Intune Debug Toolkit

The window is split into a sidebar on the left (every tool, grouped into categories like Diagnostics, Enrollment, Logs, MDM Protocol and Updates) and a tabbed console that fills the rest of the window.

Everything runs in its own tab, and nothing is lost when you multitask. Click a tool in the sidebar and it opens a new tab and starts running immediately. Click three more tools and you get three more tabs, each running independently – kick off a Win32 app rerun, an Autopilot readiness check, and the MDM event log tailer all at once, and flip between their tabs freely. Switching tabs, filtering one tab’s output, or even closing other tabs doesn’t stop or clear what’s running elsewhere. Every tab keeps streaming its own output for as long as its tool is running.

A few tools (SyncML Viewer, CMTrace, Intune Log Reader, AutopilotV2, Intune Device Details GUI) pop open their own native window in addition to their tab – the tab still tracks whether the process is running so you always know its status and can stop or re-run it from the same place as everything else.

Reading the console. Output streams into the tab live, colour-coded so the important lines jump out: errors in red, warnings in orange, success lines in green, and status/section lines dimmed. Long, noisy sections – like a Proactive Remediation script’s full detect/remediate body – automatically collapse into a one-line summary you can click to expand, so the tab stays scannable even on a chatty tool.

Use the filter box under the toolbar to narrow what’s visible in the current tab to lines containing your search text (case-insensitive). This only changes what’s displayed – the full output is still there, and still gets saved in full regardless of what’s filtered or folded.

Toolbar, per tab:

• Re-run – start the tool again from scratch in the same tab
• Stop – terminate the running tool (and anything it spawned)
• Save log… – copy the complete on-disk log for this run to wherever you want, even if you’ve filtered the view or collapsed sections
• Open log folder – jump straight to the folder where every run’s log lives on disk

A status pill in the top-right corner of each tab shows Running (with a pulsing dot and an indeterminate progress strip at the top of the console while it’s active), Completed, or an exit code if the tool failed.

Elevation. The top-right corner of the app window shows whether the launcher itself is running as Administrator or Standard user. Tools that need elevation carry a purple admin chip next to their name in the sidebar. If you launch one of those while running as a standard user, the app tells you right away instead of letting the tool fail silently – close it and relaunch Intune Debug Toolkit as Administrator.

Live-updating catalog. The list of tools comes from a tools.json file next to the app; if you (or a future update) edits it while the app is open, the sidebar refreshes on its own, or you can force it with the Reload button top-right.

Intune deep diagnostics collection (admin) Collects MDM/Intune logs locally without needing the cloud-side “Collect diagnostics” action from the Intune portal — handy when you need a diagnostic bundle to attach to a Microsoft support case, or you don’t have Intune admin rights to trigger the cloud collection. Uses Microsoft’s own On-Demand Collection tool, fetched fresh each run.

Intune Device Details GUI Petri Paavola’s WPF dashboard, opens in its own window after you sign in with Microsoft Graph. Gives a complete picture of the device and the signed-in user: recent check-ins, assigned applications, configuration profiles, and group memberships, all in one place.

Apps & Policies

IME Diagnostics (with timeline + log viewer) Runs a timeline-and-log-viewer pass over the Intune Management Extension logs — Petri Paavola’s log analyzer, wired into the console tab so you get a chronological view of what IME actually did on this device alongside the raw log lines.

Win32 App Re-run / Inspector (admin) Inspects Win32 app deployment straight from the IME logs — install/uninstall command, detection method, current state — and lets you force a redeploy right away instead of waiting for the next 24-hour evaluation cycle. Rewritten for v3 with modern GRS hash discovery, so redeploys actually fire against current-generation IME.

Remediations Reader (admin) Shows detect/remediate results for every Proactive Remediation targeted at this device, read straight from the modern IME cache. Each script’s full body folds into a summary line in the console so you can scan results quickly and expand only the ones you need.

RSOP (GPResult-like) Installs and runs Jonas Ohmsen’s IntuneDebug PowerShell module to produce a GPResult-style report of which policies actually won on this device and where they came from — the closest thing Intune has to the classic gpresult experience for hybrid or co-managed devices.

Autopilot Readiness Check (admin) Verifies the prerequisites for a successful Autopilot enrollment before you attempt one — network reachability to the right endpoints, TPM state, OS edition, and more.

Autopilot Test Attestation (admin) Runs a TPM attestation test to confirm the device can actually complete Autopilot attestation, catching devices that will silently fail this step during real provisioning.

Autopilot device prep (admin) Rafał Zimonczyk’s Autopilot diagnostic utility (AutopilotV2), opens its own window. Can also prepare a device for Autopilot enrollment directly.

Logs

Watch MDM Event Log (admin) Live-tails the Windows MDM event log with colour-coded highlighting right in the console tab, so you can watch policies land (or fail) in real time instead of digging through Event Viewer afterwards. The full trace is always saved to disk even after you close the tab.

Intune Log Reader (admin) Somesh Pathak’s Flutter-based log browser for IntuneManagementExtension logs, opens its own window — built for quickly searching a specific area of a large IME log.

CMTrace Microsoft’s classic log viewer. No longer distributed standalone by Microsoft, but works just as well on Intune logs as it always did on ConfigMgr logs. No admin rights needed.

MDM Protocol

SyncML Viewer (admin) Oliver Kieselbach’s live SyncML message viewer, opens its own window. Watch the actual OMA-URI traffic between the device and Intune in real time — the best way to see exactly what a policy sync is adding, changing, or removing, and to confirm whether unassigning a policy actually rolls it back or leaves it tattooed on the client.

Updates

Windows Update for Business Readiness (admin) Breaks down where this device’s updates are actually coming from — WUfB, WSUS, or Microsoft 365 Apps’ own update channel — with category breakdown, failure highlighting, gap analysis, and a deduplicated timeline. Built for exactly the confusion that shows up mid-migration from WSUS to Windows Update for Business.