Collect logs from an Intune-managed Windows device

For almost every ticket about an Intune-managed device, the service desk wants to see logs. This is how you collect them without the user having to find and mail files.

With Collect diagnostics

Intune has a device action for diagnostics:

Go to Devices > All devices and select the device.
Select Collect diagnostics and then Collect data.
Follow the status under Monitor > Device diagnostics. When the collection is ready, select … > Download in the row of the action and confirm with Yes.

The package holds registry keys, event logs, command output and log files, including those of the Intune Management Extension. Intune keeps it for 28 days, up to ten packages per device; Microsoft keeps it in its support systems, outside Intune’s data management. It works on Windows devices owned by the organization with Windows 10 1909 or later or Windows 11.

You need the role Help Desk Operator or School Administrator for it, or a custom role with Remote tasks/Collect diagnostics and read permissions on devices. The action is on by default; an administrator can turn it off under Tenant administration > Device diagnostics. The device must be online while the data is collected. Microsoft names two known causes of a failed collection: the device does not receive the action within 24 hours, for example because it is off, or an update is missing (KB4601315 or KB4601319).

For a Win32 app

When the installation of one Win32 app failed, you can have log files collected in that app’s installation details. You get there through Troubleshooting + support > Troubleshoot: select the user, the device, Managed Apps and the app. You give the full path of each file, optionally with an environment variable such as %PROGRAMDATA%, and at most 25 paths. Microsoft names a maximum of 250 MB or 25 files, about 15 to 20 minutes of waiting and these file types: .log, .txt, .dmp, .cab, .zip, .xml, .evtx and .evtl. You download the result with Download diagnostics.

Where the IME logs are

On the device itself, the logs of the Intune Management Extension are usually in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs. Whoever fetches them there has to collect and send them by hand.

What Toolbelt Connect adds

With Toolbelt Connect, the service desk fetches logs from the browser while the ticket is open:

Support package in one click. The package of Endpoint Toolbelt with the MDM diagnostics, all IME logs, the status of Win32 apps and remediations, and a summary of the IME log per app. It is straight in the browser and is kept for 14 days.
Fetch a log file. Any file that the list in the device’s policy allows, or through the file browser any file the file rules allow (not the user profiles), up to 200 MB.
Read event logs and the registry. Events per log and level, and registry keys, without a package.
Send or request a file. To the user’s Downloads folder, or ask the user for a file.

With the default setting Ask, nothing happens without the user’s consent, and a ticket number you enter is on every command in the audit trail.