[Bug]: There is no data to export

Question

[Bug]: There is no data to export

Saiyato opened this issue 10 months ago · 7 comments

What happened?
After installing the module on two machines, the Microsoft365 scanner produces no results. Since the environments I'm using it on do not have Azure subscriptions, I'm unable to comment there. The response of the script is always the same:

WARNING: [11:47:56:603] - [Invoke-M365Scanner] - There is no data to export - warning - {MACHINE-NAME] - AzureSubscriptionScanner

How to reproduce it
Steps to reproduce the behavior:

Clone the repo into ~/Modules
Unblock the files (elevated privileged are required, might be a good addition to the docs)
Set the params:

$param = @{
    Instance    = 'Microsoft365';
    Analysis    = @('ExchangeOnline', 'Microsoft365', 'MicrosoftTeams', 'SharePointOnline');
    DeviceCode  = $true;
    ExportTo    = "HTML";
}

Invoke the tool: Invoke-Monkey365 @param -Verbose

Expected behavior
I would expect at least some results to show, but I see scripts getting loaded and executed, without any results to show for it. The exception logs are created, however empty (0KB).

Screenshots or Logs
PowerShell 7.4.0

PS C:\Users\**censored**> Invoke-Monkey365 @param -Verbose
VERBOSE: Loading module from path 'C:\Users\**censored**\monkeymsal.psd1'.
VERBOSE: Removing the imported "New-MonkeyMSALApplicationClientOptions" function.
VERBOSE: Removing the imported "New-MonkeyMsalApplication" function.
VERBOSE: Removing the imported "Get-MonkeyMSALToken" function.
VERBOSE: Removing the imported "Convert-SecureStringToPlainText" function.
VERBOSE: Loading module from path 'C:\Users\**censored**\monkey365\core\modules\monkeymsal\monkeymsal.psm1'.
VERBOSE: Exporting function 'Install-Core'.
VERBOSE: Exporting function 'Install-Desktop'.
VERBOSE: Exporting function 'Install-MsalLibrary'.
VERBOSE: Exporting function 'Convert-SecureStringToPlainText'.
VERBOSE: Exporting function 'Get-LocalizedData'.
VERBOSE: Exporting function 'Get-OsInfo'.
VERBOSE: Exporting function 'New-MonkeyMSALApplicationClientOptions'.
VERBOSE: Exporting function 'Get-MonkeyMSALToken'.
VERBOSE: Exporting function 'New-MonkeyMsalApplication'.
VERBOSE: Importing function 'Convert-SecureStringToPlainText'.
VERBOSE: Importing function 'Get-MonkeyMSALToken'.
VERBOSE: Importing function 'New-MonkeyMsalApplication'.
VERBOSE: Importing function 'New-MonkeyMSALApplicationClientOptions'.
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code **censored** to authenticate.
VERBOSE: [13:41:42:700] - [Get-MonkeyMSGraphObject] - Getting organization from microsoft graph - verbose - **machine name** -
VERBOSE: [13:41:44:992] - [Get-TenantInformation] - Getting tenant information from **tenant** Id - verbose - **machine name** - AADTenantInfo
VERBOSE: [13:41:45:102] - [Get-MonkeyMSGraphObject] - Getting organization from microsoft graph - verbose - **machine name** -
VERBOSE: [13:41:45:253] - [Get-MonkeyMSGraphObject] - Getting subscribedSkus from microsoft graph - verbose - **machine name** -
VERBOSE: [13:41:45:368] - [Get-MonkeyMSGraphObject] - Getting domains from microsoft graph - verbose - **machine name** -
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code **censored** to authenticate.
VERBOSE: [13:41:56:141] - [New-HttpRequestMessage] - Adding client-request-id header - verbose - **machine name** -
VERBOSE: [13:41:58:150] - [Get-MonkeyMSGraphUserDirectoryRole] - Getting user's information from **censored** - verbose - **machine name** - AzureGraphDirectoryRoleByUserId
VERBOSE: [13:41:58:279] - [Get-MonkeyMSGraphObject] - Getting users/**censored**/transitiveMemberOf from microsoft graph - verbose - **machine name** -
VERBOSE: [13:41:58:471] - [Get-MonkeyMSGraphObject] - Getting users from microsoft graph - verbose - **machine name** -
VERBOSE: [13:41:58:596] - [Get-MonkeyMSGraphObject] - Getting groups from microsoft graph - verbose - **machine name** -
VERBOSE: [13:41:58:721] - [Get-MonkeyMSGraphObject] - Getting me from microsoft graph - verbose - **machine name** -
VERBOSE: [13:41:59:759] - [Invoke-ClientRequest] - [NotFound] https://graph.windows.net/**tenant**/users/**censored**/thumbnailPhoto?api-version=1.6 - verbose - **machine name** -
VERBOSE: [13:41:59:764] - [Get-HttpResponseError] - Unable to process URL: https://graph.windows.net/**tenant**/users/**censored**/thumbnailPhoto?api-version=1.6 - verbose - **machine name** -
VERBOSE: [13:41:59:766] - [Get-HttpResponseError] - [404]: Not Found - verbose - **machine name** -
VERBOSE: [13:41:59:769] - [Get-HttpResponseError] - Request_ResourceNotFound - verbose - **machine name** -
VERBOSE: [13:41:59:772] - [Get-HttpResponseError] - Resource 'thumbnailPhoto' does not exist or one of its queried reference-property objects are not present. - verbose - **machine name** -
WARNING: [13:41:59:776] - [Invoke-M365Scanner] - There is no data to export - warning - **machine name** - AzureSubscriptionScanner
VERBOSE: [13:42:00:189] - [Stop-Logger] - Stopping logger - verbose - **machine name** -

PowerShell 5.1.22621.2506

PS C:\WINDOWS\system32> Invoke-Monkey365 @param -Verbose
VERBOSE: Loading module from path 'C:\Program Files\WindowsPowerShell\Modules\monkey365\core\modules\monkeylogger\monkeylogger.psm1'.
VERBOSE: Loading module from path 'C:\Program Files\WindowsPowerShell\Modules\monkey365\monkey365.psm1'.
VERBOSE: Loading module from path 'C:\Program Files\WindowsPowerShell\Modules\monkey365\core\modules\monkeymsal\monkeymsal.psd1'.
VERBOSE: Removing the imported "Convert-SecureStringToPlainText" function.
VERBOSE: Removing the imported "Get-MonkeyMSALToken" function.
VERBOSE: Removing the imported "New-MonkeyMsalApplication" function.
VERBOSE: Removing the imported "New-MonkeyMSALApplicationClientOptions" function.
VERBOSE: Loading module from path 'C:\Program Files\WindowsPowerShell\Modules\monkey365\core\modules\monkeymsal\monkeymsal.psm1'.
VERBOSE: Exporting function 'Install-Core'.
VERBOSE: Exporting function 'Install-Desktop'.
VERBOSE: Exporting function 'Install-MsalLibrary'.
VERBOSE: Exporting function 'Convert-SecureStringToPlainText'.
VERBOSE: Exporting function 'Get-LocalizedData'.
VERBOSE: Exporting function 'Get-OsInfo'.
VERBOSE: Exporting function 'New-MonkeyMSALApplicationClientOptions'.
VERBOSE: Exporting function 'Get-MonkeyMSALToken'.
VERBOSE: Exporting function 'New-MonkeyMsalApplication'.
VERBOSE: Importing function 'Convert-SecureStringToPlainText'.
VERBOSE: Importing function 'Get-MonkeyMSALToken'.
VERBOSE: Importing function 'New-MonkeyMsalApplication'.
VERBOSE: Importing function 'New-MonkeyMSALApplicationClientOptions'.
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code **censored** to authenticate.
VERBOSE: [14:28:48:975] - [Get-MonkeyMSGraphObject] - Getting organization from microsoft graph - verbose - **machine** -
VERBOSE: [14:29:53:201] - [Get-TenantInformation] - Getting tenant information from **tenant** Id - verbose - **machine** -
AADTenantInfo
VERBOSE: [14:29:53:320] - [Get-MonkeyMSGraphObject] - Getting organization from microsoft graph - verbose - **machine** -
VERBOSE: [14:29:53:475] - [Get-MonkeyMSGraphObject] - Getting subscribedSkus from microsoft graph - verbose - **machine** -
VERBOSE: [14:29:53:658] - [Get-MonkeyMSGraphObject] - Getting domains from microsoft graph - verbose - **machine** -
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code **censored** to authenticate.
VERBOSE: [14:30:04:557] - [New-HttpRequestMessage] - Adding client-request-id header - verbose - **machine** -
VERBOSE: [14:30:10:876] - [New-HttpRequestMessage] - Adding x-ms-tenant-id header - verbose - **machine** -
VERBOSE: [14:30:10:882] - [New-HttpRequestMessage] - Adding x-ms-correlation-id header - verbose - **machine** -
VERBOSE: [14:30:11:179] - [New-HttpRequestMessage] - Adding x-ms-tenant-id header - verbose - **machine** -
VERBOSE: [14:30:11:183] - [New-HttpRequestMessage] - Adding x-ms-correlation-id header - verbose - **machine** -
VERBOSE: [14:30:11:641] - [New-MonkeyMsalApplication] - Using redirect URI https://oauth.spops.microsoft.com/ - verbose - **machine** -
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code **censored** to authenticate.
VERBOSE: [14:31:54:701] - [Get-MonkeyMSGraphUserDirectoryRole] - Getting user's information from **user** - verbose - **machine**
 - AzureGraphDirectoryRoleByUserId
VERBOSE: [14:31:54:843] - [Get-MonkeyMSGraphObject] - Getting users/**user**/transitiveMemberOf from microsoft graph - verbose -
**machine** -
VERBOSE: [14:31:54:973] - [Get-MonkeyMSGraphObject] - Getting users from microsoft graph - verbose - **machine** -
VERBOSE: [14:31:55:083] - [Get-MonkeyMSGraphObject] - Getting groups from microsoft graph - verbose - **machine** -
VERBOSE: [14:31:55:199] - [Get-MonkeyMSGraphObject] - Getting me from microsoft graph - verbose - **machine** -
VERBOSE: [14:31:55:630] - [New-InitialSessionState] - Null variable value found on WriteLog - verbose - **machine** -
VERBOSE: [14:31:55:633] - [New-InitialSessionState] - Null variable value found on returnData - verbose - **machine** -
VERBOSE: [14:31:55:637] - [New-InitialSessionState] - Importing module: C:\Program Files\WindowsPowerShell\Modules\monkey365\core/modules/monkeymsal -
verbose - **machine** -
VERBOSE: [14:31:55:644] - [New-InitialSessionState] - Importing module: C:\Program Files\WindowsPowerShell\Modules\monkey365\core/modules/monkeylogger -
verbose - **machine** -
VERBOSE: [14:31:55:650] - [Start-MonkeyJob] - Opening runspacePool - verbose - **machine** -
VERBOSE: [14:31:56:467] - [<ScriptBlock>] - Sleeping Monkey watcher before checking access tokens - verbose - **machine** -
VERBOSE: [14:31:56:737] - [Invoke-ClientRequest] - [NotFound]
https://graph.windows.net/**tenant**/users/**user**/thumbnailPhoto?api-version=1.6 - verbose -
**machine** -
VERBOSE: [14:31:56:756] - [Get-HttpResponseError] - Unable to process URL:
https://graph.windows.net/**tenant**/users/**user**/thumbnailPhoto?api-version=1.6 - verbose -
**machine** -
VERBOSE: [14:31:56:765] - [Get-HttpResponseError] - [404]: Not Found - verbose - **machine** -
VERBOSE: [14:31:56:875] - [Get-HttpResponseError] - Request_ResourceNotFound - verbose - **machine** -
VERBOSE: [14:31:56:878] - [Get-HttpResponseError] - Resource 'thumbnailPhoto' does not exist or one of its queried reference-property objects are not
present. - verbose - **machine** -
VERBOSE: [14:31:57:125] - [New-InitialSessionState] - Null variable value found on WriteLog - verbose - **machine** -
VERBOSE: [14:31:57:129] - [New-InitialSessionState] - Importing module: C:\Program
Files\WindowsPowerShell\Modules\monkey365/core/modules/monkeyhttpwebrequest - verbose - **machine** -
VERBOSE: [14:31:57:137] - [New-InitialSessionState] - Importing module: C:\Program Files\WindowsPowerShell\Modules\monkey365/core/modules/monkeylogger -
verbose - **machine** -
VERBOSE: [14:31:57:141] - [New-InitialSessionState] - Importing module: C:\Program Files\WindowsPowerShell\Modules\monkey365/core/modules/monkeyast - verbose
 - **machine** -
VERBOSE: [14:31:57:144] - [New-InitialSessionState] - Importing module: C:\Program Files\WindowsPowerShell\Modules\monkey365/core/modules/monkeyjob - verbose
 - **machine** -
VERBOSE: [14:31:57:151] - [New-InitialSessionState] - Importing module: C:\Program Files\WindowsPowerShell\Modules\monkey365/core/modules/monkeyutils -
verbose - **machine** -
VERBOSE: [14:31:57:155] - [New-InitialSessionState] - Importing module: C:\Program
Files\WindowsPowerShell\Modules\monkey365/core/api/m365/SharePointOnline/utils/enum.ps1 - verbose - **machine** -
VERBOSE: [14:31:57:160] - [New-InitialSessionState] - Importing module: C:\Program
Files\WindowsPowerShell\Modules\monkey365/core/tasks/Initialize-MonkeyScan.ps1 - verbose - **machine** -
VERBOSE: [14:31:57:470] - [New-InitialSessionState] - Importing command: Get-MonkeyGraphLinkedObject - verbose - **machine** -
VERBOSE: [14:31:57:475] - [New-InitialSessionState] - Importing command: Get-MonkeyGraphObject - verbose - **machine** -
... many more lines -> see full log
**machine** -
VERBOSE: [14:32:11:389] - [Invoke-MonkeyJob] - Invoked all Jobs, Collecting the last jobs that are running - verbose - **machine** -
VERBOSE: [14:32:11:409] - [Invoke-MonkeyJob] - Finishing the 1 job(s) that are still running - verbose - **machine** -
VERBOSE: [14:32:11:470] - [Invoke-MonkeyJob] - Exiting script - verbose - **machine** -
VERBOSE: [14:32:11:473] - [Invoke-MonkeyJob] - Jobs Collected: 1 - verbose - **machine** -
VERBOSE: [14:32:11:477] - [Invoke-MonkeyJob] - Time took to Invoke and Complete the Jobs : 00:00:00.0925501 - verbose - **machine** -
WARNING: [14:32:11:786] - [Invoke-M365Scanner] - There is no data to export - warning - **machine** - AzureSubscriptionScanner
VERBOSE: [14:32:11:864] - [Stop-Logger] - Stopping logger - verbose - **machine** -

full_log.txt

From where are you running Monkey365?
Please, complete the following information:

Resource: Docker container and/or workstation (mostly workstation, b/c I couldn't get it to work in docker)
OS: Windows 11
PowerShell Version [$PsVersionTable]: 7.4.0 and 5.1.22621.2506
Monkey365 Version: v0.91.2-beta

Additional context
It happens on both my laptop and desktop. Running in PS5 gives me more log lines around what commands have been imported and executed. The end result is the same however -> There is no data to export. I have Security and Global Reader roles.

I could trace it back to Invoke-M365Scanner.ps1; the result of the collectors is null.

Answer 1 · 2024-01-09T21:43:35.000Z

Hi @Saiyato thanks for catching this! I appreciate it.

This is a very rare error and it seems that only appears when monkey365 is placed in "Program Files".

I believe that the issue comes from the PowerShell AST (Abstract Syntax Tree) class, but I'm still investigating the issue and I'll get back to you once I have an explanation.

In the meantime, you can install monkey365 in a different path.

Cheers,

Answer 2 · 2024-01-11T17:43:05.000Z

Hi @Saiyato,

This is now fixed on dev branch.

Cheers,

Answer 3 · 2024-01-12T07:51:58.000Z

Hi,

Thanks for investigating, When I import the tool from a non-default directory it works, any of the default directories seem to yield the same result.

I will have to retest with dev, I'll update as soon as I have had the time to thoroughly test. Thanks again!

Answer 4 · 2024-05-12T02:10:33.000Z

This issue has been automatically marked as stale because it has not had recent activity. We kindly ask you to check again if the issue you reported is still relevant in the current version of Monkey 365. If it is, update this issue with a comment, otherwise it will be automatically closed if no further activity occurs. Thank you for your contributions.

Answer 5 · 2024-05-26T02:12:35.000Z

This issue was closed because it has been inactive for 14 days since being marked as stale. If the issue is still relevant, feel free to re-open it or open a new one.

Answer 6 · 2024-06-12T10:11:20.000Z

I realise I hadn't replied, but it's working form the default directory for me :) Thanks for the fix!

Answer 7 · 2024-06-12T13:58:07.000Z

No worries and thanks for using Monkey365!