Intune Diagnostics Studio: Making Intune Troubleshooting a Bit Less Painful

If you work with Intune, you probably know the routine.

Open the Intune Management Extension logs.

Open Event Viewer.

Run dsregcmd /status.

Check certificates.

Check Entra ID.

Check MDM enrolment.

Open another log.

Forget what you were looking for in the first one.

After doing this enough times, I wanted one place where I could quickly load the logs, spot the useful errors and get an idea of what to check next.

So I built Intune Diagnostics Studio.

It is a local browser-based log reader for Intune, Entra ID and MDM troubleshooting.

No cloud service.

No account required.

No logs uploaded anywhere.

And hopefully fewer hours spent staring into the Dark Side of Event Viewer.

What does it do?

Intune Diagnostics Studio can read and analyse several of the logs and diagnostics I normally end up checking when troubleshooting a Windows device.

It currently supports things like:

• Intune Management Extension logs
• MDM Event Viewer exports
• Entra ID and Device Registration logs
• dsregcmd /status
• Windows device information
• network and DNS checks
• MDM certificate information
• Windows Update related logs
• Autopilot related logs
• SCCM and co-management related logs

The tool groups findings into:

• Critical
• Warning
• Information
• Healthy

It also shows the evidence it found in the logs and gives you some checks to work through.

The idea is not to replace troubleshooting knowledge.

It is just there to help find the useful bit faster.

It works on Windows, Mac and Linux

The actual analyser runs locally in a browser.

You can open it in:

• Edge
• Chrome
• Firefox
• Safari

That means the reader itself works on:

• Windows
• macOS
• Linux

The log collection scripts still need to run on Windows because they use Windows-specific tools such as PowerShell, Event Viewer, dsregcmd and Intune Management Extension logs.

Once the logs are collected, though, you can analyse them on another machine.

I do a lot of my work from a Mac, so this was something I specifically wanted.

What can it currently pick up?

Some of the current checks include:

• Intune network and web exceptions
• Intune Management Extension errors
• Win32 app installation failures
• remediation script failures
• assignment and filter exclusions
• MDM enrolment failures
• stale MDM enrolment
• Hybrid Entra Join issues
• Device Registration problems
• successful MDM enrolment
• MDM certificate information
• Windows Update related issues

It also looks for useful Windows Event Viewer IDs, including:

76, 78, 102, 404, 8202, 8204, 8211 and 8300

For example, if I find Event ID 102 with an MDM enrolment error, I would rather see something clear like:

MDM enrolment failed

Event ID: 102

Things to check:

• Existing MDM enrolment
• Entra device state
• Intune licensing
• MDM certificates

That is a lot quicker than scrolling through an Event Viewer channel and trying to work out which error is actually relevant.

Collecting the logs

I have included two PowerShell scripts in the GitHub repository.

Full Intune and Hybrid Entra Join collection

Use:

Collect-HybridEntraLogs.ps1

Copy the script to the Windows device you are troubleshooting.

Open PowerShell as Administrator and run:

Set-ExecutionPolicy -Scope Process Bypass -Force
.\Collect-HybridEntraLogs.ps1

If PowerShell still blocks the script, run:

powershell.exe -ExecutionPolicy Bypass -File .\Collect-HybridEntraLogs.ps1

The collector gathers things such as:

• dsregcmd /status
• Intune Management Extension logs
• MDM diagnostics
• Intune and MDM Event Viewer logs
• Entra ID Device Registration events
• Group Policy results
• device information
• network and DNS checks
• MDM certificates
• Hybrid Join related information

When it finishes, it creates:

C:\temp\sendme.zip

That is the package I take back to my troubleshooting machine.

Event Viewer logs only

Sometimes I do not need the full collection.

For that I included:

Export-IntuneEventLogs.ps1

Run it from an elevated PowerShell window:

Set-ExecutionPolicy -Scope Process Bypass -Force
.\Export-IntuneEventLogs.ps1

This exports useful Intune and MDM Event Viewer entries into files that Intune Diagnostics Studio can read.

The main areas include:

• DeviceManagement-Enterprise-Diagnostics-Provider
• User Device Registration
• Entra ID / AAD
• MDM enrolment
• Autopilot
• Windows Update
• Application
• System

Analysing the logs

Once the logs have been collected:

1. Open index.html in your browser.
2. Extract sendme.zip.
3. Drag the relevant log files into Intune Diagnostics Studio.
4. Click Analyse logs.
5. Review the findings, evidence and suggested checks.

The current version supports:

• .log
• .txt
• .csv
• .json
• .xml

Direct ZIP support is on my list because manually extracting a ZIP in 2026 feels slightly too close to the Dark Side.

Privacy

Everything in the analyser runs locally in the browser.

The tool does not upload your logs anywhere.

That said, Windows logs can contain plenty of internal information, including:

• usernames
• tenant names
• device IDs
• email addresses
• internal server names
• IP addresses
• certificates
• customer or company names

So I would still check any logs before sharing them publicly.

What I want to add next

This is still something I am actively working on.

A few things I want to improve next are:

• direct sendme.zip support
• better Hybrid Entra Join diagnosis
• a clearer Event Viewer timeline
• Autopilot troubleshooting
• SCCM and co-management checks
• Windows Update checks
• more Intune and MDM error codes
• clearer device health summaries
• exportable troubleshooting reports

The longer-term idea is to get the tool to a point where I can collect a device’s diagnostics and quickly see something like:

AD Joined: OK

Entra Joined: OK

Device Authentication: OK

PRT: OK

MDM Enrolment: Failed

Intune Management Extension: OK

That is much more useful than being told somewhere in a 20,000-line log that something went wrong.

GitHub

The project is available here:

https://github.com/zeedai/intune-diagnostics-studio

The repository includes:

• index.html
• README.md
• LICENSE
• GITHUB.md
• Collect-HybridEntraLogs.ps1
• Export-IntuneEventLogs.ps1

Final thoughts

I originally started building this because I was repeatedly troubleshooting the same kind of Intune enrolment and Hybrid Join problems and got tired of opening the same collection of logs manually.

Two weeks later, here we are.

It is not supposed to replace understanding how Intune works, and I would never make a production change purely because a tool tells me to.

The aim is much simpler.

Find the useful evidence faster.

Because when an Intune device refuses to enrol for no obvious reason, sometimes the Force is not enough.

You need the logs.