Skip to Content

Collect Diagnostics

Version 1.1 by Dimitri Rupp on 2026/06/11 11:00
Warning
For security reasons, the document is displayed in restricted mode as it is not the current version. There may be differences and errors due to this.

Um eine ausführliche Diagnostic von einem Gerät zu bekommen kann man das Gerät vom Benutzer über Intune öffnen und dort mit "Collect Diagnostic". 
Mann kann die Daten dann bei Device Diagnostics herunterladen. Jedoch dauert dies einige Zeit bis es dort verfügbar ist und es geht nur wenn das jeweilige Gerät online ist.

Anbei die Liste über den Inhalt der Ordner:

List of Information Collected

At the time of writing the following information is collected:

Registry Keys:

  1. HKLM\Software\Microsoft\IntuneManagementExtension
  2. HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot
  3. HKLM\SOFTWARE\Microsoft\Windows Advanced Threat Protection
  4. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI
  5. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
  6. HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall
  7. HKLM\Software\Policies
  8. HKLM\SOFTWARE\Policies\Microsoft\Cryptography\Configuration\SSL
  9. HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
  10. HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
  11. HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL

Commands:

  1. %programfiles%\windows defender\mpcmdrun.exe -GetFiles
  2. %windir%\system32\certutil.exe -store
  3. %windir%\system32\certutil.exe -store -user my
  4. %windir%\system32\Dsregcmd.exe /status
  5. %windir%\system32\ipconfig.exe /all
  6. %windir%\system32\mdmdiagnosticstool.exe
  7. %windir%\system32\msinfo32.exe /report %temp%\MDMDiagnostics\msinfo32.log
  8. %windir%\system32\netsh.exe advfirewall show allprofiles
  9. %windir%\system32\netsh.exe advfirewall show global
  10. %windir%\system32\netsh.exe lan show profiles
  11. %windir%\system32\netsh.exe winhttp show proxy
  12. %windir%\system32\netsh.exe wlan show profiles
  13. %windir%\system32\netsh.exe wlan show wlanreport
  14. %windir%\system32\ping.exe -n 50 localhost
  15. %windir%\system32\powercfg.exe /batteryreport /output %temp%\MDMDiagnostics\battery-report.html
  16. %windir%\system32\powercfg.exe /energy /output %temp%\MDMDiagnostics\energy-report.html

Event Viewers:

  1. Application
  2. Microsoft-Windows-AppLocker/EXE and DLL
  3. Microsoft-Windows-AppLocker/MSI and Script
  4. Microsoft-Windows-AppLocker/Packaged app-Deployment
  5. Microsoft-Windows-AppLocker/Packaged app-Execution
  6. Microsoft-Windows-Bitlocker/Bitlocker Management
  7. Microsoft-Windows-SENSE/Operational
  8. Microsoft-Windows-SenseIR/Operational
  9. Setup
  10. System

Files:  

  1. %ProgramData%\Microsoft\DiagnosticLogCSP\Collectors*.etl
  2. %ProgramData%\Microsoft\IntuneManagementExtension\Logs*.*
  3. %ProgramData%\Microsoft\Windows Defender\Support\MpSupportFiles.cab
  4. %ProgramData%\Microsoft\Windows\WlanReport\wlan-report-latest.html
  5. %temp%\MDMDiagnostics\battery-report.html
  6. %temp%\MDMDiagnostics\energy-report.html
  7. %temp%\MDMDiagnostics\mdmlogs-<Date/Time>.cab
  8. %temp%\MDMDiagnostics\msinfo32.log
  9. %windir%\ccm\logs*.log
  10. %windir%\ccmsetup\logs*.log
  11. %windir%\logs\CBS\cbs.log
  12. %windir%\logs\measuredboot*.*
  13. %windir%\Logs\WindowsUpdate*.etl

Verwandte Themen

Kuratiert — kann direkt im Editor ergänzt werden://

Failed to execute the [velocity] macro. Cause: [The execution of the [velocity] script macro is not allowed in [xwiki:IT-Wiki.Makros.Verwandte-Themen.WebHome]. Check the rights of its last author or the parameters if it's rendered from another script.]. Click on this message for details.

Status: Migriert — Team-Review ausstehend · Owner: (festlegen) · Letzter Review: 2026-06-11