@echo off
REM Ver 3.2
setlocal

echo **** License Terms ****
echo Copyright (c) 2024. All Rights Reserved. 
echo This software is released under the MIT License(http://opensource.org/licenses/mit-license.php)
echo Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
echo;
echo The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
echo;
echo THE SOFTWARE IS ONLY FOR TROUBLESHOOTING PURPUSE, AND PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE
echo **** License Terms ****
echo;
set /p yn_check="IF YOU AGREE THE LICENSE TERMS, Hit (y)
IF %yn_check%==y (
  goto run
) ELSE (
  echo Close the window.
  pause
  exit /b
)

:run
:menu
echo *** Office Log Collect. Enter -Start or -Stop ***
set /p command=Command: 

if /i "%command%"=="-Start" (
    goto start
) else if /i "%command%"=="-Stop" (
    goto stop
) else (
    echo Invalid command. Enter command again
    goto menu
)

:start
if not exist "C:\MS_DATA" (
    mkdir "C:\MS_DATA"
)

set "COMPUTER_NAME=%COMPUTERNAME%"
set "dateStr=%date%"
set "timeStr=%time: =0%"

set "YY=%dateStr:~2,2%"
set "MM=%dateStr:~5,2%"
set "DD=%dateStr:~8,2%"
set "YYMMDD=%YY%%MM%%DD%"

set "HH=%timeStr:~0,2%"
set "mm=%timeStr:~3,2%"
set "ss=%timeStr:~6,2%"
set "HHmmss=%HH%%mm%%ss%"

set "FOLDER_NAME=OLC_%COMPUTER_NAME%_%YYMMDD%-%HHmmss%"

set MS_DATA_PATH="C:\MS_DATA\%FOLDER_NAME%"


set MS_WORK_PATH= %MS_DATA_PATH%\before
mkdir %MS_WORK_PATH%

REG EXPORT HKCU\Software\Microsoft %MS_WORK_PATH%\HKCU_OFFICE.reg
REG EXPORT HKCU\Software\Policies\Microsoft %MS_WORK_PATH%\HKCU_POLICY_OFFICE.reg
REG EXPORT HKCU\Software\Microsoft\AuthN %MS_WORK_PATH%\AuthN.reg
REG EXPORT HKLM\Software\Microsoft\Office %MS_WORK_PATH%\HKLM_OFFICE.reg
REG EXPORT HKLM\Software\Policies\Microsoft %MS_WORK_PATH%\HKLM_POLICY_OFFICE.reg
REG EXPORT HKLM\Software\WOW6432Node\Microsoft\Office %MS_WORK_PATH%\HKLM_WOW64_OFFICE.reg
REG EXPORT HKLM\Software\WOW6432Node\Policies\Microsoft\Office %MS_WORK_PATH%\HKLM_WOW64_POLICY_OFFICE.reg
REG EXPORT HKLM\Software\Classes\CLSID %MS_WORK_PATH%\CLSID.reg
REG EXPORT HKLM\Software\Microsoft\OfficeCSP %MS_WORK_PATH%\HKLM_OFFICECSP.reg
REG EXPORT HKLM\Software\Microsoft\PolicyManager %MS_WORK_PATH%\HKLM_OFFICE_POLICYMGR.reg
REG EXPORT "HKCU\Software\Classes\Local Settings\Software\Microsoft\MSIPC" %MS_WORK_PATH%\MSIPC.reg
REG EXPORT "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" %MS_WORK_PATH%\INTERNET_SETTING.reg
REG EXPORT HKEY_USERS\.DEFAULT\Software\Microsoft\Office %MS_WORK_PATH%\HKU_DEF_OFFICE.reg
dsregcmd /status > %MS_WORK_PATH%\dsregcmd.txt
cmdkey /list > %MS_WORK_PATH%\cmdkey.txt
whoami /upn > %MS_WORK_PATH%\whoami.txt

mkdir %MS_WORK_PATH%\16.0
mkdir %MS_WORK_PATH%\16.0\Licensing
xcopy %localappdata%\Microsoft\Office\16.0\Licensing %MS_WORK_PATH%\16.0\Licensing  /E /H /C /I
mkdir %MS_WORK_PATH%\Licenses
xcopy %localappdata%\Microsoft\Office\Licenses %MS_WORK_PATH%\Licenses  /E /H /C /I

mkdir %MS_WORK_PATH%\OneAuth
xcopy %localappdata%\Microsoft\OneAuth %MS_WORK_PATH%\OneAuth  /E /H /C /I
mkdir %MS_WORK_PATH%\IdentityCache
xcopy %localappdata%\Microsoft\IdentityCache %MS_WORK_PATH%\IdentityCache  /E /H /C /I
mkdir %MS_WORK_PATH%\MSIPC
mkdir %MS_WORK_PATH%\MSIPC\MSIPC
xcopy %localappdata%\Microsoft\MSIPC %MS_WORK_PATH%\MSIPC\MSIPC  /E /H /C /I



cmdkey /list > %MS_WORK_PATH%\cmdkey.txt
whoami /upn > %MS_WORK_PATH%\whoami.txt
mkdir %MS_WORK_PATH%\officelog
REG ADD HKCU\Software\Microsoft\Office\16.0\Common\Logging /v MsoEtwTracingEnabled /t REG_DWORD /d 1 /f
REG ADD HKCU\Software\Microsoft\Office\16.0\Common\Logging /v EnableLogging /t REG_DWORD /d 0xd /f
REG ADD HKCU\Software\Microsoft\Office\16.0\Common\Logging /v DefaultMinimumSeverity /t REG_DWORD /d 0x64 /f
REG ADD HKCU\Software\Microsoft\Office\16.0\Common\Logging /v LogPath /t REG_SZ /d %MS_WORK_PATH%\officelog /f
REG ADD HKCU\Software\Microsoft\Office\16.0\Common\Identity /v OneAuthVerboseLogging /t REG_DWORD /d 1 /f

echo *** Office Log Collect has started. Enter -Stop ***
:menu2

set /p command=command: 

if /i "%command%"=="-Stop" (
    goto stop
) else (
    echo Invalid command. Enter command again
    goto menu2
)

:stop

REG DELETE HKCU\Software\Microsoft\Office\16.0\Common\Logging /v MsoEtwTracingEnabled /f
REG DELETE HKCU\Software\Microsoft\Office\16.0\Common\Logging /v EnableLogging /f
REG DELETE HKCU\Software\Microsoft\Office\16.0\Common\Logging /v DefaultMinimumSeverity /f
REG DELETE HKCU\Software\Microsoft\Office\16.0\Common\Logging /v LogPath /f
REG DELETE HKCU\Software\Microsoft\Office\16.0\Common\Identity /v OneAuthVerboseLogging /f

if "%MS_DATA_PATH%"=="" (
	goto end
)
set MS_WORK_PATH= %MS_DATA_PATH%\after
mkdir %MS_WORK_PATH%
REG EXPORT HKCU\Software\Microsoft %MS_WORK_PATH%\HKCU_OFFICE.reg
REG EXPORT HKCU\Software\Policies\Microsoft %MS_WORK_PATH%\HKCU_POLICY_OFFICE.reg
REG EXPORT HKCU\Software\Microsoft\AuthN %MS_WORK_PATH%\AuthN.reg
REG EXPORT HKLM\Software\Microsoft\Office %MS_WORK_PATH%\HKLM_OFFICE.reg
REG EXPORT HKLM\Software\Policies\Microsoft %MS_WORK_PATH%\HKLM_POLICY_OFFICE.reg
REG EXPORT HKLM\Software\Classes\CLSID %MS_WORK_PATH%\CLSID.reg
REG EXPORT HKLM\Software\Microsoft\OfficeCSP %MS_WORK_PATH%\HKLM_OFFICECSP.reg
REG EXPORT HKLM\Software\Microsoft\PolicyManager %MS_WORK_PATH%\HKLM_OFFICE_POLICYMGR.reg
REG EXPORT "HKCU\Software\Classes\Local Settings\Software\Microsoft\MSIPC" %MS_WORK_PATH%\MSIPC.reg
REG EXPORT "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" %MS_WORK_PATH%\INTERNET_SETTING.reg
REG EXPORT HKEY_USERS.DEFAULT\Software\Microsoft\Office %MS_WORK_PATH%\HKU_DEF_OFFICE.reg
dsregcmd /status > %MS_WORK_PATH%\dsregcmd.txt
cmdkey /list > %MS_WORK_PATH%\cmdkey.txt
whoami /upn > %MS_WORK_PATH%\whoami.txt
wmic os get caption > %MS_WORK_PATH%\ver.txt
ver > %MS_WORK_PATH%\ver2.txt
wevtutil epl System %MS_WORK_PATH%\system.evtx
wevtutil epl Application %MS_WORK_PATH%\Application.evtx
wevtutil epl "Microsoft-Windows-NCSI/Operational" %MS_WORK_PATH%\Microsoft-Windows-NCSI-Operational.evtx
wevtutil epl "Microsoft-Windows-Bits-Client/Operational" %MS_WORK_PATH%\Microsoft-Windows-Bits-Client-Operational.evtx
wevtutil epl "OAlerts" %MS_WORK_PATH%\Office-Alerts.evtx
mkdir %MS_WORK_PATH%\16.0
mkdir %MS_WORK_PATH%\16.0\Licensing
xcopy %localappdata%\Microsoft\Office\16.0\Licensing %MS_WORK_PATH%\16.0\Licensing  /E /H /C /I
mkdir %MS_WORK_PATH%\Licenses
xcopy %localappdata%\Microsoft\Office\Licenses %MS_WORK_PATH%\Licenses  /E /H /C /I
mkdir %MS_WORK_PATH%\OneAuth
xcopy %localappdata%\Microsoft\OneAuth %MS_WORK_PATH%\OneAuth  /E /H /C /I
mkdir %MS_WORK_PATH%\IdentityCache
xcopy %localappdata%\Microsoft\IdentityCache %MS_WORK_PATH%\IdentityCache  /E /H /C /I
mkdir %MS_WORK_PATH%\CLP
Xcopy %localappdata%\Microsoft\Office\CLP %MS_WORK_PATH%\CLP  /E /C /I
mkdir %MS_WORK_PATH%\MSIPC
mkdir %MS_WORK_PATH%\MSIPC\MSIPC
xcopy %localappdata%\Microsoft\MSIPC %MS_WORK_PATH%\MSIPC\MSIPC  /E /H /C /I
mkdir %MS_WORK_PATH%\MSIPC\Word\MIPSDK\mip
xcopy %localappdata%\Microsoft\Word\MIPSDK\mip %MS_WORK_PATH%\MSIPC\Word\MIPSDK\mip  /E /H /C /I
mkdir %MS_WORK_PATH%\MSIPC\Excel\MIPSDK\mip
xcopy %localappdata%\Microsoft\Excel\MIPSDK\mip %MS_WORK_PATH%\MSIPC\Excel\MIPSDK\mip  /E /H /C /I
mkdir %MS_WORK_PATH%\MSIPC\PowerPoint\MIPSDK\mip
xcopy %localappdata%\Microsoft\PowerPoint\MIPSDK\mip %MS_WORK_PATH%\MSIPC\PowerPoint\MIPSDK\mip  /E /H /C /I
mkdir %MS_WORK_PATH%\MSIPC\MSIP
xcopy %localappdata%\Microsoft\MSIP %MS_WORK_PATH%\MSIPC\MSIP  /E /H /C /I
mkdir %MS_WORK_PATH%\MSIPC\Office\MIPSDK
xcopy %localappdata%\Microsoft\Office\MIPSDK %MS_WORK_PATH%\MSIPC\Office\MIPSDK  /E /H /C /I
mkdir %MS_WORK_PATH%\MSIPC\Office\CLP
xcopy %localappdata%\Microsoft\Office\CLP %MS_WORK_PATH%\MSIPC\Office\CLP  /E /H /C /I


cmdkey /list > %MS_WORK_PATH%\cmdkey.txt
whoami /upn > %MS_WORK_PATH%\whoami.txt

cd /d C:\MS_DATA
tar -a -c -f "%FOLDER_NAME%.zip" "%FOLDER_NAME%"

echo.
set OUTPUT="Log folder is C:\MS_DATA\%FOLDER_NAME%"

:end
echo.
echo Office Log Collect Stopped. %OUTPUT%
pause


