New Intune AppWorkload.log for Troubleshooting Win32 Apps

Starting in Intune service release 2408, a new log file AppWorkload.log is available to help troubleshoot and analyze Win32 app management events on the client. This log file contains all the logging data pertaining to Win32 app deployment activities carried out by the IME.

Until now, Win32 app deployment troubleshooting was done using the IntuneManagementExtension.log. All the activities and events for Win32 apps were logged into this single log. Microsoft has now chosen to switch them to this specific AppWorkload.log. Since everything related to app deployments has now been well organized, monitoring and troubleshooting have become so easy for Intune administrators.

When you are responsible for managing numerous devices, the IME AppWorkload.log offers a more tailored perspective on the deployment of applications, which is really helpful. These improvements provide better troubleshooting and analysis of app management events on the client.

Location of AppWorkload.log

The AppWorkload.log is located on the client machine in C:\ProgramData\Microsoft\IntuneManagementExtension\Logs. You can open this log file using the CMTrace.exe tool or another log file viewer of your choice. You should find the log along with other Intune Management Extension (IME) logs.

Using AppWorkload.log for troubleshooting Win32 app deployments

Now that you are aware of the location of AppWorkload.log, let me show you how you can use this log file when troubleshooting issues with Win32 app installations. The entire app installation can be tracked with this single log file, but there are numerous details logged in this file. To make it easier, I have broken down the logging workflow and explained it below in steps.

Step 1: IME starts with the app check-in

When a user installs a Win32 app from the Company Portal or if an app has been deployed as required, the IME starts with the app check-in procedure. The app poller starts its job, as shown in the screenshot below. This is where the app evaluation process begins.

[Win32AppAsync] End app check in	AppWorkload
[Win32AvailableAppAsync] Starting app check in	AppWorkload
[Win32App] Start available apps check-in a809c579-68f3-46fe-828f-a5888108ae67
[Win32App] ----------------------------------------------------- application poller starts. ----------------------------------------------------- 	AppWorkload

Step 2: Check ESP status and sidecar CSP provider status

After the IME detects the app, in the log we see the ESP Checking SidecarCspProvider status.

[Win32App] isDeviceWPJ = False	AppWorkload
[Win32App] Checking ESP status and phase for sessionId: 0
[Win32App] CheckDeviceOnlyFromFirstSyncReg Opening SOFTWARE\Microsoft\Enrollments
[Win32App] ESP Checking SidecarCspProvider status

Step 3: Content Folder Created

In this step, the App Workload file shows that a content folder is created. If you’re wondering where the downloaded Win32 apps are stored, it is saved to C:\Program Files (x86)\Microsoft Intune Management Extension\Content folder on the client machine.

Start CreateAppInstallNotifyInboxIfNotExist	AppWorkload
Created Content folder	AppWorkload
[Win32App] Refresh session info.	AppWorkload

Step 4: Gets the AAD user session and MDM certificate

In this step, there are two activities that are performed. First, there is a check for valid AAD user session and second, the MDM device certificate. All the details can be seen in the below screenshot as well.

[Win32App] Got 2 active user sessions	AppWorkload
[Win32App] valid AAD user session id : 3	AppWorkload
[Win32App] Total valid AAD User session count is 1	AppWorkload
[Win32App] Set MdmDeviceCertificate : 9BE55A5F4ADCDFB5F0D2A7ECCEE230FCF385D5D1	AppWorkload

Step 5: Load global Win32 app settings

In this step, we see the global Win32 app settings are loaded. After this step, the application poller is stopped. The available apps check-in procedure is also completed here.

Step 6: ESP Status and Branding Info retrieval

In this step, we see that the ESP status for the user is processed and the branding information you have configured in Intune is retrieved. Take a look at how to configure company branding in Intune.

[Win32App][BrandManager] GetBrandingInfo brandingInfo: , FullSync: False	AppWorkload
[Win32App][BrandManager] GetBrandingInfo brandingInfoToReturn: {"CompanyName":"Prajwal Desai","ColorBackgroundLogoUri":"https://microsoft.com/ContentService/SCService/Contents/252336fc-b78f-4734-baa1-4774e13ce8f8","WhiteBackgroundLogoUri":"https://microsoft.com/ContentService/SCService/Contents/653a8ceb-4a33-400c-9133-053fb52cd44c","AccentColor":-14606047}
[Win32App][BrandManager] GetBrandingInfo returning brand info {"CompanyName":"Prajwal Desai","ColorBackgroundLogoUri":"https://manage.microsoft.com/ContentService/SCService/Contents/252336fc-b78f-4734-baa1-4774e13ce8f8","WhiteBackgroundLogoUri":"https://manage.microsoft.com/ContentService/SCService/Contents/653a8ceb-4a33-400c-9133-053fb52cd44c","AccentColor":-14606047}	AppWorkload
[Win32App][BrandManager] UpdateBrandingForToast Set Brand for toast {"CompanyName":"Prajwal Desai","ColorBackgroundLogoUri":"https://manage.microsoft.com/ContentService/SCService/Contents/252336fc-b78f-4734-baa1-4774e13ce8f8","WhiteBackgroundLogoUri":"https://manage.microsoft.com/ContentService/SCService/Contents/653a8ceb-4a33-400c-9133-053fb52cd44c","AccentColor":-14606047}
[Win32App] Checking ESP status and phase for sessionId: 3

Step 7: Processes policy subgraphs

In this step, we see processing the subgraphs with specific app IDs. Once that is done, the GRS values from the storage path are read.

[Win32App][V3Processor] Processing subgraph with app ids: 1be3baf9-9ac6-4cc9-a617-9185a166c134	AppWorkload
[Win32App][GRSManager] Reading GRS values from storage path: a4ca2e60-4a90-4f60-b5b0-cc3ec5786055\GRS\wO6HoVeKtMqFsKyzNIQxmazma+d4nqaWNmRn6QTBY=\.	AppWorkload
[Win32App][GRSManager] Found GRS value: 01/17/2024 13:34:47 at key a4ca2e60-4a90-4f60-b5b0-cc3ec5786055\GRS\wO6HoVeKtMqFsKyzNIQxmazma+d4nqaWNmRn6QTBY=\1be3baf9-9ac6-4cc9-a617-9185a166c134.
[Win32App][GRSManager] App with id: 1be3baf9-9ac6-4cc9-a617-9185a166c134 is expired.
Hash = wO6HoVeKtMqFsKyzNIQxmazma+d4nqaWNmRn6QTBY=
GRSTimeUTC = 1/17/2024 1:34:47 PM
[Win32App][ReevaluationScheduleManager] Subgraph reevaluation interval is not expired.
Hash = wO6HoVeKtMqFsKyzNIQxmazma+d4nqaWNmRn6QTBY=	AppWorkload)
[Win32App][V3Processor] Done processing subgraph.

Step 8: Win32 app detection and installation

Finally, the Win32 app installation begins. During this step, the detection script you’ve specified for Win32 app is processed. If the Win32 app installation fails here, you should see the error code right away.

[Win32App] Start detectionManager SideCarScriptDetectionManager
[Win32App] Detection script file C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\fe0cfac8-28e9-4147-849a-76023ee1d2a6_1.ps1 is saved.
"C:\Program Files (x86)\Microsoft Intune Management Extension\agentexecutor.exe"  -powershellDetection  "C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\fe0cfac8-28e9-4147-849a-76023ee1d2a6_1.ps1" "C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\fe0cfac8-28e9-4147-849a-76023ee1d2a6_1.ps1quotedResultFilePath.txt" "C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\fe0cfac8-28e9-4147-849a-76023ee1d2a6_1.ps1quotedErrorFilePath.txt" "C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\fe0cfac8-28e9-4147-849a-76023ee1d2a6_1.ps1quotedTimeoutFilePath.txt" 3600 "C:\Windows\System32\WindowsPowerShell\v1.0" 0 "C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\fe0cfac8-28e9-4147-849a-76023ee1d2a6_1.ps1quotedExitCodeFilePath.txt" False
[Win32App] SideCarScriptDetectionManager create files for outputs
[Win32App] SideCarScriptDetectionManager Launch powershell executor in machine session
[Win32App] SideCarScriptDetectionManager Create proxy process successfully.
[Win32App] SideCarScriptDetectionManager process id = 1392
[Win32App] SideCarScriptDetectionManager Powershell execution process timeout milliseconds: 3600000
[Win32App] SideCarScriptDetectionManager Execution is done, collecting result
[Win32App] SideCarScriptDetectionManager Powershell execution got lpExitCode: 0 lastWin32Error:
[Win32App] SideCarScriptDetectionManager Powershell ExitCode: 0
[Win32App] Detection script file C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts\fe0cfac8-28e9-4147-849a-76023ee1d2a6_1.ps1quotedExitCodeFilePath.txt is deleted.
[Win32App] Checked Powershell script result: Detected

If the app installation is successful, the AppWorkload.log updates the status in the company portal. [Win32App][ReportingManager] Sending status to company portal based on report.

[StatusService] Sending an update to user a4ca2e60-4a90-4f60-b5b0-cc3ec5786055 via callback for app: fe0cfac8-28e9-4147-849a-76023ee1d2a6. Applicability: Applicable, Status: Installed, ErrorCode: null

Conclusion

With the introduction of Intune AppWorkload.log, Microsoft has made troubleshooting Win32 apps easier. You should see this log file on your client computers if your Intune tenant is updated to service release 2408 or later. Thus, keep an eye out for these updated logs the next time you are deep in troubleshooting an Intune problem.