How to Collect Windows Security Event Logs Through Intune
Question details
The user needs to collect Windows security event logs from Windows 10 devices that are managed via Microsoft Intune.
- Product
- Microsoft Intune
- Device & OS
- Windows 10
- Scenario
- An IT administrator is attempting to gather diagnostic data and security logs from managed Windows 10 devices for troubleshooting, auditing, or compliance tracking.
- Observed behavior
- The native 'Collect diagnostics' feature in Microsoft Intune does not include security event logs in its payload, leaving the administrator unable to view or analyze critical security events.
Ensure you have global or Intune administrator privileges and an active Azure subscription with permissions to configure Azure Log Analytics or Microsoft Sentinel.
Use Azure Log Analytics or Microsoft Sentinel to Collect Security Logs
Since Intune's native diagnostic feature intentionally excludes security event logs, you must configure Azure Log Analytics or Microsoft Sentinel to capture the required Windows event channels.
Microsoft intentionally excludes security event logs from Intune's default 'Collect diagnostics' tool to maintain payload efficiency and protect user privacy. To acquire these specific logs, you must establish a dedicated monitoring pipeline using Azure monitor services.
Sign in to the Azure Portal and create a new Azure Log Analytics workspace or Microsoft Sentinel instance to act as the central repository for your device logs.
Navigate to the Data Collection Rules (DCR) in your workspace settings and explicitly configure the rules to ingest the 'Security' Windows event logs.
Deploy the Azure Monitor Agent (AMA) to your managed Windows 10 devices. You can package the agent installer and deploy it as a required Windows app through the Microsoft Intune admin center.
Once the agent is successfully installed on the target endpoints, run a Kusto Query Language (KQL) query in your Log Analytics workspace to confirm that the security event logs are actively being ingested.
Draft IT Policies and Compliance Reports with WPS Office
While you configure advanced Microsoft Intune policies and Azure monitoring rules, use WPS Office to efficiently draft your IT documentation and compliance reports. It is a powerful, lightweight, and cost-effective alternative to Microsoft Office that easily handles your everyday document management needs.
- 1. Visit the WPS Office Website: Navigate to the official WPS Office website to access the free, secure download.
- 2. Download the Installer: Click the 'Free Download' button to get the lightweight installation package for your operating system.
- 3. Install and Start Drafting: Run the installer, open the application, and instantly start writing your IT documents in a familiar environment.
Frequently Asked Questions
Does Intune's default diagnostic collection gather any event logs at all?
Yes, Intune's 'Collect diagnostics' action gathers various operational and administrative event logs (such as MDM, AppLocker, and system logs), but it intentionally excludes the Security event channel to limit payload size and adhere to privacy standards.
Can I manually install the Azure Monitor Agent to collect security logs?
Yes. While deploying through Intune is recommended for efficiently managing multiple devices, you can manually download and install the Azure Monitor Agent on individual Windows 10 machines for testing or localized monitoring.
Are there additional costs for collecting security logs in Azure?
Yes, Azure Log Analytics and Microsoft Sentinel incur costs based on the volume of data ingested and retained. Because security logs can generate a massive amount of data, it is crucial to monitor your ingestion rates closely to manage your Azure billing effectively.
