Free tool · PowerShell
Intune Diagnostics
Why this device does not do what the portal says — in one report.
A PowerShell script that gathers on a Windows device everything Intune scatters — management extension logs, some twenty event channels, the registry, dsregcmd, certificates, TPM, BitLocker and Autopilot's trail —, decodes every error code and cross-checks the sources. Out comes an HTML and PDF report: what works, what does not, and in which file, on which line. The code is published below in full, to be read before it is run.
What you get
One report, eleven sections.
The same content as HTML — full-text search, severity filters — and as PDF, with a clickable table of contents. The raw files sit next to it, and every finding points to the file and line it was read from. The report is written in English or French, as you choose.
Summary
A health score, the counters, and the priorities in the order to tackle them, each with a one-line remediation.
Consistency findings
Over seventy checks that cross-reference the sources — including those that pass, and those that could not run, with the reason.
Identity and enrolment
dsregcmd, MDM enrolments, synchronisation tasks, machine certificates.
Autopilot
The profile received, the deployment step by step up to where it stopped, the ESP and the prerequisites. Each value says who documents it.
Error code catalogue
Every code in hexadecimal, decimal and signed decimal, what it means, its likely cause, what to do — and every file and line it appears on.
Timeline
Every source merged, newest first: what broke first, and what is merely a consequence.
Application deployment
The state of every Win32 app as the management extension sees it, next to what is actually installed.
Policies and conflicts
What the MDM client actually applies, and the settings two sources fight over — invisible from the portal.
Security and system
TPM, BitLocker, Defender, the management extension, the clock, the proxy.
Connectivity
DNS, TCP then TLS to the Intune, Entra ID and Autopilot endpoints, and the issuer of the certificate presented: enough to spot TLS inspection. Time is tested over NTP.
Windows Update and versions
What governs updates, what the device actually received, what Delivery Optimization moved, and how current the applications are.
Before you start
Prerequisites.
The bare minimum fits in two lines: Windows PowerShell, which ships with Windows, and a console run as administrator on the device to diagnose.
| Requirement | For | Notes |
|---|---|---|
| RequiredWindows 10 or 11, with Windows PowerShell 5.1 | The whole script. | Ships with Windows. PowerShell 7 works too. |
| RequiredA console run as administrator, or SYSTEM | The event logs, the HKLM keys, MdmDiagnosticsTool. | Without elevation the script says so and carries on, but the report is incomplete by construction. |
| OptionalHTTPS access to Microsoft's endpoints | The Connectivity section, and the clock drift measurement. | Fifteen Intune, Entra ID, Autopilot, Store and Windows Update endpoints — sixteen on a firmware TPM. Time is tested over NTP (UDP 123), internet detection over HTTP. -SkipConnectivityTests to call none of them. |
| OptionalSome disk space | The log copies, next to the report. | A few MB at Quick, a few tens at Standard, up to several hundred at Full. |
| OptionalAn output folder with a short path | The .reg and .evtx exports. | reg.exe and wevtutil fail beyond 260 characters. The default, %ProgramData%\IntuneDiagReporter, is fine. |
| OptionalAn execution policy that allows a local script | Running the file. | Otherwise, for this run only: powershell -ExecutionPolicy Bypass -File … |
The script only uses what Windows provides: PowerShell, wevtutil, reg.exe, dsregcmd and MdmDiagnosticsTool. The PDF is written by a built-in generator, with no browser. Nothing is installed on the device.
Transparency
What it reads. What it writes. What it never does.
A diagnostic that changes the device it diagnoses skews its own answer. Every statement below can be checked in the code, further down.
It reads
- The logs: the Intune Management Extension, domain join, Panther, CBS, ConfigMgr when co-managed, Company Portal, the downloaded Autopilot profile — 26 sources in all.
- 26 event channels (MDM, Entra ID, Autopilot, BitLocker, Defender…) and 17 registry branches.
- Live state:
dsregcmd /status, synchronisation tasks, certificates, TPM, BitLocker, Defender, clock, proxy, Enrollment Status Page settings — and the output ofMdmDiagnosticsTool.
It writes
- An
IntuneDiag_<device>_<date>folder under%ProgramData%\IntuneDiagReporter, or wherever-OutputRootsays: the HTML and PDF report, two JSON files, and the raw copies inRaw\. - A ZIP of it all, next to the folder.
-NoArchiveto skip it. - Those copies hold what the logs hold: user names, device identifiers, application names. Review them before handing the archive to anyone.
It never
- Changes a setting, a registry key, a policy or an enrolment.
- Installs anything.
- Sends the report anywhere you have not asked for: a share (
-UploadPath), your Azure container (-UploadSasUri) or your Log Analytics workspace. Without those parameters, nothing leaves the device. - Sends anything to LB IT Cloud. There is no telemetry, no licence, no account.
How to use it
Copy, paste, run.
Copy
Paste and save
IntuneDiagReporter.ps1, with the UTF-8 with BOM encoding: without it, Windows PowerShell 5.1 misreads the file's few accented characters.Run
powershell -ExecutionPolicy Bypass -File .\IntuneDiagReporter.ps1With no argument, the options window opens: choose, start, and the report opens at the end.
Parameters
-Depth | Quick (≈ 1 min), Standard (default) or Full (everything, 15 min or more). |
-SinceDays | Analysis window, in days. Default: 14. |
-OutputRoot | Output folder. Default: %ProgramData%\IntuneDiagReporter. Keep it short. |
-OpenReport | Opens the report at the end. |
-Console | A one-screen verdict, in ASCII — for a device stuck on the Enrollment Status Page, via Shift+F10. |
-Silent | No UI, exit code only: 0 healthy, 1 at least one critical finding. |
-NoPdf / -NoArchive | No PDF / no ZIP. |
-PdfEngine | Native (default, no browser) or Edge. |
-SkipConnectivityTests | No outbound connection at all. |
-SkipMdmDiagnosticsTool | Skips the native tool, if it is slow on your fleet. |
-UploadPath / -UploadSasUri | Drops the archive on a share, or in an Azure Blob container. |
-LogAnalytics… | Direct send to Azure Monitor, to aggregate several devices. |
-JsonPretty / -JsonTimelineLimit / -JsonMessageLimit | Shape and size of the JSON exports. |
In normal mode
A window to choose the options.
Started with no argument on a device with a desktop, the script opens this window: the destination, the depth, and what to produce. No parameter to remember. Click around: it is the same window, and the language selector switches all of it, exactly as the script does.
Diagnostic Intune et Autopilot
Collecte les journaux, le registre et l'état du poste, puis produit un rapport qui explique ce qu'il a trouvé.
The same thing, on a command line
Every choice in the window has its parameter. The line below follows your clicks: it is the one to put in a scheduled task, a remediation script or a remote session.
powershell -ExecutionPolicy Bypass -File .\IntuneDiagReporter.ps1 -OpenReport -Language fr
The window never opens where it could hang something:
- as soon as any parameter is passed: a command line is an explicit intent;
- under SYSTEM, so never during an Intune deployment;
- in a session with no desktop.
-Consolethen gives a one-screen verdict,-Silenta plain exit code.
Started without administrator rights, the window says so in red before you start anything.
The code
The whole script.
Split into modules, each explained in one sentence. Everything is in plain text: no encoded block, no hidden download. The only outbound connections are the tests to Microsoft's endpoints, and whatever you ask for yourself. You may run it in your organisation and at your clients': what is allowed is set out in its terms of use.