Office 365 sans licence : corriger 0xCAA5004B et TPM_E_PCP_WRONG_PARENT

0xCAA5001C Token broker operation failed
GetTokenSilently
0xCAA5004B Device information is missing
0x8029040E TPM_E_PCP_WRONG_PARENT
NgcHelper::SignWithSymmetricPopKey

$c2r = 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration'
Get-ItemProperty -LiteralPath $c2r |
  Select-Object ProductReleaseIds,VersionToReport,Platform,
    'O365BusinessRetail.TenantId',
    'O365BusinessRetail.OSPPReady',
    DeployedInAuditMode |
  Format-List

ProductReleaseIds            : OneNoteFreeRetail,O365BusinessRetail
O365BusinessRetail.TenantId  : 1,
O365BusinessRetail.OSPPReady : 1
DeployedInAuditMode          : True

& 'C:\Program Files\Microsoft Office\root\Office16\vNextDiag.ps1' -action list

========== Mode per ProductReleaseId ==========
o365businessretail = Legacy

========== vNext licenses found ==========
No licenses found.

========== Mode per ProductReleaseId ==========
o365businessretail = vNext

{
  "Type": "User|Subscription",
  "Product": "O365BusinessRetail",
  "LicenseState": "Licensed",
  "EntitlementStatus": "Provisioned",
  "TenantId": "<GUID-TENANT>",
  "LicenseId": "EWW_<ID-ANONYMISE>"
}

Get-ChildItem "$env:LOCALAPPDATA\Microsoft\Office\Licenses" `
  -Recurse -Force -File -ErrorAction SilentlyContinue |
  Select-Object FullName,Length,CreationTime,LastWriteTime

dsregcmd.exe /status

DomainJoined    : YES
AzureAdJoined   : NO
WorkplaceJoined : NO
AzureAdPrt      : NO
WamDefaultSet   : NO

Get-Tpm | Select-Object `
  TpmPresent,TpmReady,TpmEnabled,TpmActivated,TpmOwned,
  RestartPending,ManufacturerIdTxt,ManufacturerVersionFull20,
  ManagedAuthLevel,OwnerClearDisabled,AutoProvisioning,
  LockedOut,LockoutCount |
  Format-List

$since = (Get-Date).AddHours(-24)
$events = Get-WinEvent -FilterHashtable @{
  LogName   = 'Microsoft-Windows-AAD/Operational'
  StartTime = $since
} -ErrorAction SilentlyContinue

$events |
  Select-Object TimeCreated,Id,LevelDisplayName,Message |
  Format-List

"WrongParent=" + @($events | Where-Object Message -match `
  '0x8029040E|TPM_E_PCP_WRONG_PARENT').Count

GetTokenSilently
NgcHelper::SignWithSymmetricPopKey
0x8029040E TPM_E_PCP_WRONG_PARENT

w32tm.exe /query /status /verbose
w32tm.exe /query /peers

$pkg = Get-AppxPackage -Name Microsoft.AAD.BrokerPlugin
Add-AppxPackage -Register "$($pkg.InstallLocation)\AppxManifest.xml" `
  -DisableDevelopmentMode -ForceApplicationShutdown

%LOCALAPPDATA%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy

Get-AppxPackage -Name Microsoft.AAD.BrokerPlugin | Reset-AppxPackage

AAD events     : 5
WrongParent    : 3
OneDrive       : lancé

AAD events     : 9
WrongParent    : 0
OneDrive       : lancé et stable

Product               : O365BusinessRetail
Activation mode       : vNext
License type          : User|Subscription
LicenseState          : Licensed
EntitlementStatus     : Provisioned
License files         : 1
TPM_E_PCP_WRONG_PARENT: 0 après correction
0xCAA5004B             : 0 après correction
Word                   : activé
OneDrive               : connecté
Outlook classique      : connecté et réactif

& 'C:\Program Files\Microsoft Office\root\Office16\vNextDiag.ps1' -action list

# Après sauvegarde, utiliser uniquement le LicenseId EWW affiché :
& 'C:\Program Files\Microsoft Office\root\Office16\vNextDiag.ps1' `
  -action remove -LicenseId 'EWW_<ID>'

# Diagnostic en lecture seule
.\Office-WAM-Activation-Debug.ps1

# Voir exactement ce que ferait la réparation, sans la faire
.\Office-WAM-Activation-Debug.ps1 -Action ResetBroker

# Réenregistrement non destructif du Broker
.\Office-WAM-Activation-Debug.ps1 -Action ReregisterBroker -Apply

# Reset du Broker après sauvegarde intégrale vérifiée
.\Office-WAM-Activation-Debug.ps1 -Action ResetBroker -Apply

# Simulation de la stratégie DPAPI documentée par Microsoft
.\Office-WAM-Activation-Debug.ps1 -Action SetProtectionPolicy

# Application réelle : lancer PowerShell en administrateur
.\Office-WAM-Activation-Debug.ps1 -Action SetProtectionPolicy -Apply

[CmdletBinding()]
param(
    [ValidateSet('Diagnose','ReregisterBroker','ResetBroker','SetProtectionPolicy','RestoreProtectionPolicy')]
    [string]$Action = 'Diagnose',
    [switch]$Apply,
    [ValidateRange(1,168)]
    [int]$EventHours = 24,
    [string]$OutputRoot = 'C:\INFORMATIQUE',
    [string]$RestoreFrom
)

# PowerShell 5.1 compatible. No credential is requested, read or stored.
# Diagnose is always read-only. Every repair action is a dry run unless -Apply is present.

$ErrorActionPreference = 'Stop'
$script:DryRun = -not $Apply
$stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
$machineSafe = $env:COMPUTERNAME -replace '[^A-Za-z0-9_-]', '_'
$runRoot = Join-Path $OutputRoot "Office-WAM-Debug-$machineSafe-$stamp"
$logRoot = Join-Path $runRoot 'Logs'
$backupRoot = Join-Path $runRoot 'Backup'
New-Item -ItemType Directory -Path $logRoot,$backupRoot -Force | Out-Null

# Diagnostic files can contain technical identifiers. Restrict access immediately.
$userSid = [System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value
& icacls.exe $runRoot /inheritance:r /grant:r "*$userSid`:(OI)(CI)F" '*S-1-5-32-544:(OI)(CI)F' '*S-1-5-18:(OI)(CI)F' | Out-Null
if ($LASTEXITCODE -ne 0) { throw 'Unable to secure the diagnostic directory ACL.' }

$script:TranscriptPath = Join-Path $logRoot 'Transcript.txt'
Start-Transcript -LiteralPath $script:TranscriptPath -Force | Out-Null

function Write-Log {
    param([string]$Message)
    $line = '[{0}] {1}' -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'),$Message
    Write-Host $line
    $line | Add-Content -LiteralPath (Join-Path $logRoot 'Actions.log') -Encoding UTF8
}

function Save-Output {
    param([string]$Name,[scriptblock]$Command)
    try {
        & $Command 2>&1 | Out-File -LiteralPath (Join-Path $logRoot "$Name.txt") -Encoding UTF8 -Width 400
    }
    catch {
        $_ | Format-List * -Force | Out-File -LiteralPath (Join-Path $logRoot "$Name-ERROR.txt") -Encoding UTF8 -Width 400
    }
}

function Test-IsAdministrator {
    $p = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
    $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
}

function Get-Office16Path {
    @(
        'C:\Program Files\Microsoft Office\root\Office16',
        'C:\Program Files (x86)\Microsoft Office\root\Office16',
        'C:\Program Files\Microsoft Office\Office16',
        'C:\Program Files (x86)\Microsoft Office\Office16'
    ) | Where-Object { Test-Path -LiteralPath $_ } | Select-Object -First 1
}

function Get-TreeStats {
    param([Parameter(Mandatory=$true)][string]$Path)
    if (-not (Test-Path -LiteralPath $Path)) {
        return [pscustomobject]@{Path=$Path;Exists=$false;Files=0;Bytes=0}
    }
    $m = Get-ChildItem -LiteralPath $Path -Recurse -Force -File -ErrorAction SilentlyContinue | Measure-Object Length -Sum
    [pscustomobject]@{Path=$Path;Exists=$true;Files=[int]$m.Count;Bytes=[long]$m.Sum}
}

function Export-RegIfPresent {
    param([string]$NativeKey,[string]$FileName)
    & reg.exe query $NativeKey *> $null
    if ($LASTEXITCODE -eq 0) {
        $destination = Join-Path $backupRoot $FileName
        & reg.exe export $NativeKey $destination /y | Out-Null
        if ($LASTEXITCODE -ne 0) { throw "Registry backup failed: $NativeKey" }
        Write-Log "Registry backup: $NativeKey"
    }
}

function Backup-TreeVerified {
    param([string]$Source,[string]$Destination,[string]$Label)
    if (-not (Test-Path -LiteralPath $Source)) {
        Write-Log "Backup source absent: $Source"
        return
    }
    $before = Get-TreeStats $Source
    New-Item -ItemType Directory -Path $Destination -Force | Out-Null
    & robocopy.exe $Source $Destination /E /COPY:DAT /DCOPY:DAT /R:1 /W:1 /XJ /NP /NFL /NDL /NJH /NJS |
        Out-File -LiteralPath (Join-Path $logRoot "Robocopy-$Label.txt") -Encoding UTF8
    if ($LASTEXITCODE -ge 8) { throw "Robocopy failed for $Label with exit code $LASTEXITCODE" }
    $after = Get-TreeStats $Destination
    @($before,$after) | Export-Csv -LiteralPath (Join-Path $logRoot "Backup-Verification-$Label.csv") -NoTypeInformation -Encoding UTF8
    if ($after.Files -lt $before.Files -or $after.Bytes -lt $before.Bytes) {
        throw "Incomplete backup for $Label"
    }
    Get-ChildItem -LiteralPath $Destination -Recurse -Force -File -ErrorAction Stop | Get-FileHash -Algorithm SHA256 |
        Export-Csv -LiteralPath (Join-Path $logRoot "Backup-SHA256-$Label.csv") -NoTypeInformation -Encoding UTF8
    Write-Log "Verified backup: $Label ($($after.Files) files, $($after.Bytes) bytes)"
}

function Assert-OfficeClosed {
    $names = @('WINWORD','OUTLOOK','EXCEL','POWERPNT','MSACCESS','MSPUB','ONENOTE','LYNC')
    $running = @(Get-Process -Name $names -ErrorAction SilentlyContinue)
    if ($running) {
        throw ('Close Office applications before -Apply. Running: ' + (($running.ProcessName | Sort-Object -Unique) -join ', '))
    }
}

function Stop-OneDriveCleanly {
    $exe = @(
        (Join-Path $env:LOCALAPPDATA 'Microsoft\OneDrive\OneDrive.exe'),
        'C:\Program Files\Microsoft OneDrive\OneDrive.exe',
        'C:\Program Files (x86)\Microsoft OneDrive\OneDrive.exe'
    ) | Where-Object { Test-Path -LiteralPath $_ } | Select-Object -First 1
    if ($exe -and (Get-Process OneDrive -ErrorAction SilentlyContinue)) {
        Start-Process -FilePath $exe -ArgumentList '/shutdown' -Wait
        Start-Sleep -Seconds 4
        Write-Log 'OneDrive stopped cleanly.'
    }
}

function Write-Diagnostics {
    param([string]$Prefix)
    $since = (Get-Date).AddHours(-$EventHours)
    $office16 = Get-Office16Path
    $vNextDiag = if ($office16) { Join-Path $office16 'vNextDiag.ps1' } else { $null }
    $brokerData = Join-Path $env:LOCALAPPDATA 'Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy'

    Save-Output "$Prefix-00-Context" {
        [pscustomobject]@{
            Captured=(Get-Date -Format o)
            Computer=$env:COMPUTERNAME
            User=[System.Security.Principal.WindowsIdentity]::GetCurrent().Name
            UserSid=$userSid
            Elevated=(Test-IsAdministrator)
            Windows=(Get-CimInstance Win32_OperatingSystem).Caption
            WindowsVersion=(Get-CimInstance Win32_OperatingSystem).Version
            PowerShell=$PSVersionTable.PSVersion.ToString()
            Action=$Action
            DryRun=$script:DryRun
        } | Format-List
    }
    Save-Output "$Prefix-01-Office-ClickToRun" {
        Get-ItemProperty -LiteralPath 'HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration' -ErrorAction SilentlyContinue |
            Select-Object ProductReleaseIds,VersionToReport,ClientVersionToReport,UpdateChannel,CDNBaseUrl,Platform,'O365BusinessRetail.TenantId','O365BusinessRetail.OSPPReady',DeployedInAuditMode | Format-List
    }
    Save-Output "$Prefix-02-Office-User-Licensing" {
        Get-ItemProperty -LiteralPath 'HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Licensing' -ErrorAction SilentlyContinue |
            Select-Object TimeOfLastDACheck,DeviceEntitlementsExist,EligibleForExtendedGrace | Format-List
        Get-ItemProperty -LiteralPath 'HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext' -ErrorAction SilentlyContinue | Format-List
        Get-TreeStats (Join-Path $env:LOCALAPPDATA 'Microsoft\Office\Licenses') | Format-List
    }
    Save-Output "$Prefix-03-vNextDiag" {
        if ($vNextDiag -and (Test-Path -LiteralPath $vNextDiag)) { & $vNextDiag -action list }
        else { 'vNextDiag.ps1 not found.' }
    }
    Save-Output "$Prefix-04-DsRegCmd" { dsregcmd.exe /status }
    Save-Output "$Prefix-05-TPM" {
        # Never use Format-List * here: OwnerAuth is a TPM secret.
        Get-Tpm | Select-Object TpmPresent,TpmReady,TpmEnabled,TpmActivated,TpmOwned,RestartPending,ManufacturerIdTxt,ManufacturerVersionFull20,ManagedAuthLevel,OwnerClearDisabled,AutoProvisioning,LockedOut,LockoutCount | Format-List
    }
    Save-Output "$Prefix-06-Time" {
        w32tm.exe /query /status /verbose
        w32tm.exe /query /peers
    }
    Save-Output "$Prefix-07-Appx-Broker" {
        Get-AppxPackage -Name Microsoft.AAD.BrokerPlugin | Select-Object Name,PackageFullName,Status,InstallLocation | Format-List
        Get-AppxPackage -Name Microsoft.Windows.CloudExperienceHost | Select-Object Name,PackageFullName,Status,InstallLocation | Format-List
        Get-TreeStats $brokerData | Format-List
    }
    Save-Output "$Prefix-08-Processes-Services" {
        Get-Process WINWORD,OUTLOOK,EXCEL,POWERPNT,ONENOTE,OneDrive,Microsoft.AAD.BrokerPlugin -ErrorAction SilentlyContinue |
            Select-Object ProcessName,Id,StartTime,Responding,Path | Format-Table -AutoSize
        Get-Service ClickToRunSvc,TokenBroker -ErrorAction SilentlyContinue | Select-Object Name,Status,StartType | Format-Table -AutoSize
    }
    Save-Output "$Prefix-09-Network" {
        'login.microsoftonline.com','officeclient.microsoft.com','ols.officeapps.live.com' | ForEach-Object {
            Test-NetConnection -ComputerName $_ -Port 443 -InformationLevel Detailed
        }
    }
    Save-Output "$Prefix-10-AAD-Events" {
        Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-AAD/Operational';StartTime=$since} -ErrorAction SilentlyContinue |
            Select-Object TimeCreated,Id,LevelDisplayName,ProviderName,Message | Format-List
    }
    $events = @(Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-AAD/Operational';StartTime=$since} -ErrorAction SilentlyContinue)
    @(
        "Captured=$(Get-Date -Format o)"
        "WindowHours=$EventHours"
        "AAD_EventCount=$($events.Count)"
        "AAD_ErrorCount=$(@($events | Where-Object Level -eq 2).Count)"
        "WrongParentCount=$(@($events | Where-Object Message -match '0x8029040E|TPM_E_PCP_WRONG_PARENT').Count)"
        "CAA5004BCount=$(@($events | Where-Object Message -match '0xCAA5004B').Count)"
        "CAA5001CCount=$(@($events | Where-Object Message -match '0xCAA5001C').Count)"
    ) | Out-File -LiteralPath (Join-Path $logRoot "$Prefix-11-Summary.txt") -Encoding UTF8
}

function Backup-BrokerState {
    $packageFamily = 'Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy'
    Export-RegIfPresent 'HKCU\Software\Microsoft\Windows\CurrentVersion\AAD' 'HKCU-AAD.reg'
    Export-RegIfPresent 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\WorkplaceJoin' 'HKCU-WorkplaceJoin.reg'
    Export-RegIfPresent 'HKCU\Software\Microsoft\Office\16.0\Common\Identity' 'HKCU-Office-Identity.reg'
    Export-RegIfPresent 'HKCU\Software\Microsoft\Office\16.0\Common\Licensing' 'HKCU-Office-Licensing.reg'
    Export-RegIfPresent 'HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy' 'HKCU-AadBroker-SystemAppData.reg'
    Backup-TreeVerified (Join-Path $env:LOCALAPPDATA "Packages\$packageFamily") (Join-Path $backupRoot $packageFamily) 'AadBroker'
}

try {
    Write-Log "Action=$Action Apply=$Apply DryRun=$script:DryRun"
    Write-Diagnostics 'Before'

    switch ($Action) {
        'Diagnose' {
            Write-Log 'Read-only diagnosis completed. No repair was attempted.'
        }
        'ReregisterBroker' {
            if ($script:DryRun) {
                Write-Log 'DRY RUN: would close broker-hosted apps and re-register Microsoft.AAD.BrokerPlugin.'
            }
            else {
                Assert-OfficeClosed
                Stop-OneDriveCleanly
                $pkg = Get-AppxPackage -Name Microsoft.AAD.BrokerPlugin
                if (-not $pkg) { throw 'Microsoft.AAD.BrokerPlugin package not found.' }
                Add-AppxPackage -Register (Join-Path $pkg.InstallLocation 'AppxManifest.xml') -DisableDevelopmentMode -ForceApplicationShutdown
                Write-Log 'AAD BrokerPlugin re-registered.'
                Write-Diagnostics 'After'
            }
        }
        'ResetBroker' {
            $source = Join-Path $env:LOCALAPPDATA 'Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy'
            $stats = Get-TreeStats $source
            Write-Log "Broker source: Exists=$($stats.Exists), Files=$($stats.Files), Bytes=$($stats.Bytes)"
            if ($script:DryRun) {
                Write-Log 'DRY RUN: would export relevant registry keys, copy and hash the complete BrokerPlugin data tree, verify the backup, stop OneDrive, then run Reset-AppxPackage.'
            }
            else {
                Assert-OfficeClosed
                Backup-BrokerState
                Stop-OneDriveCleanly
                $pkg = Get-AppxPackage -Name Microsoft.AAD.BrokerPlugin
                if (-not $pkg) { throw 'Microsoft.AAD.BrokerPlugin package not found.' }
                $pkg | Reset-AppxPackage
                Write-Log 'AAD BrokerPlugin user data reset after verified backup.'
                Write-Diagnostics 'After'
                Write-Log 'Open Word manually and sign in through the Microsoft window. Never put credentials in this script.'
            }
        }
        'SetProtectionPolicy' {
            if (-not $script:DryRun -and -not (Test-IsAdministrator)) { throw 'SetProtectionPolicy with -Apply requires an elevated PowerShell window.' }
            $native = 'HKLM\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb'
            $psPath = 'HKLM:\SOFTWARE\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb'
            $item = Get-ItemProperty -LiteralPath $psPath -ErrorAction SilentlyContinue
            $exists = $null -ne $item -and $item.PSObject.Properties.Name -contains 'ProtectionPolicy'
            $old = if ($exists) { [int]$item.ProtectionPolicy } else { $null }
            [pscustomobject]@{Exists=$exists;Value=$old;RegistryPath=$psPath} | Export-Clixml -LiteralPath (Join-Path $backupRoot 'ProtectionPolicy-Before.clixml')
            Export-RegIfPresent $native 'HKLM-DPAPI-Provider.reg'
            if ($script:DryRun) {
                Write-Log "DRY RUN: would set ProtectionPolicy=1. PreviousExists=$exists PreviousValue=$old"
            }
            else {
                New-Item -Path $psPath -Force | Out-Null
                New-ItemProperty -LiteralPath $psPath -Name ProtectionPolicy -PropertyType DWord -Value 1 -Force | Out-Null
                Write-Log 'ProtectionPolicy set to 1. Reboot is required for a meaningful test.'
                Write-Diagnostics 'After'
            }
        }
        'RestoreProtectionPolicy' {
            if (-not $script:DryRun -and -not (Test-IsAdministrator)) { throw 'RestoreProtectionPolicy with -Apply requires an elevated PowerShell window.' }
            if (-not $RestoreFrom) { throw 'Use -RestoreFrom with the earlier Office-WAM-Debug run directory.' }
            $resolved = (Resolve-Path -LiteralPath $RestoreFrom).Path
            if (-not $resolved.StartsWith((Join-Path $OutputRoot 'Office-WAM-Debug-'),[System.StringComparison]::OrdinalIgnoreCase)) {
                throw "Restore path refused: $resolved"
            }
            $stateFile = Join-Path $resolved 'Backup\ProtectionPolicy-Before.clixml'
            $state = Import-Clixml -LiteralPath $stateFile
            if ($script:DryRun) {
                Write-Log "DRY RUN: would restore ProtectionPolicy. PreviousExists=$($state.Exists) PreviousValue=$($state.Value)"
            }
            else {
                if ($state.Exists) {
                    New-ItemProperty -LiteralPath $state.RegistryPath -Name ProtectionPolicy -PropertyType DWord -Value ([int]$state.Value) -Force | Out-Null
                }
                else {
                    Remove-ItemProperty -LiteralPath $state.RegistryPath -Name ProtectionPolicy -ErrorAction SilentlyContinue
                }
                Write-Log 'ProtectionPolicy restored to its recorded previous state.'
                Write-Diagnostics 'After'
            }
        }
    }

    @(
        "RunRoot=$runRoot"
        "Action=$Action"
        "DryRun=$script:DryRun"
        "Completed=$(Get-Date -Format o)"
        'CredentialsRequested=False'
    ) | Out-File -LiteralPath (Join-Path $runRoot 'RESULT.txt') -Encoding UTF8

    Stop-Transcript | Out-Null
    Get-ChildItem -LiteralPath $runRoot -Recurse -Force -File -ErrorAction SilentlyContinue |
        Where-Object FullName -ne (Join-Path $runRoot 'SHA256.csv') |
        Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue |
        Export-Csv -LiteralPath (Join-Path $runRoot 'SHA256.csv') -NoTypeInformation -Encoding UTF8

    Write-Host "Logs: $runRoot"
    exit 0
}
catch {
    $_ | Format-List * -Force | Out-File -LiteralPath (Join-Path $runRoot 'ERROR.txt') -Encoding UTF8 -Width 400
    Stop-Transcript -ErrorAction SilentlyContinue | Out-Null
    Write-Error $_
    Write-Host "Logs: $runRoot"
    exit 1
}