Kris Mandemaker

Kris Mandemaker

Senior Workspace Consultant @ Mand-IT

I'm a freelance Senior Workspace Consultant operating as Mand-IT, based in Alkmaar, Netherlands.

My day job centres on the Microsoft ecosystem — Intune, Entra ID, Azure Virtual Desktop, and modern workplace design.

Sherlog is a side project — I spend a lot of time digging through Intune Management Extension logs and wanted the timeline analysis and a CMTrace-style viewer one drag-and-drop away, right in the browser.

LinkedIn Mand-IT

Analyze Intune Management Extension logs

Sherlog is a free troubleshooting tool for Intune administrators: upload the IME logs of a managed Windows device and see what actually happened — app installs, scripts and errors — without reading raw logs line by line.

No account needed · uploads are deleted after 24 hours

Screenshot of the interactive Win32App timeline report with the analysis summary panel

Timeline Analyzer

“What happened on this device, and when?”

Upload IME .log files and get an interactive timeline report: app installs, scripts and errors in chronological order, with a summary of failures and known error codes.

Open Timeline
Screenshot of the CMTrace-style log table with colored warning and error rows and filters

CMTrace Viewer

“Let me just read this log, fast.”

Read raw .log files in a colored, filterable CMTrace-style table: warnings yellow, errors red, with text, component and severity filters. No analysis run.

Open CMTrace
Screenshot of the device health dashboard and package file browser

Diagnostics Package

“Is this device healthy at all?”

Upload the zip from Collect-IntuneDiagnostics.ps1 and get device health checks, an automatic timeline analysis and a viewer for every file in the package — including event logs and registry exports.

Open Diagnostics

How it works

  1. Get the logs off the device. Copy them from C:\ProgramData\Microsoft\IntuneManagementExtension\Logs, download the Intune portal’s Collect diagnostics export, or run the collector script for a complete diagnostics package.
  2. Upload them here. Drag & drop a .zip, loose .log files or a whole folder. Nothing is installed on the device or in Intune.
  3. Read the result in your browser. An interactive timeline, a colored log table or a device health dashboard — and every result page links back to the raw evidence.

Which tool do I need?