Reads the Intune Management Extension logs as objects, with the events the agent's lines record.

Get-IntuneAgentLog [[-Path] <string[]>] [-Log <string[]>] [-Id <string[]>] [-EventName <string[]>]
 [-Pattern <string>] [-Level <string[]>] [-After <datetime>] [-Before <datetime>] [-Last <int>]
 [<CommonParameters>]

Get-IntuneAgentLog -ListEvent [<CommonParameters>]

Parses the agent's CMTrace logs (IntuneManagementExtension, AppWorkload, HealthScripts and AgentExecutor, rolled files included) into one object per entry, merges them in time order and names the event each known line records: a platform script's policy fetch and download count, its start, launch, result and exit, a user-context script skipped on an Entra registered device, the agent's start and its userless check-in, a remediation's schedule inspection, queueing, start, detection result and report, a Win32 app's policy fetch, one filtered out by an assignment filter or skipped for user context, its applicability, requirement checks, detection, rule evaluation, install, exit code, outcome and report, AgentExecutor's launch, exit code, script output and errors, the Enrollment Status Page's phase, selected apps, their registration and tracked install states, its completion and the check-in that follows it, and an app's relationships: the subgraph it is processed in, a skipped subgraph, the report that names the impacting app with its classification and conflict reason, the dependency toast, an unassigned child's missing intent and the content download step. The event table is the set of lines the validation rounds used as evidence (Validation\Findings.md), so a filtered read answers "what did the agent do with my script" without grep.

The logs are opened with shared access, so a live agent is no obstacle. Times are the local times the agent wrote. A folder path reads every log in it that -Log selects; a file path reads that file.

Get-IntuneAgentLog -Log HealthScripts -EventName RemediationStart, DetectionResult -Last 10

The last ten remediation launches and detection verdicts on this device.

Get-IntuneAgentLog -Id bbf7e139-fe9d-4783-80df-627b8e084059 -After (Get-Date).AddHours(-2) | Format-Table Time, Log, Event, Detail, Message

Everything the agent logged about one policy in the last two hours, across all four logs.

Get-IntuneAgentLog -Path .\Logs -Log AppWorkload -EventName AppDetection, AppReport | Group-Object Id | ForEach-Object { $_.Group | Select-Object -Last 1 }

From a copied log folder: the last detection or report per app. An install exit code line carries no app id, so read those with -EventName AppInstallExit on their own.

Keeps entries at or after this time.

Type: System.DateTime
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Read
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

Keeps entries before this time.

Type: System.DateTime
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Read
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

One or more event names; keeps the entries that record one of them. Get-IntuneAgentLog -ListEvent shows the names.

Type: System.String[]
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Read
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

One or more policy or app ids; keeps the entries whose message contains one of them.

Type: System.String[]
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Read
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

Keeps only the most recent N entries after the other filters.

Type: System.Int32
DefaultValue: 0
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Read
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

Information, Warning or Error; keeps the entries at those levels.

Type: System.String[]
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Read
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

Lists the event names and the message pattern behind each instead of reading logs.

Type: System.Management.Automation.SwitchParameter
DefaultValue: False
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: List
  Position: Named
  IsRequired: true
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

Which logs to read from a folder: Agent (IntuneManagementExtension*.log), AppWorkload, HealthScripts, AgentExecutor, or All for every .log file. Default: the four named logs. Ignored for a file path.

Type: System.String[]
DefaultValue: "@('Agent', 'AppWorkload', 'HealthScripts', 'AgentExecutor')"
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Read
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

Log files or folders. Default: the agent's log folder, %ProgramData%\Microsoft\IntuneManagementExtension\Logs.

Type: System.String[]
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Read
  Position: 0
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

A regular expression the message must match.

Type: System.String
DefaultValue: ''
SupportsWildcards: false
Aliases: []
ParameterSets:
- Name: Read
  Position: Named
  IsRequired: false
  ValueFromPipeline: false
  ValueFromPipelineByPropertyName: false
  ValueFromRemainingArguments: false
DontShow: false
AcceptedValues: []
HelpMessage: ''

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable, -ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

This command does not accept pipeline input. Pass the paths and filters as parameters.

One object per log entry: Time (the local time the agent wrote), Level (Information, Warning or Error), Component, Thread, Event (the name from the event table, or empty for a line the table does not know), Detail (what the event's pattern captured: an exit code, a detection state, a download count), Id (the first non-empty GUID in the message, or the empty GUID when that is all the line carries), Message, Log (the file's base name) and Line. With -ListEvent, one IntuneScriptLab.AgentLogEventDefinition per event with Event and Pattern.

Author: Jeffrey Stuhr. The event names follow the observations in Validation\Findings.md; a line the agent writes that is not in the table has no event and passes through unless -EventName filters it out.

• Invoke-IntuneRemediationTest
• Invoke-IntuneWin32AppTest