I was able to do it.
Here's the steps & Script
1. I created a UEM registry policy. The condition is if the user is a member of a group. If returns true, it then imports the registry.
2. I modified the existing script. The script search for the active user. Uses the active user username I to retrieve the user's SID. I mounted the HKU as a psdrive. I query the registry for the key created by UEM. If returns true, it execute the task to disable the device.
3. The script is triggered by task scheduler as SYSTEM when an event occurred. I used the source: Immidio Flex+ Event id: 267. I used that because that's when UEM done completing the sync. For certain the key will be there if it is supposed to be there. I came across an issue where the script would run before the key was created. That prevents it from running until UEM completes its tasks.
<#
.Synopsis
Disable a device when an event occurs.
.DESCRIPTION
This script queries the event log to determine who is the logon user. Returns the username, the user's SID and disables the VMware
Virtual Microphone device if a registry key exists.
.NOTES
Name: VirtualMicDisabled
Author: Carlhens Baptiste
Version: 2.0
DateUpdated: 2019-09-04
.PARAMETER computer
The hostname of the local or remote host
.PARAMETER domain
The domain netbios of the Active Directory user account exists in
.EXAMPLE
- powershell.exe -ExecutionPolicy Bypass -File "C:\ProgramData\ImageConfig\VirtualMicDisabled.ps1"
#>
## Declaring variables
$LogOnUser = ((Get-EventLog -LogName Application -Source "Immidio Flex+" -Message 'Processing asynchronous UEM actions finished for user*').UserName).Split("{\}")[1]
$LogOnUserSID = ([WMI] "Win32_UserAccount.Domain='$env:UserDomain',Name='$($LogOnUser.TrimEnd())'").SID
$ErrorActionPreference = 'SilentlyContinue'
## Record a powerShell session to a text file
Start-Transcript -path "$env:SystemRoot\Logs\ImagePrepLog.txt"
Write-Host "The active user account is $LogOnUser"
Write-Host "The user's SID is $LogOnUserSID"
## Create a drive for HKU if it is not already loaded since it is not by default
If (!(Get-PSDrive HKU -ErrorAction SilentlyContinue)) {
New-PSDrive -Name HKU -PSProvider Registry -Root Registry::HKEY_USERS | Out-Null
}
## Validate if the key exists, if true, disable the VMware Virtual Microphone device
If(Get-ItemPropertyValue "HKU:\$LogOnUserSID\Environment" -Name "EpicDragonUser" -ErrorAction Ignore)
{
Get-PnpDevice -FriendlyName "VMware Virtual Microphone" | Disable-PnpDevice -Confirm:$false
Write-Host "Disabled VMware Virtual Microphone device"
}
## Remove drive for HKU since it is no longer needed
Remove-PSDrive -Name HKU
## End the recording to text file
Stop-Transcript
