershell-5.1). - -#### Allow signed PowerShell scripts - -If PowerShell script execution is restricted in your environment, you must first remove this restriction in order to be able to run the 'Compliance Utility'. To do this, run the `Set-ExecutionPolicy` command with the following parameters: - -``` -Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned -Force -``` - -The 'Compliance Utility' is code-signed with a Microsoft certificate. - -### Manual Installation - -If you’re using the 'Compliance Utility' in an environment that does not have Internet access, you need to proceed with the manual installation. - -To install the 'Compliance Utility' manually, you must create the following folder and copy/paste all 'Compliance Utility' files (`ComplianceUtility.psm1` and `ComplianceUtility.psd1`) into this folder: - -For Windows PowerShell 5.1: - -``` %USERPROFILE%\Documents\WindowsPowerShell\Modules\ComplianceUtility\3.2.1``` - -For Microsoft PowerShell 7.x: - -``` %USERPROFILE%\Documents\PowerShell\Modules\ComplianceUtility\3.2.1``` - -The corresponding path must be listed in the [PSModulePath environment variable](https://docs.microsoft.com/en-us/powershell/scripting/developer/module/modifying-the-psmodulepath-installation-path?view=powershell-5.1#to-view-the-psmodulepath-variable). - -To verify if the installation was successful, please review the [check installation](#check-installation) section. - -> **Note** -> -> Please also consider point [Allow signed PowerShell scripts](#allow-signed-powershell-scripts). - -### Check installation - -To verify if the installation was successful, you can call the `Get-Module` cmdlet with the following parameter: - -``` -Get-Module -Name ComplianceUtility -ListAvailable -``` - -If you find an entry like the following, the installation was successful: - -``` - Directory: C:\Users\\Documents\WindowsPowerShell\Modules - -ModuleType Version Name ExportedCommands ----------- ------- ---- ---------------- -Script 3.2.1 ComplianceUtility {ComplianceUtility, CompUtil, UnifiedLabelingSupportTool} -``` - -# Uninstall - -If you want to completely uninstall the 'Compliance Utility', you must execute the following command: - -``` -Uninstall-Module -Name ComplianceUtility -AllVersions -``` - -If you want to uninstall a specific version, for example version 3.2.0, you must execute the following command: - -``` -Uninstall-Module -Name ComplianceUtility -RequiredVersion 3.2.0 -``` - -If the 'Compliance Utility' was installed manually, you also need to remove it manually by deleting its installation folder. - -> **Note** -> -> Under certain circumstances, you may need to run the uninstallation with administrator privileges. Please request assistance from your administrator if necessary. - -# User experience - -To start the 'Compliance Utility', simply type the following command in a PowerShell window and press enter: - -``` -ComplianceUtility -``` - -When you start the 'Compliance Utility', you'll see the following menu: - -``` -ComplianceUtility: - - [I] INFORMATION - [M] MIT LICENSE - [H] HELP - [R] RESET - [P] RECORD PROBLEM - [C] COLLECT - [Z] COMPRESS LOGS - [X] EXIT - -Please select an option and press enter: -``` - -> **Note** -> -> * For option [RESET](#reset) and [RECORD PROBLEM](#record-problem) you may run as user with local administrative privileges. Please contact your administrator if necessary. -> * When the 'Compliance Utility' is started for the first time and an installation of the 'Unified Labeling Support Tool' is found, it is removed. - -If you select `[C] COLLECT`, a submenu will be expanded, and you can collapse it by selecting option `[C] COLLECT` again: - -``` - [C] COLLECT - ├──[A] AIP service configuration - ├──[T] Protection templates - ├──[E] Endpoint URLs - ├──[L] Labels and policies - ├──[D] DLP rules and policies - └──[U] User license details -``` - -> **Note** -> -> * With an exception of the [User license details](#user-license-details) entry, for the most sub-items of the COLLECT menu, you need to run the 'Compliance Utility' as a user with local administrative privileges. -> * You need to run the 'Compliance Utility' as user with local administrative privileges to continue with option [Endpoint URLs](#endpoint-urls), if the corresponding [Microsoft 365 App](https://www.microsoft.com/en-us/microsoft-365/products-apps-services) is not bootstraped. Please contact your administrator if necessary. -> * You need to know your Microsoft 365 global administrator account information to proceed, as you will be asked for your credentials. - -You can also start the 'Compliance Utility' within the command line. Use the following command line parameter to see a short summary of all available command line parameters: - -``` -ComplianceUtility -Information -``` - -To see a complete list of all command line parameters with details (command line help), execute the following command: - -``` -Get-Help ComplianceUtility -Detailed -``` - -To see the help for a single command line parameter, for example for `-CompressLogs`, run the following command: - -``` -Get-Help ComplianceUtility -Parameter CompressLogs -``` - -# Features / Parameters - -The 'Compliance Utility' provides the following parameters: - -**Syntax:** - -``` -ComplianceUtility - [-Information] - [-License] - [-Help] - [-Reset] - [-RecordProblem] - [-CollectAIPServiceConfiguration] - [-CollectProtectionTemplates] - [-CollectEndpointURLs] - [-CollectLabelsAndPolicies] - [-CollectDLPRulesAndPolicies] - [-CollectUserLicenseDetails] - [-SkipUpdates] - [-CompressLogs] - [-Menu] - -``` - -Description of all features and parameters (feature / parameter): - -### [I] INFORMATION / -Information - -This shows syntax, description and version information. - -### [M] MIT LICENSE / -License - -This displays the [MIT License](#mit-license). - -### [H] HELP / -Help - -This opens the online manual. - -### [R] RESET / -Reset - -> [!IMPORTANT] -> Before you proceed with this option, please close all open applications. - -This option removes all relevant policies, labels and settings. - -> **Note** -> -> * Reset with the default argument will not reset all settings, but only user-specific settings if you run PowerShell with user privileges. This is sufficient in most cases to reset [Microsoft 365 Apps](https://www.microsoft.com/en-us/microsoft-365/products-apps-services), while a complete reset is useful for all other applications. -> * If you want a complete reset, you need to run the 'Compliance Utility' in an administrative PowerShell window as a user with local administrative privileges. - -Valid arguments are: "Default", or "Silent": - -**Default:** - -When you run PowerShell with user privileges, this argument removes all relevant policies, labels and settings: - -``` -ComplianceUtility -Reset Default -``` - -With the above command the following registry keys are cleaned up: - -``` -[HKCU:\SOFTWARE\Classes\Local Settings\Software\Microsoft\MSIPC] -[HKCU:\SOFTWARE\Classes\Local Settings\Software\Microsoft\AIPMigration] -[HKCU:\SOFTWARE\Classes\Microsoft.IPViewerChildMenu] -[HKCU:\SOFTWARE\Microsoft\Cloud\Office] -[HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\DRM] -[HKCU:\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\DRM] -[HKCU:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\DRM] -[HKCU:\SOFTWARE\Microsoft\XPSViewer\Common\DRM] -[HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Identity] -[HKCU:\SOFTWARE\Microsoft\MSIP] -[HKCU:\SOFTWARE\Microsoft\MSOIdentityCRL] -[HKCR:\AllFilesystemObjects\shell\Microsoft.Azip.Inspect] -[HKCR:\AllFilesystemObjects\shell\Microsoft.Azip.RightClick] -``` - -The [DRMEncryptProperty](https://docs.microsoft.com/en-us/deployoffice/security/protect-sensitive-messages-and-documents-by-using-irm-in-office#office-2016-irm-registry-key-options) and [OpenXMLEncryptProperty](https://admx.help/?Category=Office2013&Policy=office15.Office.Microsoft.Policies.Windows::L_Protectdocumentmetadataforpasswordprotected) registry settings are purged of the following keys: - -``` -[HKCU:\SOFTWARE\Policies\Microsoft\Cloud\Office\16.0\Common\Security] -[HKCU:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security] -[HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Security] -``` - -The [UseOfficeForLabelling](https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide#office-built-in-labeling-client-and-other-labeling-solutions) (Use the Sensitivity feature in Office to apply and view sensitivity labels) and [AIPException](https://microsoft.github.io/ComplianceCxE/playbooks/AIP2MIP/AIPException/#configuring-sensitivity-labeling-client-in-m365-apps) (Use the Azure Information Protection add-in for sensitivity labeling) registry setting is purged of the following keys: - -``` -[HKCU:\SOFTWARE\Policies\Microsoft\Cloud\Office\16.0\Common\Security\Labels] -[HKCU:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Labels] -[HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Security\Labels] -``` - -The following file system folders are cleaned up as well: - -``` -%LOCALAPPDATA%\Microsoft\Word\MIPSDK\mip -%LOCALAPPDATA%\Microsoft\Excel\MIPSDK\mip -%LOCALAPPDATA%\Microsoft\PowerPoint\MIPSDK\mip -%LOCALAPPDATA%\Microsoft\Outlook\MIPSDK\mip -%LOCALAPPDATA%\Microsoft\Office\DLP\mip -%LOCALAPPDATA%\Microsoft\Office\CLP -%TEMP%\Diagnostics -%LOCALAPPDATA%\Microsoft\MSIP -%LOCALAPPDATA%\Microsoft\MSIPC -%LOCALAPPDATA%\Microsoft\DRM -``` - -The [Clear-AIPAuthentication](https://docs.microsoft.com/en-us/powershell/module/azureinformationprotection/Clear-AIPAuthentication?view=azureipps) cmdlet is used to reset user settings, if a [Purview Information Protection client](https://www.microsoft.com/en-us/download/details.aspx?id=53018) (or an 'Azure Information Protection unified labeling client') installation is found. - -When you run the 'Compliance Utility' in an administrative PowerShell window as a user with local administrative privileges, the following registry keys are cleaned up in addition: - -``` -[HKLM:\SOFTWARE\Wow6432Node\Microsoft\MSIPC] -[HKLM:\SOFTWARE\Microsoft\MSIPC] -[HKLM:\SOFTWARE\Microsoft\MSDRM] -[HKLM:\SOFTWARE\Wow6432Node\Microsoft\MSDRM] -[HKLM:\SOFTWARE\WOW6432Node\Microsoft\MSIP] -``` - -**Silent:** - -This command line parameter argument does the same as `-Reset Default`, but does not print any output - unless an error occurs when attempting to reset: - -``` -ComplianceUtility -Reset Silent -``` - -If a silent reset triggers an error, you can use the additional parameter `-Verbose` to find out more about the cause of the error: - -``` -ComplianceUtility -Reset Silent -Verbose -``` - -You can also review the [Script.log](#script-log-file) file for errors of silent reset. - -### [P] RECORD PROBLEM / -RecordProblem - -> [!IMPORTANT] -> Before you proceed with this option, please close all open applications. - -As a first step, this parameter activates the required logging and then prompts you to reproduce the problem. While you’re doing so, the 'Compliance Utility' collects and records data. Once you have reproduced the problem, all collected files will be stored into the default logs folder (`%temp%\ComplianceUtility`). Every time you call this option, a new unique subfolder will be created in the logs-folder that reflects the date and time when it was created. - -In the event that you accidentally close the PowerShell window while logging is enabled, the 'Compliance Utility' disables logging the next time you start it. - -> **Note** -> -> Neither CAPI2 or AIP event logs, network trace nor filter drivers are recorded if the 'Compliance Utility' is not run in an administrative PowerShell window as a user with local administrative privileges. - -### [A] AIP service configuration / -CollectAIPServiceConfiguration - -This parameter collects your AIP service configuration information (e.g. [SuperUsers](https://learn.microsoft.com/en-us/azure/information-protection/configure-super-users) or [OnboardingControlPolicy](https://learn.microsoft.com/en-us/powershell/module/aipservice/set-aipserviceonboardingcontrolpolicy?view=azureipps) etc.) by using the [AIPService module](#aipservice-module). - -The results are written to the log file [AIPServiceConfiguration.log](#aip-service-config-log) in the subfolder "Collect" of the Logs folder. - -### [T] Protection templates / -CollectProtectionTemplates - -This parameter collects [protection templates](https://learn.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels-office-apps?view=o365-worldwide#protection-templates-and-sensitivity-labels) of your tenant by using the [AIPService module](#aipservice-module). - -The results are written to the log files [ProtectionTemplates.xml](#protection-templates-xml) and [ProtectionTemplateDetails.xml](#protection-templates-xml) in the subfolder "Collect\ProtectionTemplates" of the Logs folder, and an export of each protection template (.xml) into the subfolder "ProtectionTemplatesBackup". - -> [!TIP] -> You can use this feature to create a backup copy of your protection templates. - -### [E] Endpoint URLs / -CollectEndpointURLs - -This parameter collects important endpoint URLs. The URLs are taken from your local registry or your tenant's Purview service configuration information (by using the [AIPService module](#aipservice-module)), and extended by additional relevant URLs. - -In a first step, this parameter is used to check whether you can access the URL. In a second step, the issuer of the corresponding certificate of the URL is collected. This process is represented by an output with the Tenant Id, Endpoint name, URL, and Issuer of the certificate. For example: - -``` --------------------------------------------------- -Tenant Id: 48fc04bd-c84b-44ac-b7991b7-a4c5eefd5ac1 --------------------------------------------------- - -Endpoint: UnifiedLabelingDistributionPointUrl -URL: https://dataservice.protection.outlook.com -Issuer: CN=DigiCert Cloud Services CA-1, O=DigiCert Inc, C=US -``` - -The results are written to log file [EndpointURLs.log](#endpoint-urls-log) in the subfolder "Collect" of the Logs folder. Additionally, an export of each certificate is saved in the "EndpointURLs" subfolder with the Endpoint URL as the file name and the [.ce_](#cer-files) file extension. - -### [L] Labels and policies / -CollectLabelsAndPolicies - -This parameter collects Information Protection labels, policies (with detailled actions and rules), auto-label policies and rules from your [Microsoft Purview compliance portal](https://learn.microsoft.com/en-us/microsoft-365/compliance/microsoft-365-compliance-center?view=o365-worldwide) by using the [Exchange Online PowerShell module](#exchange-online-module). - -The results are written to the log files ([Labels.xml](#labels-and-policies-xml), [LabelsDetailedActions.xml](#labels-and-policies-xml), [LabelPolicies.xml](#labels-and-policies-xml), [LabelRules.xml](#labels-and-policies-xml), [AutoLabelPolicies.xml](#labels-and-policies-xml) and [AutoLabelRules.xml](#labels-and-policies-xml)) in the subfolder "Collect\LabelsAndPolicies" of the Logs folder, and you can also have a CLP subfolder with the Office CLP policy. - -> [!TIP] -> You can use the resulting .xml files to create exact copies of the label and policy settings for troubleshooting purposes, e.g. in test environments. - -### [D] DLP rules and policies / -CollectDLPRulesAndPolicies - -This parameter collects DLP rules and policies, sensitive information type details, rule packages, keyword dictionaries and exact data match schemas from the [Microsoft Purview compliance portal](https://learn.microsoft.com/en-us/microsoft-365/compliance/microsoft-365-compliance-center?view=o365-worldwide) by using the [Exchange Online PowerShell module](#exchange-online-module). - -The results are written to the log files [DlpPolicy.xml](#dlp-rules-xml), [DlpRule.xml](#dlp-rules-xml), [DlpPolicyDistributionStatus.xml](#dlp-rules-xml), [DlpSensitiveInformationType.xml](#dlp-rules-xml), [DlpSensitiveInformationTypeRulePackage.xml](#dlp-rules-xml), [DlpKeywordDictionary.xml](#dlp-rules-xml) and [DlpEdmSchema.xml](#dlp-rules-xml) in the subfolder "Collect\DLPRulesAndPolicies" of the Logs folder. - -### [U] User license details - -This parameter collects the user license details by the [Graph PowerShell module](#graph-module). - -The results are written to log file [UserLicenseDetails.log](#user-license-log) in the subfolder "Collect" of the Logs folder. - -> **Note** -> -> You must log in with the corresponding Microsoft 365 user account for which you want to check the license details. - -### [Z] COMPRESS LOGS / -CompressLogs - -This command line parameter should always be used at the very end of a scenario. - -This parameter compresses all collected log files and folders into a .zip archive, and the corresponding file is saved to your desktop. In addition, the default logs folder (`%temp%\ComplianceUtility`) is cleaned. - -### [X] EXIT / - - -This option will asks you whether you want to exit the menu after a confirmation prompt. - -### - / -SkipUpdates - -> [!IMPORTANT] -> Use this parameter only if you are sure that all PowerShell modules are up to date. - -This parameter skips the update check mechanism for all entries of the [COLLECT](#collect) menu. - -### - / -Menu - -This will start the 'Compliance Utility' with the default menu. - -### \ - -The 'Compliance Utility' supports the common parameters: Verbose, Debug, ErrorAction, ErrorVariable, WarningAction, WarningVariable, OutBuffer, PipelineVariable, and OutVariable. For more information, see [about_CommonParameters](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_commonparameters). - -# Script log file - -The 'Compliance Utility' creates the following log file. The log file gives an overview of the executed commands and provides a control mechanism to review the results. - -**Script.log** - -This log file collects the actions that has been taken and lists the results. It also logs general environment information from the used client machine, like the Windows edition or Windows PowerShell version. - -# Log files and folders - -The 'Compliance Utility' collects the following log files and folders. - -> **Note** -> -> Not all log files are collected or recorded at all times. It depends on your environment which logs, or traces can be recorded. - -### RECORD PROBLEM - -Log files and folders collected by the [RECORD PROBLEM](#record-problem) option when you run the 'Compliance Utility' with user privileges: - -
    -
  • - -**Tasklist.log** - -
    • - -This file contains a list of currently running processes on the local computer.
    - -For more information, please see the following documentation: [tasklist](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/tasklist). - -
  • - -**WinIPConfig.txt and IPConfigAll.log** - -
    • - -These files show all current TCP/IP network configuration settings.
    - -For more information, please see the following documentation: [ipconfig](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/ipconfig). - -
  • - -**WinHTTP.log and WinHTTP_WoW6432.log** - -
    • - -These files contain the WinHTTP proxy configuration and are collected with Netsh.exe.
    - -For more information, please see the following documentation: [Netsh command syntax, contexts, and formatting](https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts). - -
  • - -**AutoConfigURL.log** - -
    • - -This file contains information of the auto proxy configuration settings.
    - -For more information, please see the following documentation: [Automatic Proxy Detection](https://docs.microsoft.com/en-us/dotnet/framework/network-programming/automatic-proxy-detection), and [Use a proxy server in Windows](https://support.microsoft.com/en-us/windows/use-a-proxy-server-in-windows-03096c53-0554-4ffe-b6ab-8b1deee8dae1). - -
  • - -**ProblemSteps.zip** - -
    • - -This file records the exact steps you took when the problem occured. It was created by the Steps Recorder (psr.exe).
    - -For more information, please see the following documentation: [Record steps to reproduce a problem](https://support.microsoft.com/en-us/help/22878/windows-10-record-steps) and [Steps Recorder deprecation](https://support.microsoft.com/en-us/windows/steps-recorder-deprecation-a64888d7-8482-4965-8ce3-25fb004e975f). - -
  • - -**MSIPC/MSIP folders, AIPLogs.zip** - -
    • - -The following log folders contain MSIP/MSIPC logging information:
    - -``` -%LOCALAPPDATA%\Microsoft\MSIP -%LOCALAPPDATA%\Microsoft\MSIPC -``` - -If you have installed Purview Information Protection client (previously 'Azure Information Protection unified labeling client'), the folders containing the AIPLogs.zip file are collected.
    - -For more information, please see the following documentation for the used PowerShell command: [Export-AIPLogs](https://docs.microsoft.com/en-us/powershell/module/azureinformationprotection/export-aiplogs?view=azureipps). - -
  • - -**MIP plugin for Adobe Acrobat logs** - -
    • - -The following log folders contain logging information:
    - -``` -%LOCALAPPDATA%\Microsoft\RMSLocalStorage\MIP\logs -%USERPROFILE%\appdata\locallow\Microsoft\RMSLocalStorage\mip\logs -``` - -For more information, please see the following information: [Adobe reader and Microsoft Information Protection integration FAQs](https://techcommunity.microsoft.com/t5/microsoft-information-protection/adobe-reader-and-microsoft-information-protection-integration/ba-p/482219). - -
  • - -**Application.evtx** - -
    • - -This file is the Application Windows Event Log. - -
  • - -**System.evtx** - -
    • - -This file is the System Windows Event Log. - -
  • - -**office.log** - -
    • - -This file is the Office TCOTrace log. - -
  • - -**Office logging** - -
    • - -An Office log file collected from the users temp folder. For example: - -``` -%TEMP%\MACHINENAME-20230209-133005.log -``` - -The log file name reflects the compuer name, and date and time when the log was created.
    - -For more information, please see the following documentation: [How to enable Microsoft 365 Apps for enterprise ULS logging](https://learn.microsoft.com/en-us/office/troubleshoot/diagnostic-logs/how-to-enable-office-365-proplus-uls-logging) (part "For sign-in or activation issues, add the following registry key").

    -In addition, Office diagnostics data will be collected from the following folder: - -``` -%TEMP%\Diagnostics -``` - -The resulting log files collected in the above folder can be viewed with the Microsoft [ULS viewer](https://www.microsoft.com/en-us/download/details.aspx?id=44020). - -
  • - -**MIPSDK-Word.zip, MIPSDK-Excel.zip, MIPSDK-PowerPoint.zip, and MIPSDK-Outlook.zip** - -
    • - -A respective .zip file contains the contents of the corresponding MIPSDK log folder collected at the following locations: - -``` -%LOCALAPPDATA%\Microsoft\Word\MIPSDK\mip -%LOCALAPPDATA%\Microsoft\Excel\MIPSDK\mip -%LOCALAPPDATA%\Microsoft\PowerPoint\MIPSDK\mip -%LOCALAPPDATA%\Microsoft\Outlook\MIPSDK\mip -``` - -Each .zip file contains multiple .json files. - -
  • - -**LabelsAndPolicies.zip** - -
    • - -This .zip file is created by the option [RECORD PROBLEM](#record-problem).
    - -The file contains the cached labels and policies .xml files from the following folder:
    - -``` -%LOCALAPPDATA%\Microsoft\Office\CLP -``` - -
  • - -**CertMachine.log and CertUser.log** - -
    • - -These files contain certification information and were collected with Certutil.exe.
    - -For more information, please see the following documentation: [certutil](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil). - -
  • - -**EnvVar.log** - -
    • - -This file contains environment variables information from the system ("Get-ChildItem Env:").
    - -For more information about this PowerShell command, please see the following documentation: [Get-ChildItem](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-childitem?view=powershell-5.1). - -
  • - -**Programs32.csv** - -
    • - -This file contains the installed software (32-bit) from the system. This file were taken from this registry key: - -``` -[HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall] -``` - -
  • - -**Programs64.csv** - -
    • - -This file contains the installed software (64-bit) from the system. This file were taken from this registry key: - -``` -[HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall] -``` - -
  • - -**ScheduledTasks.csv** - -
    • - -This file contains a collection of Scheduled Tasks. - -For more information, please see the following documentation: [Get-ScheduledTask](https://learn.microsoft.com/en-us/powershell/module/scheduledtasks/get-scheduledtask) and [Get-ScheduledTaskInfo](https://learn.microsoft.com/en-us/powershell/module/scheduledtasks/get-scheduledtaskinfo). - -
  • - -**Registry.log** - -
    • - -This file contains several regsitry keys related to the Office/Microsoft 365 Apps and Information Protection configuration. The content were taken from these registry keys: - -``` -[HKLM:\Software\Classes\MSIP.ExcelAddin] -[HKLM:\Software\Classes\MSIP.WordAddin] -[HKLM:\Software\Classes\MSIP.PowerPointAddin] -[HKLM:\Software\Classes\MSIP.OutlookAddin] -[HKLM:\Software\Classes\AllFileSystemObjects\shell\Microsoft.Azip.RightClick] -[HKLM:\Software\Microsoft\MSIPC] -[HKLM:\Software\Microsoft\Office\Word\Addins] -[HKLM:\Software\Microsoft\Office\Excel\Addins] -[HKLM:\Software\Microsoft\Office\PowerPoint\Addins] -[HKLM:\Software\Microsoft\Office\Outlook\Addins] -[HKLM:\Software\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\Word\Addins] -[HKLM:\Software\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\Excel\Addins] -[HKLM:\Software\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\PowerPoint\Addins] -[HKLM:\Software\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\Outlook\Addins] -[HKLM:\Software\WOW6432Node\Microsoft\MSIPC] -[HKLM:\Software\Wow6432Node\Microsoft\Office\Word\Addins] -[HKLM:\Software\Wow6432Node\Microsoft\Office\Excel\Addins] -[HKLM:\Software\Wow6432Node\Microsoft\Office\PowerPoint\Addins] -[HKLM:\Software\Wow6432Node\Microsoft\Office\Outlook\Addins] -[HKCU:\Software\Microsoft\MSIP] -[HKCU:\Software\Microsoft\Office\16.0\Common\DRM] -[HKCU:\Software\Microsoft\Office\16.0\Common\Security] -[HKCU:\Software\Microsoft\Office\16.0\Common\Identity] -[HKCU:\Software\Microsoft\Office\16.0\Common\Internet] -[HKCU:\Software\Microsoft\Office\Word\Addins] -[HKCU:\Software\Microsoft\Office\Excel\Addins] -[HKCU:\Software\Microsoft\Office\PowerPoint\Addins] -[HKCU:\Software\Microsoft\Office\Outlook\Addins] -[HKCU:\Software\Microsoft\Office\16.0\Word\Resiliency] -[HKCU:\Software\Microsoft\Office\16.0\Excel\Resiliency] -[HKCU:\Software\Microsoft\Office\16.0\PowerPoint\Resiliency] -[HKCU:\Software\Microsoft\Office\16.0\Outlook\Resiliency] -[HKCU:\Software\Classes\Local Settings\Software\Microsoft\MSIPC] -[HKCR:\MSIP.ExcelAddin] -[HKCR:\MSIP.WordAddin] -[HKCR:\MSIP.PowerPointAddin] -[HKCR:\MSIP.OutlookAddin] -[HKCR:\Local Settings\Software\Microsoft\MSIPC] -[HKCU:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\DRM] -[HKCU:\SOFTWARE\Policies\Microsoft\Cloud\Office\16.0\Common\Security] -[HKCU:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security] -[HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Security] -[HKCU:\Software\Microsoft\Office\16.0\Common\Licensing\CurrentSkuIdAggregationForApp] -[HKCU:\Software\Microsoft\Office\16.0\Common\Licensing\LastKnownC2RProductReleaseId] -``` - -
  • - -**Gpresult.htm** - -
    • - -This file contains the Resultant Set of Policy (RSoP) information from the system.
    - -For more information, please see the following documentation: [gpresult](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult). - -
  • - -**BaseUTCOffset.log** - -
    • - -This file contains time zone offset information.
    - -For more information about this PowerShell command, please see the following documentation: [Get-TimeZone](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-timezone?view=powershell-5.1). - -
  • - -**SystemInformation.log** - -
    • - -This file contains basic system information.
    - -For more information, please see the following documentation: [Get-ComputerInfo](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-computerinfo). - -
- -Log files and folders additionally collected by the [RECORD PROBLEM](#record-problem) option when you run the 'Compliance Utility' with administrative privileges: - -
    -
  • - -**CAPI2.evtx** - -
    • - -This file is the CAPI2 Windows Event Log.
    - -For more information, please see the following documentation: [wevtutil](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil) (export-log). - -
  • - -**AIP.evtx** - -
    • - -This file is the Azure Information Protection Windows Event Log. - -For more information, please see the following documentation: [wevtutil](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil) (export-log). - -
  • - -**PIP.evtx** - -
    • - -This file is the Purview Information Protection Windows Event Log. - -For more information, please see the following documentation: [wevtutil](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil) (export-log). - -
  • - -**NetMon.etl** - -
    • - -This file is a network trace recorded by Netsh.exe.
    - -For more information, please see the following documentation: [Netsh command syntax, contexts, and formatting](https://docs.microsoft.com/en-us/windows-server/networking/technologies/netsh/netsh-contexts). - -
  • - -**Filters.log** - -
    • - -This file contain a list of Windows filter drivers.
    - -For more information about this PowerShell command, please see the following documentation: [Fltmc.exe](https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/development-and-testing-tools#fltmcexe-control-program). - -
- -### COLLECT - -Log files and folders collected via the sub-entries of the [COLLECT](#collect) menu. Results are written in the subfolder "Collect" of the Logs folder: - -
    -
  • - -**AIPServiceConfiguration.log** - -
    • - -This file is only collected if you selected [AIP service configuration](#aip-service-config). The file contains the AIP service configuration of your tenant.
    - -For more information, please see the following documentation: [Get-AipServiceConfiguration](https://docs.microsoft.com/de-de/powershell/module/aipservice/get-aipserviceconfiguration). - -
  • - -**ProtectionTemplates.xml, ProtectionTemplateDetails.xml, and .xml backup files** - -
    • - -These files are collected if you selected [Protection templates](#protection-templates) from the collect menu.
    - -The "ProtectionTemplates.xml" file contains the Purview Information Protection templates and the "ProtectionTemplateDetails.xml" file contains the template details. Additionally, an export of each protection template is saved in the "ProtectionTemplatesBackup" subfolder with the protection template ID as the file name and the .xml file extension.
    - -For more information, please see the following documentation: [Get-ServiceTemplate](https://docs.microsoft.com/en-us/powershell/module/aipservice/get-aipservicetemplate), and [Export-ServiceTemplate](https://docs.microsoft.com/en-us/powershell/module/aipservice/export-aipservicetemplate?view=azureipps). - -
  • - -**Labels.xml, LabelsDetailedActions.xml, LabelPolicies.xml, LabelRules.xml, AutoLabelPolicies.xml, AutoLabelRules.xml** - -
    • - -These files are created by the collect option [Labels and policies](#labels-and-policies). If you have not initiated a [RESET](#reset) before collecting logs, you can also have a CLP subfolder with the Office CLP policy folder.
    - -For more information, please see the following documentation: [Get-Label](https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance/get-label?view=exchange-ps), [Get-LabelPolicy](https://docs.microsoft.com/en-us/powershell/module/exchange/policy-and-compliance/get-labelpolicy?view=exchange-ps), [Get-AutoSensitivityLabelPolicy](https://learn.microsoft.com/en-us/powershell/module/exchange/get-autosensitivitylabelpolicy) and [Get-AutoSensitivityLabelRule](https://learn.microsoft.com/en-us/powershell/module/exchange/get-autosensitivitylabelrule). - -
  • - -**DlpPolicy.xml, DlpRule.xml, DlpPolicyDistributionStatus.xml, DlpSensitiveInformationType.xml, DlpSensitiveInformationTypeRulePackage.xml, DlpKeywordDictionary.xml and DlpEdmSchema.xml** - -
    • - -These files are created by the collect option [DLP rules and policies](#dlp-rules-and-policies).
    - -For more information, please see the following documentation: [Get-DlpCompliancePolicy](https://learn.microsoft.com/en-us/powershell/module/exchange/get-dlpcompliancepolicy?view=exchange-ps), [Get-DlpComplianceRule](https://learn.microsoft.com/en-us/powershell/module/exchange/get-dlpcompliancerule?view=exchange-ps), [Get-DlpSensitiveInformationType](https://learn.microsoft.com/en-us/powershell/module/exchange/get-dlpsensitiveinformationtype), [Get-DlpSensitiveInformationTypeRulePackage](https://learn.microsoft.com/en-us/powershell/module/exchange/get-dlpsensitiveinformationtyperulepackage), [Get-DlpKeywordDictionary](https://learn.microsoft.com/en-us/powershell/module/exchange/get-dlpkeyworddictionary), and [Get-DlpEdmSchema](https://learn.microsoft.com/en-us/powershell/module/exchange/get-dlpedmschema). - -
  • - -**EndpointURLs.log** - -
    • - -This file contains information for endpoint URLs and the certificate issuer collected by the [Endpoint URLs](#endpoint-urls) option. - -
  • - -**.cer files (.ce_)** - -
    • - -These files are created by the option [Endpoint URLs](#endpoint-urls).
    - -> **Note** -> -> The files are exported with the file extension .ce_ instead of .cer, since some security programs can block these files. - -
  • - -**UserLicenseDetails.log** - -
    • - -This parameter collects the [User license details](#user-license-details) by [Microsoft Graph](https://www.powershellgallery.com/packages/Microsoft.Graph).
    - -For more information, please see the following documentation: -[Get-MgUserLicenseDetail](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/get-mguserlicensedetail), [Get-MgSubscribedSku](https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.directorymanagement/get-mgsubscribedsku) and [Product names and service plan identifiers for licensing](https://learn.microsoft.com/en-us/entra/identity/users/licensing-service-plan-reference). - -
- -# Support - -When creating the 'Compliance Utility', great care was taken to ensure quality and functionality. Extensive tests were carried out before publication to intercept and handle any errors. However, there is no guarantee that an error will not occur in a wide variety of configurations and environments. - -Should you ever encounter a problem with the 'Compliance Utility', please visit the [support page](https://github.com/microsoft/ComplianceUtility/blob/main/SUPPORT.md) on the project site. - -### Microsoft Support Policy - -Under this policy, the 'Compliance Utility' remains in support if the following criteria are met: - -* You're using the [lastet version](https://aka.ms/ComplianceUtility/Latest) of the 'Compliance Utility'. -* You must be licensed with a product or service that uses a [Microsoft Information Protection subscription](https://learn.microsoft.com/en-us/office365/servicedescriptions/azure-information-protection#available-plans). - -### How to file issues and get help - -The 'Compliance Utility' uses GitHub [Issues](https://github.com/microsoft/ComplianceUtility/issues) to track problems and feature requests. - -Please check for [known issues](https://github.com/microsoft/ComplianceUtility/blob/main/SUPPORT.md#known-issues) before submitting new issues to avoid duplicates. - -For new issues, file your bug or feature request as a [new Issue](https://github.com/microsoft/ComplianceUtility/issues/new). Please describe the Issue as detailed as possible. A screenshot of the error and/or a step-by-step description of how to reproduce a problem would be very helpful for this. - -
-
-
- -Copyright Microsoft® Corporation.