Intune Management Extension (IME) Log Diagnostics
Master Windows client-side log investigation, diagnose Win32 app failures, troubleshoot proactive remediation scripts, and decode MDM enrollment errors.
Overview
When Windows policies, Win32 apps, or PowerShell scripts fail to apply on an endpoint, client-side log analysis is essential for identifying the precise root cause.
The Intune Management Extension (IME) service (Microsoft.Management.Services.IntuneWindowsAgent.exe) maintains continuous operational logs on every enrolled Windows client. Using tools like CMTrace or OneTrace, administrators can track app downloads, hash validations, execution return codes, and detection logic in real time.
---
Essential Client-Side Log Directory
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\
├── IntuneManagementExtension.log # Primary log: Win32 apps, scripts, ESP progress
├── AgentExecutor.log # Output from PowerShell scripts & detection scripts
├── ClientHealth.log # IME agent health check and auto-update verification
└── Sensor.log # Endpoint Analytics telemetry and pro-active remediations---
Key Search Terms in `IntuneManagementExtension.log`
| Search String | What It Reveals |
|---|---|
[Win32App] | Identifies individual application evaluation, download, and execution blocks. |
ExitCode | Shows the exact numeric process exit code returned by the installer (0 = Success). |
DetectionRule | Shows whether the detection rule returned true (installed) or false (missing). |
Hash validation | Verifies whether the downloaded .intunewin SHA-256 hash matches tenant metadata. |
reboot | Identifies if the application requested a mandatory hard or soft system reboot. |
---
PowerShell Commands
Collect and Zip All Client-Side MDM & Diagnostic Logs Instantly:
# Built-in Windows MDM diagnostics collector
mdmdiagnosticstool.exe -area Autopilot;DeviceEnrollment;DeviceProvisioning -cab C:\IntuneDiagnostics.cab
# Inspect recent IME errors via PowerShell
Get-Content -Path "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log" -Tail 50 |
Select-String -Pattern "error", "fail", "exitcode" -CaseSensitive:$false---
Troubleshooting Matrix
| Exit Code / Error | Technical Root Cause | Resolution |
|---|---|---|
0x87D1041C | Detection rule failed to locate the app after the installation command returned exit code 0. | Fix detection rule (wrong file path, missing reg key, or slow MSI background registration). |
0x87D1041E | Requirement rule not met; hardware architecture (x86 vs x64) or minimum disk space failed. | Review Requirement rules on the Win32 app in Intune Admin Center. |
0x80070002 | File not found; the setup executable named in the install string was not in the root of the .intunewin package. | Repackage source files with IntuneWinAppUtil.exe ensuring setup binary is at root level. |
---
MD-102 Exam Notes
Key Exam Traps:
- The default location for Intune Management Extension logs is
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs. - Standard Windows MDM policy logs are viewed in Event Viewer under:
Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin.