Microsoft Intune Management Extension Logs: Complete Guide

In this post, I am going to cover all the Microsoft Intune Management Extension logs, the location of the IME logs, and the information logged in each log file. IME logs assist administrators in troubleshooting app and script deployments and investigating performance issues.

In Intune, troubleshooting Win32 app deployments or PowerShell script deployments is primarily done with the IME log files. The log files contain the error codes, which are really useful in troubleshooting the issue.

What is Intune Management Extension?

The Microsoft Intune management extension (IME) is a component of Intune to streamline application installation, execute PowerShell scripts, and monitor the compliance of devices effectively.

The IME is installed automatically when a PowerShell script or Win32 app is assigned to a device or user using Intune. After it’s installed, the Intune management extension agent checks every hour for any new Win32 app assignments.

Tip: When you restart your device or restart the IntuneManagementExtension service, you automatically force the IME agent to check for new app assignments.

One way to confirm that the IME is installed on your devices is to look for the Microsoft Intune Management Extension service in the Services console. This service is set to launch automatically when your device is powered on. The path to this service executable is listed below.

"C:\Program Files (x86)\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe"

Where are Intune Management Extension Logs located?

So, where does the Intune management extension store log files? The Intune IME logs are found in the C:\ProgramData\Microsoft\IntuneManagementExtension\Logs folder. Previously there were a total of 7 IME logs but starting in Intune service release 2408, Microsoft has introduced two new logs: AppWorkload.log and ClientCertCheck.log. So that makes a total of 9 IME log files now.

How do I view IME logs?

To view the IME log files, IT administrators can use the Notepad app that comes preinstalled on Windows devices. Microsoft recommends using CMTrace as an alternative to Notepad because it neatly handles log file formatting and highlights the errors and warnings with predefined colors.

The CMTrace log file viewer is installed along with Configuration Manager client. However, if your devices are only managed by Intune, you must copy the CMTrace tool to the destination computer before using it. If you still need better options, take a look at the list of log file viewers for ConfigMgr and Intune.

Default size of IME Log Files

By default, the size of the IME log files is 3 MB. When a log file reaches its maximum size, a new log file is created with the same name. These log file names will be appended with the date of creation.

When you enroll a new device in Intune, the size of the IME logs is merely in KB. After deploying apps, scripts and other policy assignments, the size of these log files grows. If you’re considering changing the size of the IME logs, I don’t think Microsoft supports it.

List of Intune management extension logs

Now I am going to list all the Intune management extension logs that you should find on every Windows device that is enrolled in Intune. There are a total of 9 IME log files, and they are as follows:

1. AgentExecutor.log
2. AppActionProcessor.log
3. AppWorkload.log
4. ClientCertCheck.log
5. DeviceHealthMonitoring.log
6. HealthScripts.log
7. IntuneManagementExtension.log
8. Sensor.log
9. Win32AppInventory.log

As I mentioned earlier, the information that is logged in each of these Intune IME logs is unique. We will now go through each log file and understand its purpose.

1. AgentExecutor.log

The AgentExecutor.log gets invoked when you are deploying PowerShell scripts or Win32 apps to your devices. When you access the log file, you’ll notice that it runs scripts from the C:\Windows\IMECache\HealthScripts path on a regular basis. This is mainly used for tracking the PowerShell script execution on the computer.

2. AppActionProcessor.log

The AppActionProcessor.log file contains information about the app or PS script deployments that have been assigned for installation or uninstallation. It also detects and runs applicability checks on all apps in the subgraphs.

3. AppWorkload.log

AppWorkload.log is a new IME log introduced in Intune Service release 2408. This log file helps troubleshoot and analyze Win32 app management events on the client. This log file contains all the logging data pertaining to Win32 app deployment activities carried out by the IME. I wrote a detailed guide on how to use AppWorkload.log to troubleshoot Win32 app deployments.

4. ClientCertCheck.log

The ClientCertCheck.log is one of the IME log files that regularly checks the client certificates on the device that are essential for device management.

5. DeviceHealthMonitoring.log

The DeviceHealthMonitoring.log is an important IME log that logs the information about the hardware readiness, inventory, app crashes, and gathering and sending microsoft_sidecar_event_telemetry through 1DS SDK.

6. HealthScripts.log

The HealthScripts.log logs the details about HS component that runs the assigned detection and remediation scripts on a regular schedule. There are two scripts that it regularly runs, located in C:\Windows\IMECache\HealthScripts folder on the client machine.

7. IntuneManagementExtension.log

The IntuneManagementExtension.log is technically the most significant of all the IME logs. This log contains all the information related to agent check-in, policy requests, package management, policy processing, and reporting activities.

8. Sensor.log

The Sensor.log IME log contains the information provided by the ‘SensorFramework‘ component. This file contains the event details such as boot performance of the device, CPU summary event, driver inventory, app usage configuration, and much more.

9. Win32AppInventory.log

The Win32AppInventory.log file logs the data that the Win32 AppInventory component provides, as its name suggests. It collects the Win32 app inventory count using WMI and sends the Win32 app inventory report to the Intune service. It also saves the app inventory details to the local registry.

Gathering IME Logs for Troubleshooting

So let’s say you have encountered an issue during the Win32 app deployment, and you want to review the logs. Intune offers three ways to access the IME logs, and they are as follows:

• Access the IME logs manually: The log files can be accessed locally on the device by going to the folder where the IME logs are located.
• Intune Admin Center: You can collect diagnostics from an Intune managed device via the Microsoft Intune admin center. Select the device and on the overview page, click Collect diagnostics. I have published a guide on collecting diagnostic logs with Intune.
• Windows Autopilot Device Diagnostics: Autopilot automatically collects diagnostics when a device fails during the Autopilot process. This feature is enabled by default, and no additional action is required. For more details, see how to manage the diagnostics collection for autopilot failure for Windows devices in Intune.

Conclusion

After reading this post, you should have a better grasp of where to find the Intune Management Extension logs, how to access them, and what they are for. To diagnose and investigate deployment failures and performance issues, organizations should maintain track of the log files for the Microsoft Intune management extension. If you are having issues with app and script deployments in Microsoft Intune, you can begin troubleshooting by reviewing the Intune management extension logs.