@echo off setlocal EnableDelayedExpansion REM ===================================================================== REM CollectSyncLogsLite.bat - Lightweight OneDrive Log Collection Script REM ===================================================================== REM This script collects OneDrive diagnostic logs without user prompts. REM Excludes only security-sensitive files: REM - Keystore files (*.keystore) REM - Obfuscation maps (ObfuscationStringMap.txt) REM REM Output is saved to %TEMP%\OneDriveLogs to avoid syncing collected logs. REM ===================================================================== set RETURNCODE=0 set TOTAL_STEPS=6 set CURRENT_STEP=0 REM Output to TEMP folder (neutral, non-synced location) set OUTPUTDIR=%TEMP%\OneDriveLogs set DATETIMESUFFIX=%DATE:/=_%_%TIME::=_% set OUTPUT=OneDriveLogs_%DATETIMESUFFIX: =_%.zip REM ------------------------- REM * CLIENT PATH DISCOVERY * REM ------------------------- if "%LOCALAPPDATA%"=="" ( set LOCALAPPDATA=%USERPROFILE%\Local Settings\Application Data ) set CLIENTPATH=%LOCALAPPDATA%\Microsoft\OneDrive set LEGACY_MACHINE_SETUP_LOGS_PATH=%PROGRAMDATA%\Microsoft OneDrive set MACHINE_I386_SETUP_LOGS_PATH=%PROGRAMFILES(X86)%\Microsoft OneDrive set MACHINE_AMD64_SETUP_LOGS_PATH=%ProgramW6432%\Microsoft OneDrive REM Verify at least one data folder exists if not exist "%CLIENTPATH%" ( if not exist "%LEGACY_MACHINE_SETUP_LOGS_PATH%" ( if not exist "%MACHINE_I386_SETUP_LOGS_PATH%" ( if not exist "%MACHINE_AMD64_SETUP_LOGS_PATH%" ( echo Error: No OneDrive application data found. set RETURNCODE=1 goto :Cleanup ) ) ) ) REM Create output directory if not exist "%OUTPUTDIR%" mkdir "%OUTPUTDIR%" REM Create working directory set WORKINGDIR=%TEMP%\OneDriveLogCollection_%RANDOM% if exist "%WORKINGDIR%" rd /s /q "%WORKINGDIR%" mkdir "%WORKINGDIR%" echo. echo OneDrive Log Collection (Lite) echo ============================== echo. echo Output will be saved to: %OUTPUTDIR% echo. REM ------------------------- REM Step 1: System Information REM ------------------------- set /a CURRENT_STEP+=1 echo [%CURRENT_STEP%/%TOTAL_STEPS%] Collecting system information... REM Filter sensitive environment variables set 2>nul | findstr /V /I "PASSWORD TOKEN SECRET KEY CREDENTIAL AUTH API" > "%WORKINGDIR%\env.txt" 2>nul tasklist.exe > "%WORKINGDIR%\tasklist.txt" 2>nul systeminfo.exe > "%WORKINGDIR%\systeminfo.txt" 2>nul net.exe start > "%WORKINGDIR%\services.txt" 2>nul REM ------------------------- REM Step 2: OneDrive Logs REM ------------------------- set /a CURRENT_STEP+=1 echo [%CURRENT_STEP%/%TOTAL_STEPS%] Collecting OneDrive logs... set WORKINGDIRONEDRIVE=%WORKINGDIR%\OneDrive mkdir "%WORKINGDIRONEDRIVE%" REM Exclusion patterns: only exclude security-sensitive files (keystores, obfuscation maps) set EXCLUDE_FILES=/XF *.keystore ObfuscationStringMap.txt if exist "%CLIENTPATH%" ( dir /S "%CLIENTPATH%" > "%WORKINGDIRONEDRIVE%\tree.txt" 2>nul robocopy.exe "%CLIENTPATH%\logs" "%WORKINGDIRONEDRIVE%\logs" /S %EXCLUDE_FILES% /NFL /NDL /NJH /NJS >nul 2>&1 robocopy.exe "%CLIENTPATH%\setup\logs" "%WORKINGDIRONEDRIVE%\setup\logs" /S %EXCLUDE_FILES% /NFL /NDL /NJH /NJS >nul 2>&1 ) REM ------------------------- REM Step 3: Setup Logs REM ------------------------- set /a CURRENT_STEP+=1 echo [%CURRENT_STEP%/%TOTAL_STEPS%] Collecting setup logs... if exist "%LEGACY_MACHINE_SETUP_LOGS_PATH%" ( robocopy.exe "%LEGACY_MACHINE_SETUP_LOGS_PATH%\setup\logs" "%WORKINGDIRONEDRIVE%\LegacyMachineSetupLogs\setup\logs" /S %EXCLUDE_FILES% /NFL /NDL /NJH /NJS >nul 2>&1 robocopy.exe "%LEGACY_MACHINE_SETUP_LOGS_PATH%\StandaloneUpdater\logs" "%WORKINGDIRONEDRIVE%\LegacyMachineSetupLogs\StandaloneUpdater\logs" /S %EXCLUDE_FILES% /NFL /NDL /NJH /NJS >nul 2>&1 robocopy.exe "%LEGACY_MACHINE_SETUP_LOGS_PATH%\UpdaterService\logs" "%WORKINGDIRONEDRIVE%\LegacyMachineSetupLogs\UpdaterService\logs" /S %EXCLUDE_FILES% /NFL /NDL /NJH /NJS >nul 2>&1 ) if exist "%MACHINE_I386_SETUP_LOGS_PATH%" ( robocopy.exe "%MACHINE_I386_SETUP_LOGS_PATH%\setup\logs" "%WORKINGDIRONEDRIVE%\MachineSetupLogs\setup\logs" /S %EXCLUDE_FILES% /NFL /NDL /NJH /NJS >nul 2>&1 robocopy.exe "%MACHINE_I386_SETUP_LOGS_PATH%\StandaloneUpdater\logs" "%WORKINGDIRONEDRIVE%\MachineSetupLogs\StandaloneUpdater\logs" /S %EXCLUDE_FILES% /NFL /NDL /NJH /NJS >nul 2>&1 ) if exist "%MACHINE_AMD64_SETUP_LOGS_PATH%" ( robocopy.exe "%MACHINE_AMD64_SETUP_LOGS_PATH%\setup\logs" "%WORKINGDIRONEDRIVE%\MachineAmd64SetupLogs\setup\logs" /S %EXCLUDE_FILES% /NFL /NDL /NJH /NJS >nul 2>&1 robocopy.exe "%MACHINE_AMD64_SETUP_LOGS_PATH%\StandaloneUpdater\logs" "%WORKINGDIRONEDRIVE%\MachineAmd64SetupLogs\StandaloneUpdater\logs" /S %EXCLUDE_FILES% /NFL /NDL /NJH /NJS >nul 2>&1 ) REM ------------------------- REM Step 4: Registry Keys REM ------------------------- set /a CURRENT_STEP+=1 echo [%CURRENT_STEP%/%TOTAL_STEPS%] Collecting registry information... reg.exe query "HKCU\Software\Microsoft\OneDrive" /s > "%WORKINGDIRONEDRIVE%\reg_OneDriveRegKeys.txt" 2>&1 reg.exe query "HKLM\Software\Microsoft\OneDrive" /s >> "%WORKINGDIRONEDRIVE%\reg_OneDriveRegKeys.txt" 2>&1 reg.exe query "HKLM\Software\Policies\Microsoft\OneDrive" /s > "%WORKINGDIRONEDRIVE%\reg_OneDrivePolicies.txt" 2>&1 reg.exe query "HKCU\Software\Policies\Microsoft\OneDrive" /s >> "%WORKINGDIRONEDRIVE%\reg_OneDrivePolicies.txt" 2>&1 REM ------------------------- REM Step 5: Event Logs REM ------------------------- set /a CURRENT_STEP+=1 echo [%CURRENT_STEP%/%TOTAL_STEPS%] Exporting event logs... wevtutil.exe export-log Application "%WORKINGDIR%\Application.evtx" 2>nul wevtutil.exe export-log System "%WORKINGDIR%\System.evtx" 2>nul REM ------------------------- REM Step 6: Create ZIP REM ------------------------- set /a CURRENT_STEP+=1 echo [%CURRENT_STEP%/%TOTAL_STEPS%] Creating log archive... pushd "%WORKINGDIR%" tar -a -cf "%OUTPUTDIR%\%OUTPUT%" * >nul 2>&1 popd if ERRORLEVEL 1 ( echo Error: Failed to create log archive. set RETURNCODE=1 goto :Cleanup ) echo. echo ============================== echo Log collection complete! echo. echo Logs saved to: echo %OUTPUTDIR%\%OUTPUT% echo. REM Open the output directory in File Explorer explorer.exe "%OUTPUTDIR%" :Cleanup REM Clean up working directory if exist "%WORKINGDIR%" rd /s /q "%WORKINGDIR%" 2>nul echo Press any key to close... pause >nul exit /b %RETURNCODE%