@echo off
REM Ver 3.5

echo **** License Terms ****
echo Copyright (c) 2024. All Rights Reserved. 
echo This software is released under the MIT License(http://opensource.org/licenses/mit-license.php)
echo Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
echo;
echo The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
echo;
echo THE SOFTWARE IS ONLY FOR TROUBLESHOOTING PURPUSE, AND PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE
echo **** License Terms ****
echo;
set /p yn_check="IF YOU AGREE THE LICENSE TERMS, Hit (y)
IF %yn_check%==y (
  goto run
) ELSE (
  echo Close the window.
  pause
  exit /b
)

:run
echo Collecting logs...


@echo off
if not exist "C:\MS_DATA" (
    mkdir "C:\MS_DATA"
)

set "COMPUTER_NAME=%COMPUTERNAME%"

set "dateStr=%date%"
set "timeStr=%time: =0%"

set "YY=%dateStr:~2,2%"
set "MM=%dateStr:~5,2%"
set "DD=%dateStr:~8,2%"
set "YYMMDD=%YY%%MM%%DD%"

set "HH=%timeStr:~0,2%"
set "mm=%timeStr:~3,2%"
set "ss=%timeStr:~6,2%"
set "HHmmss=%HH%%mm%%ss%"

set "FOLDER_NAME=MOI_%COMPUTER_NAME%_%YYMMDD%-%HHmmss%"

set MS_WORK_PATH="C:\MS_DATA\%FOLDER_NAME%"
mkdir %MS_WORK_PATH%
cd %MS_WORK_PATH%

mkdir apptemp
mkdir wintemp
mkdir ccmlogs
mkdir msipclogs
mkdir oneauthaccounts
mkdir idcache
mkdir SvcMgr
mkdir Diagnostics

REG EXPORT HKCU\Software\Microsoft %MS_WORK_PATH%\HKCU_OFFICE.reg
REG EXPORT HKCU\Software\Policies\Microsoft %MS_WORK_PATH%\HKCU_POLICY_OFFICE.reg
REG EXPORT HKCU\Software\Microsoft\AuthN %MS_WORK_PATH%\AuthN.reg
REG EXPORT HKLM\Software\Microsoft\Office %MS_WORK_PATH%\HKLM_OFFICE.reg
REG EXPORT HKLM\Software\Policies\Microsoft %MS_WORK_PATH%\HKLM_POLICY_OFFICE.reg
REG EXPORT HKLM\Software\WOW6432Node\Microsoft\Office %MS_WORK_PATH%\HKLM_WOW64_OFFICE.reg
REG EXPORT HKLM\Software\WOW6432Node\Policies\Microsoft\Office %MS_WORK_PATH%\HKLM_WOW64_POLICY_OFFICE.reg

REG EXPORT HKLM\Software\Classes\CLSID %MS_WORK_PATH%\CLSID.reg
REG EXPORT HKLM\Software\Microsoft\OfficeCSP %MS_WORK_PATH%\HKLM_OFFICECSP.reg
REG EXPORT HKLM\Software\Microsoft\XPD %MS_WORK_PATH%\HKLM_XPD.reg
REG EXPORT "HKCU\Software\Classes\Local Settings\Software\Microsoft\MSIPC" %MS_WORK_PATH%\MSIPC.reg
REG EXPORT "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" %MS_WORK_PATH%\INTERNET_SETTING.reg

REG EXPORT HKEY_USERS\.DEFAULT\Software\Microsoft\Office %MS_WORK_PATH%\HKU_DEF_OFFICE.reg


dsregcmd /status > %MS_WORK_PATH%\dsregcmd.txt
cmdkey /list > %MS_WORK_PATH%\cmdkey.txt
whoami /upn > %MS_WORK_PATH%\whoami.txt
wmic os get caption > %MS_WORK_PATH%\ver.txt
ver > %MS_WORK_PATH%\ver2.txt
ipconfig /all > %MS_WORK_PATH%\ipconfig.txt
ipconfig /displaydns > %MS_WORK_PATH%\ipconfigDns.txt

wevtutil epl System %MS_WORK_PATH%\system.evtx
wevtutil epl Application %MS_WORK_PATH%\Application.evtx
wevtutil epl "Microsoft-Windows-NCSI/Operational" %MS_WORK_PATH%\Microsoft-Windows-NCSI-Operational.evtx
wevtutil epl "Microsoft-Windows-Bits-Client/Operational" %MS_WORK_PATH%\Microsoft-Windows-Bits-Client-Operational.evtx
wevtutil epl "OAlerts" %MS_WORK_PATH%\Office-Alerts.evtx


dir C:\ProgramData\Microsoft\ClickToRun /s > ProgramDatadir.txt
dir "C:\Program Files\Microsoft Office\Updates\Download"  /s > UpdatesDownloaddir.txt
dir "C:\Program Files (x86)\Microsoft Office\Updates\Download"  /s > UpdatesDownloadx86dir.txt

dir %localappdata%\Microsoft\Office\16.0 /s > Office16.0dir.txt

Xcopy %temp%\*.log  %MS_WORK_PATH%\apptemp  /S /C /I

Xcopy C:\windows\temp\*.log  %MS_WORK_PATH%\wintemp  /S /C /I

Xcopy C:\Windows\CCM\Logs %MS_WORK_PATH%\ccmlogs  /E /C /I

Xcopy %localappdata%\Microsoft\MSIPC %MS_WORK_PATH%\msipclogs  /E /C /I

Xcopy %localappdata%\Microsoft\OneAuth\accounts %MS_WORK_PATH%\oneauthaccounts  /E /C /I

Xcopy %localappdata%\Microsoft\IdentityCache %MS_WORK_PATH%\idcache /E /C /I

Xcopy %localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts %MS_WORK_PATH%\wamaccount /E /H /C /I

Xcopy C:\ProgramData\Microsoft\Office\SvcMgr %MS_WORK_PATH%\SvcMgr /E /C /I

Xcopy %temp%\Diagnostics %MS_WORK_PATH%\Diagnostics /E /C /I

echo Compressing logs to "%FOLDER_NAME%.zip"
cd /d C:\MS_DATA
tar -a -c -f "%FOLDER_NAME%.zip" "%FOLDER_NAME%"

echo MSOfficeinfo Finished. Log folder is C:\MS_DATA\%FOLDER_NAME%
pause