Why are log files important?

IT admins need to be able to perform troubleshooting activities when something goes wrong. If that sounds broad, that's because it is. In the context of desktop management, IT might run into issues like failed app installations or configurations. In all those different cases, it's important for the administrator to have a starting point for troubleshooting. That starting point is most often the right log file. It doesn't matter if that's an event log or a log file that belongs specifically to the related application.

The idea is that -- by installation default -- any app, agent, service or other component automatically writes information to the related log file. This shouldn't only happen when something goes wrong or fails; there should be a log for anything important happening on the desktop. The latter is also important, as it enables the IT administrator to follow the flow of the application to better pinpoint the potential issue. Admins can use all that information -- both important events and failures -- for troubleshooting. This makes log files a key component for troubleshooting.

Today, many apps also provide the option to enable something like verbose logging. This empowers the app to write more detailed information to the log file for more detailed troubleshooting options.

Where does the Intune Management Extension store log files?

Most apps contain log files that are accessible and available within the IME. Intune contains a single important location that stores all the different available log files for that agent, C:\ProgramData\Microsoft\IntuneManagementExtension\Logs.

By default, everyone has at least read permissions to that location and to the log files that are stored within it. To view those log files, admins can use their preferred reader, because the files contain plain text written in a specific format. Even Notepad is a valid option. Another viable option is the more frequently used CMTrace, as it can easily handle the formatting of the log files and provides a quick overview of the errors and warnings within the log file.

In addition to accessing the log files directly on the local device, it's also possible to access the log files using the Microsoft Intune admin center portal. There are two common methods for retrieving the IME log files. The first method is through the installation details of an app on a device, and the second method is through the overview of a device. In both cases, admins can use the Collect diagnostics option to collect the IME log files of the specific device.

Because this is a remote action on a device, this does require the device to be online. The collected log files are available within the portal, in the Device diagnostics section of the device. When the device is online, it can still take more than a few minutes for the log files to become available within the portal. IT can download the collected files as a zipped file, which contains many registry keys, collected information, event logs and log files -- including the IME log files.

Note that there are also failures, such as Windows Autopilot failures, that automatically collect the diagnostics of the related device and make them available within the Microsoft Intune admin center portal. This can save admins the step of retrieving the files when an issue occurs.

What log files are available for the Intune Management Extension?

In the early days of the Intune Management Extension, admins only had two or three log files for the provided functionalities. Over time, however, the number of these log files has grown significantly.

At this moment, the following log files are available, listed in alphabetical order:

• AgentExecutor.log. This log file contains the information provided by the agent executor, which executes the different actions that are performed by the IME.
• AppActionProcessor.log. This log file contains the information provided by the action processor for apps, which processes the actions for assigned apps.
• AppWorkload.log. This log file contains information on Win32 app deployments, including app check-ins, installations, applicability checks and detection results.
• ClientCertCheck.log. This log file contains information on device client certificate checks.
• ClientHealth.log. This log file contains the information provided by the client health component, which checks the health of the IME.
• DeviceHealthMonitoring.log. This log file contains the information provided by the data collection, which collects data about hardware readiness, device inventory and more.
• HealthScripts.log. This log file contains the information provided by the health scripts component, which runs the assigned detection and remediation scripts at the required schedule.
• IntuneManagementExtension.log. This is one of the original log files, and most of the activities of the IME are still logged in this log file. However, when the IME uses different components to execute specific tasks, the detailed logging for those tasks is written to the log files associated with those components instead.
• NotificationInfra.log. This log file contains information on notifications sent through the Microsoft real-time communication channel.
• Sensor.log. This log file contains the information provided by the sensor framework component, which subscribes to different events on the device, gathering usage information.
• Win32AppInventory.log. This log file contains the information provided by the app inventory collector, which collects the inventory of the installed MSI applications.

When a log file reaches its maximum size, which is 3 MB by default, the endpoint or application creates a new log file with the same name. From there, the endpoint or app will rename the file according to the date of creation.

Editor's note: This article was updated in September 2026 to include recent additions to Microsoft's list of log files.

Peter van der Woude works as a mobility consultant and knows the ins and outs of the ConfigMgr and Microsoft Intune tools. He is a Microsoft MVP and a Windows expert as well.