Intune Deployment Guide

Intune Management Extension logs

Overview

Intune Management Extension logs are the device-side record of what actually happened during Win32 app processing. They help confirm whether the device received policy, evaluated applicability, checked detection, ran the install command, and reported status back to Intune.

The most effective way to troubleshoot is not to open every log randomly. Start with the right log for the symptom, then follow the timeline around the deployment attempt.

Where the logs are stored

On Windows devices, Intune Management Extension logs are stored under this local folder:

C:\ProgramData\Microsoft\IntuneManagementExtension\Logs

Use CMTrace, OneTrace, Notepad++, or another log viewer that can handle live log updates and long lines. Plain Notepad works for quick checks, but it is not ideal for timeline-based troubleshooting.

File ExplorerIntuneManagementExtension\Logs

C:\ProgramData\Microsoft\IntuneManagementExtension\Logs

IntuneManagementExtension.logMain agent, check-in, policy processing, and reporting

AppWorkload.logWin32 app workload, applicability, install, uninstall, and state transitions

AppActionProcessor.logApp action processing, detection, and applicability checks

AgentExecutor.logPowerShell script execution and agent-run actions

Which log should you open first?

Use the symptom to pick the starting log. For most Win32 app issues, start with AppWorkload.log or IntuneManagementExtension.log, then branch to the more specific log when the timeline points there.

Scenario	Open this log first	Why
Win32 app install or uninstall failed	AppWorkload.log	Shows app workload processing, applicability, install, uninstall, and app state transitions.
Device may not be checking in or receiving policy	IntuneManagementExtension.log	Main IME log for check-ins, policy requests, policy processing, and reporting.
Detection or applicability looks wrong	AppActionProcessor.log	Tracks actions for assigned apps, including detection and applicability checks.
PowerShell script or script-based action failed	AgentExecutor.log	Tracks script execution and agent-run tasks.
IME service or client health seems broken	ClientHealth.log	Helps confirm client health evaluation and service-side issues.
Portal reporting or inventory state looks incorrect	Win32AppInventory.log	Helps validate local Win32 app inventory and installed-state reporting.

Log file map

The IME writes multiple logs because different components handle different parts of the deployment flow. This map keeps the troubleshooting path focused.

Log file	What it usually tells you
IntuneManagementExtension.log	Main agent activity: check-in, policy request, policy processing, reporting, and high-level app processing.
AppWorkload.log	Detailed Win32 app workload processing, including app applicability, install, uninstall, and state evaluation.
AppActionProcessor.log	Actions for assigned apps, including detection and applicability checks.
AgentExecutor.log	Execution details for PowerShell scripts and actions started by the agent.
ClientHealth.log	Health evaluation of the Intune Management Extension client.
HealthScripts.log	Detection and remediation script runs scheduled through Intune.
Win32AppInventory.log	Inventory scan details for installed Win32 applications and reported installed state.
ImeUI.log	User-facing notification/UI activity from the IME.

Read logs by timeline

For app deployment issues, start with the exact time of the install attempt. Then read forward through the sequence: policy received, applicability evaluated, detection checked, content prepared, command executed, exit code returned, detection rechecked, and status reported.

01PolicyAssignment and app intent arrive on the device

02ApplicabilityRequirements and applicability are evaluated

03DetectionExisting installed state is checked

04ExecutionInstall, uninstall, or script action runs

05ResultExit code, detection state, and status are reported

Log viewer example

Search by app name, app ID, command text, return code, or a timestamp from the Intune admin center. The first failure after the detection or execution phase is usually more useful than the final summary line.

AppWorkload.logFind: 7-Zip

[10:14:22] App workload policy received
[10:14:24] Applicability: Applicable
[10:14:25] Detection before install: NotDetected
[10:14:31] Install command: msiexec /i "7z2601-x64.msi" /qn
[10:14:45] Process exit code: 0
[10:14:49] Detection after install: Detected
[10:14:50] Reporting state: Installed

Common searches

Use focused searches instead of reading the entire folder from top to bottom.

Search for	What it helps confirm
App name or app ID	Finds the exact processing section for the app.
Applicability	Shows whether the app was eligible for the device.
Detection	Shows whether Intune considered the app installed before and after execution.
Install command	Confirms the command Intune actually executed.
Exit code / return code	Shows how the installer or script ended.
GRS / re-evaluation	Helps explain retry timing after a failed Win32 app attempt.
Error / exception / failed	Finds the first meaningful failure near the action, not just the final status.

Collect logs from a device

When troubleshooting remotely, collect logs before repeated retries change the timeline. Package the folder and attach it to your support case or internal ticket.

PowerShell

PS>Compress-Archive -Path “C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\*” -DestinationPath “$env:TEMP\IME-Logs.zip” -Force

Created IME-Logs.zip for review.

Quick checklist

Record the exact time when the deployment was tested
Start with AppWorkload.log for Win32 app failures
Use IntuneManagementExtension.log for policy/check-in/reporting issues
Open AgentExecutor.log for PowerShell script failures
Compare detection state before and after execution
Check return code mapping before changing install commands
Collect logs before forcing too many retries

Troubleshooting with logs

Use the log evidence to decide the next check instead of changing multiple app settings at once.

Log evidence	What to check next
No app processing appears	Confirm assignment, sync, device targeting, and whether the device has received the policy.
Applicability is false	Review requirements, architecture, OS version, disk space, and custom requirement rules.
Detection is already true before install	Intune may skip installation because the app is already detected.
Command starts but fails	Validate silent switches, install behavior, dependencies, and installer context.
Exit code is not mapped correctly	Review return codes and whether the installer requires reboot, retry, or failure handling.
Install succeeds but detection fails	Fix the detection rule path, MSI product code, registry key, or script logic.
PowerShell script fails	Review AgentExecutor.log and verify script execution policy, 32-bit setting, and exit code.
App waits before retrying	Check re-evaluation timing and avoid assuming a failed app retries immediately.

Best practices

Troubleshoot from the device timeline, not only from portal status
Keep app names, package names, and commands easy to search
Use stable detection rules so install success can be confirmed
Preserve logs for failed pilot deployments before making changes
Change one setting at a time, then retest and compare logs

Leave a feedback

Include versions, steps, and any error text if you have them.