Skip to content

Commit 13adf2e

Browse files
JohnDupreyJohnDuprey
committed
fix: audit log lookups and timer calculations
Improve Get-CIPPTimerFunctions: add a warning when Cronos.dll fails to load, use a separate DueOccurrence variable for determining due runs, compute a safe NextOccurrenceUtc via the next future occurrence (DateTimeOffset) and use UtcDateTime in comparisons to avoid incorrect timezone conversions. Improve Test-CIPPAuditLogRules: prefer cached directory data from CippReportingDB (New-CIPPDbRequest) and fall back to a Graph bulk request only when the DB is empty/unavailable; avoid repeated Graph calls by caching partner users in the cacheauditloglookups table (PartitionKey '_partner', RowKey 'users') and add informational logging for these code paths.
1 parent 4310485 commit 13adf2e

2 files changed

Lines changed: 84 additions & 45 deletions

File tree

‎Modules/CIPPCore/Public/Get-CIPPTimerFunctions.ps1‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,9 @@ function Get-CIPPTimerFunctions {
5050
try {
5151
$Cronos = Join-Path -Path $CIPPCoreModuleRoot -ChildPath 'lib\Cronos.dll'
5252
Add-Type -Path $Cronos
53-
} catch {}
53+
} catch {
54+
Write-Warning "Failed to load Cronos.dll from '$Cronos': $_"
55+
}
5456
}
5557

5658
$CIPPRoot = (Get-Item $CIPPCoreModuleRoot).Parent.Parent
@@ -111,26 +113,27 @@ function Get-CIPPTimerFunctions {
111113

112114
$Now = [DateTime]::UtcNow
113115
if ($ListAllTasks.IsPresent) {
114-
$NextOccurrence = $Cron.GetNextOccurrence($Now, $ScheduleTimeZone)
116+
$DueOccurrence = $Cron.GetNextOccurrence($Now, $ScheduleTimeZone)
115117
} else {
116118
$NextOccurrences = $Cron.GetOccurrences($Now.AddMinutes(-15), $Now.AddMinutes(15), $ScheduleTimeZone)
117119
if (!$Status -or $Status.LastOccurrence -eq 'Never') {
118-
$NextOccurrence = $NextOccurrences | Where-Object { $_ -le [DateTime]::UtcNow } | Select-Object -First 1
120+
$DueOccurrence = $NextOccurrences | Where-Object { $_ -le [DateTime]::UtcNow } | Select-Object -First 1
119121
} else {
120-
$NextOccurrence = $NextOccurrences | Where-Object { $_ -gt $Status.LastOccurrence.DateTime.ToUniversalTime() -and $_ -le [DateTime]::UtcNow } | Select-Object -First 1
122+
$DueOccurrence = $NextOccurrences | Where-Object { $_ -gt $Status.LastOccurrence.UtcDateTime -and $_ -le [DateTime]::UtcNow } | Select-Object -First 1
121123
}
122124
}
123125

124-
125-
if ($NextOccurrence -or $ListAllTasks.IsPresent) {
126+
if ($DueOccurrence -or $ListAllTasks.IsPresent) {
127+
$NextFutureOccurrence = $Cron.GetNextOccurrence([DateTime]::UtcNow, $ScheduleTimeZone)
128+
$NextOccurrenceUtc = if ($NextFutureOccurrence) { [DateTimeOffset]::new($NextFutureOccurrence.ToUniversalTime()) } else { $null }
126129
if (!$Status) {
127130
$Status = [pscustomobject]@{
128131
PartitionKey = 'Timer'
129132
RowKey = $Orchestrator.Id
130133
Command = $Orchestrator.Command
131134
Cron = $CronString
132135
LastOccurrence = 'Never'
133-
NextOccurrence = $NextOccurrence.ToUniversalTime()
136+
NextOccurrence = $NextOccurrenceUtc
134137
Status = 'Not Scheduled'
135138
OrchestratorId = ''
136139
RunOnProcessor = $RunOnProcessor
@@ -143,7 +146,7 @@ function Get-CIPPTimerFunctions {
143146
if ($Orchestrator.IsSystem -eq $true -or $ResetToDefault.IsPresent) {
144147
$Status.Cron = $Orchestrator.Cron
145148
}
146-
$Status.NextOccurrence = $NextOccurrence.ToUniversalTime()
149+
$Status.NextOccurrence = $NextOccurrenceUtc
147150
$PreferredProcessor = $Orchestrator.PreferredProcessor ?? ''
148151
if ($Status.PSObject.Properties.Name -notcontains 'PreferredProcessor') {
149152
$Status | Add-Member -MemberType NoteProperty -Name 'PreferredProcessor' -Value $PreferredProcessor -Force
@@ -159,7 +162,7 @@ function Get-CIPPTimerFunctions {
159162
Command = $Orchestrator.Command
160163
Parameters = $Orchestrator.Parameters ?? @{}
161164
Cron = $CronString
162-
NextOccurrence = $NextOccurrence.ToUniversalTime()
165+
NextOccurrence = $NextOccurrenceUtc
163166
LastOccurrence = $Status.LastOccurrence
164167
Status = $Status.Status
165168
OrchestratorId = $Status.OrchestratorId

‎Modules/CIPPCore/Public/Webhooks/Test-CIPPAuditLogRules.ps1‎

Lines changed: 72 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -187,34 +187,59 @@ function Test-CIPPAuditLogRules {
187187
}
188188

189189
if (!$Lookups -or $NeedsRefresh) {
190-
# Collect bulk data for users/groups/devices/applications
191-
$Requests = @(
192-
@{
193-
id = 'users'
194-
url = '/users?$select=id,displayName,userPrincipalName,accountEnabled&$top=999'
195-
method = 'GET'
196-
}
197-
@{
198-
id = 'groups'
199-
url = '/groups?$select=id,displayName,mailEnabled,securityEnabled&$top=999'
200-
method = 'GET'
201-
}
202-
@{
203-
id = 'devices'
204-
url = '/devices?$select=id,displayName,deviceId&$top=999'
205-
method = 'GET'
206-
}
207-
@{
208-
id = 'servicePrincipals'
209-
url = '/servicePrincipals?$select=id,displayName&$top=999'
210-
method = 'GET'
190+
# Try CippReportingDB first (pre-populated by timer, same pattern as Add-CIPPApplicationPermission)
191+
Write-Information "Checking CippReportingDB for directory data for tenant $TenantFilter"
192+
try {
193+
$Users = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Users')
194+
$ServicePrincipals = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'ServicePrincipals')
195+
} catch {
196+
Write-Information "CippReportingDB query failed for ${TenantFilter}: $($_.Exception.Message)"
197+
$Users = @()
198+
$ServicePrincipals = @()
199+
}
200+
201+
if (!$Users -or !$ServicePrincipals) {
202+
# DB cache is empty or unavailable, fall back to Graph bulk request
203+
Write-Information "CippReportingDB has no data for $TenantFilter, falling back to Graph bulk request"
204+
$Requests = @(
205+
@{
206+
id = 'users'
207+
url = '/users?$select=id,displayName,userPrincipalName,accountEnabled&$top=999'
208+
method = 'GET'
209+
}
210+
@{
211+
id = 'groups'
212+
url = '/groups?$select=id,displayName,mailEnabled,securityEnabled&$top=999'
213+
method = 'GET'
214+
}
215+
@{
216+
id = 'devices'
217+
url = '/devices?$select=id,displayName,deviceId&$top=999'
218+
method = 'GET'
219+
}
220+
@{
221+
id = 'servicePrincipals'
222+
url = '/servicePrincipals?$select=id,displayName&$top=999'
223+
method = 'GET'
224+
}
225+
)
226+
$Response = New-GraphBulkRequest -TenantId $TenantFilter -Requests $Requests
227+
$Users = ($Response | Where-Object { $_.id -eq 'users' }).body.value ?? @()
228+
$Groups = ($Response | Where-Object { $_.id -eq 'groups' }).body.value ?? @()
229+
$Devices = ($Response | Where-Object { $_.id -eq 'devices' }).body.value ?? @()
230+
$ServicePrincipals = ($Response | Where-Object { $_.id -eq 'servicePrincipals' }).body.value ?? @()
231+
$Response = $null
232+
} else {
233+
try {
234+
$Groups = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Groups')
235+
$Devices = @(New-CIPPDbRequest -TenantFilter $TenantFilter -Type 'Devices')
236+
} catch {
237+
Write-Information "CippReportingDB Groups/Devices query failed for ${TenantFilter}: $($_.Exception.Message)"
238+
$Groups = @()
239+
$Devices = @()
211240
}
212-
)
213-
$Response = New-GraphBulkRequest -TenantId $TenantFilter -Requests $Requests
214-
$Users = ($Response | Where-Object { $_.id -eq 'users' }).body.value ?? @()
215-
$Groups = ($Response | Where-Object { $_.id -eq 'groups' }).body.value ?? @()
216-
$Devices = ($Response | Where-Object { $_.id -eq 'devices' }).body.value ?? @()
217-
$ServicePrincipals = ($Response | Where-Object { $_.id -eq 'servicePrincipals' }).body.value ?? @()
241+
Write-Information "Loaded from CippReportingDB: $($Users.Count) users, $($Groups.Count) groups, $($Devices.Count) devices, $($ServicePrincipals.Count) service principals"
242+
}
218243

219244
# Build hashtables for O(1) GUID lookups
220245
Write-Information "Building hashtable lookups for tenant $TenantFilter"
@@ -342,17 +367,28 @@ function Test-CIPPAuditLogRules {
342367
}
343368
}
344369

345-
# partner users
346-
$PartnerUsers = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$select=id,displayName,userPrincipalName,accountEnabled&`$top=999" -AsApp $true -NoAuthCheck $true
347-
348-
# Build partner user hashtable
349-
$PartnerUserLookup = @{}
350-
foreach ($PartnerUser in $PartnerUsers) {
351-
if (![string]::IsNullOrEmpty($PartnerUser.id)) {
352-
$PartnerUserLookup[$PartnerUser.id] = $PartnerUser
370+
# Partner users - cache in cacheauditloglookups (PartitionKey '_partner') to avoid a fresh Graph fetch every invocation
371+
$PartnerUsersCache = Get-CIPPAzDataTableEntity @Table -Filter "PartitionKey eq '_partner' and RowKey eq 'users' and Timestamp gt datetime'$1dayago'"
372+
if ($PartnerUsersCache -and $PartnerUsersCache.Format -eq 'hashtable') {
373+
Write-Information 'Loading partner user hashtable from cache'
374+
$PartnerUserLookup = ($PartnerUsersCache.Data | ConvertFrom-Json -ErrorAction SilentlyContinue -AsHashtable) ?? @{}
375+
} else {
376+
$PartnerUsers = New-GraphGetRequest -uri "https://graph.microsoft.com/beta/users?`$select=id,displayName,userPrincipalName,accountEnabled&`$top=999" -AsApp $true -NoAuthCheck $true
377+
$PartnerUserLookup = @{}
378+
foreach ($PartnerUser in $PartnerUsers) {
379+
if (![string]::IsNullOrEmpty($PartnerUser.id)) {
380+
$PartnerUserLookup[$PartnerUser.id] = $PartnerUser
381+
}
353382
}
383+
Add-CIPPAzDataTableEntity @Table -Entity @{
384+
PartitionKey = '_partner'
385+
RowKey = 'users'
386+
Data = [string]($PartnerUserLookup | ConvertTo-Json -Compress)
387+
Format = 'hashtable'
388+
} -Force
389+
$PartnerUsers = $null
354390
}
355-
Write-Information "Built partner user hashtable: $($PartnerUserLookup.Count) partner users"
391+
Write-Information "Partner user hashtable: $($PartnerUserLookup.Count) partner users"
356392

357393
Write-Warning '## Audit Log Configuration ##'
358394
Write-Information ($Configuration | ConvertTo-Json -Depth 10)

0 commit comments

Comments
 (0)