Site icon TheWindowsUpdate.com

Intune Public Preview – Windows 10 Device diagnostics

This post has been republished via RSS; it originally appeared at: Intune Customer Success articles.

By Jon Lynn – Sr. Service Engineer | Microsoft Endpoint Manager – Intune

 

In our 2102 (February) Microsoft Intune service release we are enabling a public preview of the Windows 10 Device diagnostics feature. We’ve listened to your feedback and understand that troubleshooting, especially with the emphasis on remote work, can be particularly challenging. This first release of device diagnostics utilizes the Windows DiagnosticLog CSP, allowing Intune to collect a set of files, registry, event viewers and commands to be gathered on a Windows 10 or a Microsoft HoloLens 2 device. The diagnostic process is quite easy, fast, and reliable, generally taking about 5 minutes from start to finish.

 

Let’s take a look at the requirements to use device diagnostics:

 

Client requirements

 

Intune requirements

 

Once the client and Intune requirements are met, simply navigate in the Microsoft Endpoint Manager admin center to the Devices > All Devices blade and search for the device you want to collect diagnostics on.

 

All devices blade in the MEM admin center

Double click on the device and choose the device action “Collect diagnostics”.

 

Single device view in the MEM admin center

The status and results of the Collect diagnostics task can be found under Device diagnostics (Preview). Once opened, the monitor displays who ran the Collect diagnostics task, status, when it was started, when diagnostics were uploaded, and a download button when complete (if successful).

There are three status messages for a diagnostic task, let us review each:

  1. Completed: Diagnostics were successful and are available for download.
  2. Pending diagnostics Upload: The device is running the diagnostics and will finish shortly, or the device is offline/unreachable and has not received the request. The diagnostics task is good for 12 hours, so if the machine comes online and/or checks into the Intune service, the diagnostic action will be kicked off.
  3. Failed: The device ran diagnostics but failed to complete the task or failed to upload. To troubleshoot this issue, please review the MDMDiagnostics registry key at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MdmDiagnostics and the sub keys inside. If collecting diagnostics fails, we recommend you run the device action again. If it continues to fail, please open a case with Intune support from the Endpoint Manager admin center.

 

Here’s what a pending and completed diagnostic collection status looks like:

 

Device diagnostics (Preview) example

 

Device diagnostics (Preview) download example

Now that the diagnostic has completed, click download, save to your machine, and extract the zip file. You will know notice the zip file has many folders. This can be confusing and unfortunately, it’s not something we can change because that is how the DiagnosticLog CSP handles the files. However, we are working on an update to flatten the folders and simplify the process after diagnostics are gathered. To help simplify the diagnostics during the preview, please see the PowerShell script provided later in the blog.

 

Each file, command, registry, or event viewers is stored in an individual folder to be compressed into a zip file, see the image below for a sample of the zip and contents.

 

Fig 1. Example of the samples of the zip and contents

 

Fig 2. Example of the samples of the zip and contents

 

Fig 3. Example of the samples of the zip and contents

Now that we have reviewed how to collect diagnostics, let’s review what we are collecting from machines. Currently we collect useful registry keys, command outputs, MDM diagnostic logs and other critical Microsoft data like Microsoft Defender ATP logs.

 

Also, it is important to note, there are restrictions on what and where we can gather data using the DiagnosticLog CSP. We cannot collect information from user data folders, nor non-diagnostic file types, like photo or document file types. I highly encourage you to review the DiagnosticLog CSP documentation here for all the details. Microsoft doesn't have access to these logs. The logs are encrypted at rest after uploading them.

 

Here is the standard diagnostics template Intune is collecting and what it’s useful for:

Windows 10 Desktop OS:

  1. HKLM\Software\Microsoft\IntuneManagementExtension
    • This registry key contains specific information about the Intune Management Extension.
  2. HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
    • This registry key contains info about certificates installed on your machine.
  3. HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection
    • This registry key contains detailed info on your Microsoft Defender ATP configuration.
  4. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
    • This registry key contains the last logged on user.
  5. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
    • This registry key contains info on your Internet configuration.
  6. HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall
    • This registry key contains the 32-bit applications that are installed on the machine.
  7. HKLM\Software\Policies
    • This registry key contains information on the policies configured on the machine.
  8. HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL
    • This registry key contains more information on certificates.
  9. HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
    • This registry key contains policy information related to Microsoft Defender ATP.
  10. HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
    • This registry key contains the 64-bit applications that are installed on the machine.
  11. HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL
    • This registry key contains information on the TLS configuration on the machine.

 

Commands:

  1. %programfiles%\windows defender\mpcmdrun.exe -GetFiles
    • The command captures support data for troubleshooting ATP issues.
  2. %windir%\system32\certutil.exe -store
    • This command outputs the certificates installed on the machine’s store.
  3. %windir%\system32\certutil.exe -store -user my
    • This command outputs the certificates installed on the machine’s user store.
  4. %windir%\system32\Dsregcmd.exe /status
    • This command outputs Azure AD information for the machine.
  5. %windir%\system32\ipconfig.exe /all
    • This command outputs the IP address information for the machine.
  6. %windir%\system32\mdmdiagnosticstool.exe -area Autopilot;deviceprovisioning;deviceenrollment;tpm;HololensFallbackDeviceOwner -cab %temp%\MDMDiagnostics\mdmlogs-<Date/Time>.cab
    • This command captures MDM diagnostics for the machine.
  7. %windir%\system32\msinfo32.exe /report %temp%\MDMDiagnostics\msinfo32.log
    • This command outputs the hardware, software and driver details for the machine.
  8. %windir%\system32\netsh.exe advfirewall show allprofiles
    • This command outputs the firewall configuration for all profiles.
  9. %windir%\system32\netsh.exe advfirewall show global
    • This command outputs the global firewall configuration.
  10. %windir%\system32\netsh.exe lan show profiles
    • This command outputs the configuration of the LAN Adapter(s).
  11. %windir%\system32\netsh.exe winhttp show proxy
    • This command outputs network proxy configuration.
  12. %windir%\system32\netsh.exe wlan show profiles
    • This command outputs the proxy configuration of the Wireless LAN Adapters(s).
  13. %windir%\system32\netsh.exe wlan show wlanreport
    • This command outputs the status of the Wireless LAN.
  14. %windir%\system32\ping.exe -n 50 localhost
    • This command runs a test of the local network host.
  15. %windir%\system32\powercfg.exe /batteryreport /output %temp%\MDMDiagnostics\battery-report.html
    • This command generates a detailed report about day-to-day battery usage.
  16. %windir%\system32\powercfg.exe /energy /output %temp%\MDMDiagnostics\energy-report.html
    • This command generates a Battery Report, useful for troubleshooting laptop battery/power issues.

 

Event Viewers: We are capturing the common event viewers for troubleshooting issues, including Application, System and Setup. In addition, we are capturing the AppLocker event viewers to assist in debugging AppLocker issues and the SENSE event viewers to help debugging issues with anti-virus/malware.

 

  1. Application
  2. Microsoft-Windows-AppLocker/EXE and DLL
  3. Microsoft-Windows-AppLocker/MSI and Script
  4. Microsoft-Windows-AppLocker/Packaged app-Deployment
  5. Microsoft-Windows-AppLocker/Packaged app-Execution
  6. Microsoft-Windows-Bitlocker/Bitlocker Management
  7. Microsoft-Windows-SENSE/Operational
  8. Microsoft-Windows-SenseIR/Operational
  9. Setup
  10. System

 

Files: These commands collect the files generated during the log collection and files on the machine used for debugging issues. We are capturing all the data mentioned earlier along with Configuration Manager setup and client logs, CBS logs for issues and measured boot ETL’s to assist in machine security issues.

 

  1. %ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\*.etl
  2. %ProgramData%\Microsoft\IntuneManagementExtension\Logs\*.*
  3. %ProgramData%\Microsoft\Windows Defender\Support\MpSupportFiles.cab
  4. %ProgramData%\Microsoft\Windows\WlanReport\wlan-report-latest.html
  5. %temp%\MDMDiagnostics\battery-report.html
  6. %temp%\MDMDiagnostics\energy-report.html
  7. %temp%\MDMDiagnostics\mdmlogs-<Date/Time>.cab
  8. %temp%\MDMDiagnostics\msinfo32.log
  9. %windir%\ccm\logs\*.log
  10. %windir%\ccmsetup\logs\*.log
  11. %windir%\logs\CBS\cbs.log
  12. %windir%\logs\measuredboot\*.*
  13. %windir%\Logs\WindowsUpdate\*.etl

 

HoloLens 2:

 

Commands:

  1. %windir%\system32\mdmdiagnosticstool.exe -area Autopilot;deviceprovisioning;deviceenrollment;tpm;HololensFallbackDeviceOwner -zip %programdata%\MDMDiagnostics\mdmlogs-DATE/TIME.zip

 

Folders/Files:

  1. %programdata%\MDMDiagnostics\mdmlogs-<Date/Time>.zip

  2. %ProgramData%\Microsoft\DiagnosticLogCSP\Collectors\*.etl

  3. %windir%\logs\measuredboot\*.*

 

For the public preview we have created a PowerShell script that will take the downloaded zip file and convert it into a simplified folder file with updated file names to describe each one and removing all the folders.

 

To use the PowerShell script, simply open a PowerShell prompt, and use the name of the download file as the input for the script.

 

Example: Devicediagnostics.ps1 Download.zip

 

Device diagnostics PowerShell Script:

 

param($DiagnosticArchiveZipPath) #region Formatting Choices $flatFileNameTemplate = '({0:D2}) {1} {2}' $maxLengthForInputTextPassedToOutput = 80 #endregion #region Create Output Folders and Expand Zip $diagnosticArchiveTempUnzippedPath = $DiagnosticArchiveZipPath + "_expanded" if(-not (Test-Path $diagnosticArchiveTempUnzippedPath)){mkdir $diagnosticArchiveTempUnzippedPath} $reformattedArchivePath = $DiagnosticArchiveZipPath + "_formatted" if(-not (Test-Path $reformattedArchivePath)){mkdir $reformattedArchivePath} Expand-Archive -Path $DiagnosticArchiveZipPath -DestinationPath $diagnosticArchiveTempUnzippedPath #endregion #region Discover and Move/rename Files $resultElements = ([xml](Get-Content -Path (Join-Path -Path $diagnosticArchiveTempUnzippedPath -ChildPath "results.xml"))).Collection.ChildNodes | Foreach-Object{ $_ } $n = 1 # only process supported directives $supportedDirectives = @('Command', 'Events', 'FoldersFiles', 'RegistryKey') foreach( $element in $resultElements) { # only process supported directives, skip unsupported ones if(!$supportedDirectives.Contains($element.Name)) { continue } $directiveNumber = $n $n++ $directiveType = $element.Name $directiveStatus = [int]$element.Attributes.ItemOf('HRESULT').psbase.Value $directiveUserInputRaw = $element.InnerText # trim the path to only include the actual command - not the full path if ($element.Name -eq 'Command') { $lastIndexOfSlash = $directiveUserInputRaw.LastIndexOf('\'); $directiveUserInputRaw = $directiveUserInputRaw.substring($lastIndexOfSlash+1); } $directiveUserInputFileNameCompatible = $directiveUserInputRaw -replace '[\\|/\[\]<>\:"\?\*%\.\s]','_' $directiveUserInputTrimmed = $directiveUserInputFileNameCompatible.substring(0, [System.Math]::Min($maxLengthForInputTextPassedToOutput, $directiveUserInputFileNameCompatible.Length)) $directiveSummaryString = $flatFileNameTemplate -f $directiveNumber,$directiveType,$directiveUserInputTrimmed $directiveOutputFolder = Join-Path -Path $diagnosticArchiveTempUnzippedPath -ChildPath $directiveNumber $directiveOutputFiles = Get-ChildItem -Path $directiveOutputFolder -File foreach( $file in $directiveOutputFiles) { $leafSummaryString = $directiveSummaryString,$file.Name -join ' ' Copy-Item $file.FullName -Destination (Join-Path -Path $reformattedArchivePath -ChildPath $leafSummaryString) } } #endregion Remove-Item -Path $diagnosticArchiveTempUnzippedPath -Force -Recurse

 

 

Standard Zip versus PowerShell converted folder:

 

Comparison of Standard Zip vs. PowerShell converted folder

Lastly, if your organization does not want to utilize device diagnostics and wants to prevent IT admins from collecting diagnostics, the feature can be completely disabled in the Tenant Administration workload in the Microsoft Endpoint Manager admin center. Navigate to Tenant Admin > Device diagnostics (Preview) and disable the feature. Only a global administrator or Intune administrator can make this change.

 

Screenshot of the Device diagnostics (Preview) feature in the MEM admin center

Frequently asked questions and known issues (FAQ):

 

We are excited to ship this feature and look forward to your feedback and comments. Let us know if you have any additional questions by replying to this post or reaching out to @IntuneSuppTeam on Twitter.

Exit mobile version