How to collect Device Diagnostics logs using Intune Portal

In this post I will show you how to collect Device Diagnostics logs using Intune Portal. MEM Admin center has the ability to collect the Diagnostics logs remotely from the device.

Collecting the diagnostics logs remotely through portal gives the ability to get the logs remotely without disturbing the user. Good thing is that, diagnostics logs are stored for 28 days and we can collect upto 10 collections of these logs.

Verify Device diagnostics is enabled

Make sure Device diagnostics is turned on. Login to MEM Admin center and navigate to Tenant administration > Diagnostics settings.

Device diagnostics are available for corporate-managed devices running Windows 10, version 1909 and later, or Windows 11 should be Enabled.

Initiate Device Diagnostics on Intune portal

On MEM Admin Center, navigate to Devices and click on specific device. With Overview option selected, click on Collect diagnostics.

Click on Yes to initiate collecting the diagnostics logs.

You will see under Notifications that Collect diagnostics initiated.

Allow some time, you may check the status by clicking on Device diagnostics under same Device.

We can see the Status showing as Pending diagnostics upload. If device is online and reporting back to the portal, it should collect the logs within next 20 mins.

You might see the error as Failed with following message:

The diagnostic upload failed because it timed out. This is a known issue for devices that don't have the Windows KB4601315 or KB4601319 installed.

Following steps are recommended for it:

Make sure to install either KB4601315 or KB4601319 based on the OS type. Then, reboot the device and retry.

Once above pre-requisite is met, you will be able to see the Device diagnostics status showing as Complete and ready to Download. Click on it to download local copy of the file which is in zip format.

What is included in Device Diagnostics

Extract the content from zip file. Following information / data is collected as part of Device Diagnostics.

Registry Keys:

1. HKLM\Software\Microsoft\IntuneManagementExtension
2. HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
3. HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection
4. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
5. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
6. HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall
7. HKLM\Software\Policies
8. HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL
9. HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
10. HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
11. HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Commands:

12. %programfiles%\windows defender\mpcmdrun.exe -GetFiles
13. %windir%\system32\certutil.exe -store
14. %windir%\system32\certutil.exe -store -user my
15. %windir%\system32\Dsregcmd.exe /status
16. %windir%\system32\ipconfig.exe /all
17. %windir%\system32\mdmdiagnosticstool.exe
18. %windir%\system32\msinfo32.exe /report %temp%\MDMDiagnostics\msinfo32.log
19. %windir%\system32\netsh.exe advfirewall show allprofiles
20. %windir%\system32\netsh.exe advfirewall show global
21. %windir%\system32\netsh.exe lan show profiles
22. %windir%\system32\netsh.exe winhttp show proxy
23. %windir%\system32\netsh.exe wlan show profiles
24. %windir%\system32\netsh.exe wlan show wlanreport
25. %windir%\system32\ping.exe -n 50 localhost
26. %windir%\system32\powercfg.exe /batteryreport /output %temp%\MDMDiagnostics\battery-report.html
27. %windir%\system32\powercfg.exe /energy /output %temp%\MDMDiagnostics\energy-report.html

Event Viewers:

28. Application
29. Microsoft-Windows-AppLocker/EXE and DLL
30. Microsoft-Windows-AppLocker/MSI and Script
31. Microsoft-Windows-AppLocker/Packaged app-Deployment
32. Microsoft-Windows-AppLocker/Packaged app-Execution
33. Microsoft-Windows-AppxPackaging/Operational
34. Microsoft-Windows-Bitlocker/Bitlocker Management
35. Microsoft-Windows-HelloForBusiness/Operational
36. Microsoft-Windows-SENSE/Operational
37. Microsoft-Windows-SenseIR/Operational
38. Microsoft-Windows-Windows Firewall With Advanced Security/Firewall
39. Setup
40. System

Files:

41. %ProgramData%\Microsoft\DiagnosticLogCSP\Collectors*.etl
42. %ProgramData%\Microsoft\IntuneManagementExtension\Logs*.*
43. %ProgramData%\Microsoft\Windows Defender\Support\MpSupportFiles.cab
44. %ProgramData%\Microsoft\Windows\WlanReport\wlan-report-latest.html
45. %temp%\MDMDiagnostics\battery-report.html
46. %temp%\MDMDiagnostics\energy-report.html
47. %temp%\MDMDiagnostics\mdmlogs-<Date/Time>.cab
48. %temp%\MDMDiagnostics\msinfo32.log
49. %windir%\ccm\logs*.log
50. %windir%\ccmsetup\logs*.log
51. %windir%\logs\CBS\cbs.log
52. %windir%\logs\measuredboot*.*
53. %windir%\Logs\WindowsUpdate*.etl
54. %windir%\temp%computername%*.log
55. %windir%\temp\officeclicktorun*.log

Important Links

https://docs.microsoft.com/en-us/mem/intune/remote-actions/collect-diagnostics