ℹ️
Quick reference: Bookmark this page. These are the first places to check whenever an Intune app or policy isn't applying on a managed Windows device.
01
Intune Management Extension (IME) Logs
The primary log location for all Win32 app deployments and PowerShell script execution. Open with CMTrace or VS Code for easier filtering.
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs
# Key files:
# IntuneManagementExtension.log — app deployment & script execution
# AgentExecutor.log — script execution tracking
# Sensor.log — Endpoint Analytics collection
# Scripts.log — custom script execution
02
Event Viewer — MDM Policy Logs
Navigate to: Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider → Admin. Use for MDM policy deployment events and CSP-based policy troubleshooting.
03
Registry — Policy & Enrollment State
Check these registry paths to verify policy application and enrollment state.
HKLM\SOFTWARE\Microsoft\PolicyManager
HKLM\SOFTWARE\Microsoft\Enrollments
HKLM\SOFTWARE\Microsoft\EnterpriseDesktopAppManagement
04
Company Portal Logs
Use for troubleshooting enrollment, app availability, and Company Portal interactions.
%localappdata%\Packages\Microsoft.CompanyPortal_8wekyb3d8bbwe\LocalState\DiagOutputDir
05
Task Scheduler — Deployment Triggers
If a deployment hasn't triggered on schedule, check the PushLaunch task: Task Scheduler → Microsoft → Windows → EnterpriseMgmt
06
Force IME Sync (Quick Trigger)
Run this command to immediately trigger Intune policy and app evaluation without waiting for the 8-hour cycle.
Start-Process "intunemanagementextension://syncapp"
💡
IME log tip: Search for your app's display name or installer filename in the log. Error code 0x80070002 means file not found; 0x87D300C9 means detection rule not met — the two most common failure codes.