<#
.SYNOPSIS
Validates and enforces NVIDIA GPU driver compliance for Siemens NX
based on the official Siemens NX certification matrix.
.DESCRIPTION
This script detects:
- Siemens NX installed version
- Computer model
- Active Intel and NVIDIA GPUs
- Installed NVIDIA driver version
It compares the detected configuration against a certification
matrix provided in a CSV file located in the same directory.
If the installed NVIDIA driver does not match the certified
version for the detected Siemens NX release, computer model,
and GPU model: - DryRun mode logs the required action
- Remediate mode downloads and installs the certified driver
The script is designed for enterprise environments and supports
Microsoft Intune detection and remediation workflows.
.PARAMETER DryRun
Enables audit-only mode.
No driver installation or system changes are performed.
Intended for testing and Intune detection rules.
.PARAMETER Remediate
Enables driver remediation.
If the installed NVIDIA driver is not certified, the script
will download and silently install the certified driver.
Must NOT be used together with -DryRun.
.PARAMETER Help
Displays usage instructions and exits.
powershell.exe -ExecutionPolicy Bypass -File Check-SiemensNX-GPUCompliance.ps1 -Help
.EXAMPLE
Audit-only execution (no changes):
powershell.exe -ExecutionPolicy Bypass -File Check-SiemensNX-GPUCompliance.ps1 -DryRun
.EXAMPLE
Remediation execution (driver install if required):
powershell.exe -ExecutionPolicy Bypass -File Check-SiemensNX-GPUCompliance.ps1 -Remediate
.EXAMPLE
Intune Detection Rule:
Exit Code 0 = Compliant
Exit Code 1 = Non-compliant
.NOTES
Author: Enterprise CAD / PLM Automation
Requires: Administrator privileges
CSV File: SiemensNX_GPU_Driver_Matrix.csv
Log File: SiemensNX_GPU_Compliance.log
NVIDIA driver installation uses silent mode and does not
force a reboot.
#>
[CmdletBinding()]
param (
[switch]$DryRun,
[switch]$Remediate,
[switch]$Help
)
#region HELP
if ($Help) {
Get-Help -Detailed $MyInvocation.MyCommand.Path
exit 0
}
#endregion
if ($DryRun -and $Remediate) { exit 1 }
#region INIT
$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Definition
$LogFile = Join-Path $ScriptDir “SiemensNX_GPU_Compliance.log”
$CsvFile = Join-Path $ScriptDir “SiemensNX_GPU_Driver_Matrix.csv”
#endregion
#region LOGGING
function Write-Log {
param (
[string]$Message,
[ValidateSet(“INFO”,“WARNING”,“ERROR”,“SUCCESS”)]
[string]$Level = “INFO”
)
$Timestamp = Get-Date -Format “yyyy-MM-dd HH:mm:ss”
$Entry = “[$Timestamp] [$Level] $Message”
Add-Content -Path $LogFile -Value $Entry
}
#endregion
Write-Log “===== Siemens NX GPU Compliance START =====”
#region GPU DETECTION
Write-Log “Detecting GPU devices using PnP”
$IntelGPU = Get-PnpDevice -Class Display | Where-Object { $.FriendlyName -match “Intel” }
$NvidiaGPU = Get-PnpDevice -Class Display | Where-Object { $.FriendlyName -match “NVIDIA” }
if (-not $IntelGPU -or -not $NvidiaGPU) {
Write-Log “Required GPU missing” “ERROR”
exit 1
}
foreach ($GPU in @($IntelGPU, $NvidiaGPU)) {
Write-Log “GPU detected: $($GPU.FriendlyName) | Status: $($GPU.Status)”
if ($GPU.Status -ne “OK”) {
Write-Log “GPU is disabled or in error state” “WARNING”
if ($DryRun) {
Write-Log “ACTION REQUIRED: Enable GPU device” “WARNING”
exit 1
}
elseif ($Remediate) {
Write-Log “Enabling GPU device: $($GPU.FriendlyName)”
Enable-PnpDevice -InstanceId $GPU.InstanceId -Confirm:$false | Out-Null
Start-Sleep 3
}
else { exit 1 }
}
}
Write-Log “Intel and NVIDIA GPUs are present and enabled”
#endregion
#region DRIVER DETECTION
Write-Log “Detecting Windows NVIDIA driver version”
$NvidiaWMI = Get-CimInstance Win32_VideoController | Where-Object { $.Name -match “NVIDIA” }
if (-not $NvidiaWMI) {
Write-Log “NVIDIA WMI detection failed” “ERROR”
exit 1
}
$RawDriver = $NvidiaWMI.DriverVersion
$LastBlock = ($RawDriver -split ‘.’)[-1]
$Normalized = “5$LastBlock”
$InstalledDriver = “{0}.{1}” -f $Normalized.Substring(0,3), $Normalized.Substring(3,2)
Write-Log “Windows NVIDIA Driver Version: $RawDriver”
Write-Log “Normalized NVIDIA Driver Version (NX format): $InstalledDriver”
#endregion
#region SIEMENS NX DETECTION
Write-Log “Detecting Siemens NX installation”
$NXRelease = $null
$NXFullVersion = $null
$Roots = @(
“HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall”,
“HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall”
)
foreach ($Root in $Roots) {
Get-ChildItem $Root -ErrorAction SilentlyContinue | ForEach-Object {
try {
$App = Get-ItemProperty $.PSPath
if ($App.DisplayName -match “^Siemens NX\s+(\d{4})”) {
$NXRelease = $Matches[1]
$NXFullVersion = $App.DisplayVersion
return
}
} catch {}
}
if ($NXRelease) { break }
}
if (-not $NXRelease) {
Write-Log “Siemens NX not detected” “ERROR”
exit 1
}
Write-Log “Detected Siemens NX Release: $NXRelease”
Write-Log “Detected Siemens NX Full Version: $NXFullVersion”
#endregion
#region MATRIX MATCH
Write-Log “Matching against certification matrix”
$ComputerModel = ((Get-CimInstance Win32_ComputerSystem).Model.ToLower() -replace ‘[^a-z0-9 ]’,‘’).Trim()
$GPUName = ($NvidiaWMI.Name.ToLower() -replace ‘[^a-z0-9 ]’,‘’).Trim()
$Matrix = Import-Csv $CsvFile
$Match = $Matrix | Where-Object {
$.NXVersion -eq $NXRelease -and
$ComputerModel -like "*$($.ComputerModel.ToLower())" -and
$GPUName -like "$($.GPUModel.ToLower())*"
} | Select-Object -First 1
if (-not $Match) {
Write-Log “No certification match found” “ERROR”
exit 1
}
$CertifiedDriver = $Match.CertifiedDriver
$DriverURL = $Match.DriverDownloadURL
Write-Log “Certified NVIDIA Driver: $CertifiedDriver”
if ([version]$InstalledDriver -eq [version]$CertifiedDriver) {
Write-Log “Driver COMPLIANT with Siemens NX certification” “SUCCESS”
Write-Log “===== Siemens NX GPU Compliance END (COMPLIANT) =====”
exit 0
}
if ($DryRun) {
Write-Log “ACTION REQUIRED: Install certified driver $CertifiedDriver” “WARNING”
Write-Log “===== Siemens NX GPU Compliance END (NON-COMPLIANT) =====”
exit 1
}
#endregion
#region ENTERPRISE HARDENED INSTALL
Write-Log “Starting hardened remediation”
$DriverCache = “C:\ProgramData\NVIDIA\DriverCache”
New-Item -ItemType Directory -Path $DriverCache -Force | Out-Null
$DriverFile = Join-Path $DriverCache "NVIDIA$CertifiedDriver.exe"
$ExtractDir = Join-Path $DriverCache “Extracted_$CertifiedDriver”
if (-not (Test-Path $DriverFile)) {
Write-Log “Downloading NVIDIA driver package”
Invoke-WebRequest $DriverURL -OutFile $DriverFile -UseBasicParsing -ErrorAction Stop
}
if (Test-Path $ExtractDir) {
Remove-Item -Path $ExtractDir -Recurse -Force -ErrorAction SilentlyContinue
}
Write-Log “Extracting NVIDIA driver package silently”
$ExtractProcess = Start-Process -FilePath $DriverFile-ArgumentList "-s -extract="$ExtractDir""
-WindowStyle Hidden -Wait -PassThru
if ($ExtractProcess.ExitCode -ne 0) {
Write-Log “Extraction failed (ExitCode $($ExtractProcess.ExitCode))” “ERROR”
exit 1
}
Write-Log “Extraction completed successfully” “SUCCESS”
#endregion
#region INSTALL WITH RETRY
$SetupExe = Get-ChildItem -Path $ExtractDir -Recurse -File -Filter “setup.exe” -ErrorAction SilentlyContinue |
Select-Object -First 1
if (-not $SetupExe) {
Write-Log “setup.exe not found after extraction” “ERROR”
exit 1
}
Write-Log “Starting NVIDIA silent installation”
$InstallProcess = Start-Process -FilePath $SetupExe.FullName-ArgumentList "-s -noreboot"
-WindowStyle Hidden -Wait -PassThru
if ($InstallProcess.ExitCode -ne 0) {
Write-Log “Driver installation failed (ExitCode $($InstallProcess.ExitCode))” “ERROR”
exit 1
}
Write-Log “Driver installation process completed (ExitCode 0)” “SUCCESS”
#endregion
#region POST-INSTALL VALIDATION
Write-Log “Re-validating installed NVIDIA driver version after installation”
Start-Sleep -Seconds 10
$PostInstallWMI = Get-CimInstance Win32_VideoController | Where-Object { $_.Name -match “NVIDIA” }
$PostRawDriver = $PostInstallWMI.DriverVersion
$PostLastBlock = ($PostRawDriver -split ‘.’)[-1]
$PostNormalized = “5$PostLastBlock”
$PostInstalledDriver = “{0}.{1}” -f $PostNormalized.Substring(0,3), $PostNormalized.Substring(3,2)
if ([version]$PostInstalledDriver -eq [version]$CertifiedDriver) {
Write-Log “Driver successfully remediated and now COMPLIANT with Siemens NX certification” “SUCCESS”
Write-Log “===== Siemens NX GPU Compliance END (COMPLIANT) =====”
exit 0
}
else {
Write-Log “Driver installation completed but version does NOT match certified driver” “ERROR”
Write-Log “===== Siemens NX GPU Compliance END (NON-COMPLIANT) =====”
exit 1
}
#endregion