Kris Mandemaker

Kris Mandemaker

Senior Workspace Consultant @ Mand-IT

I'm a freelance Senior Workspace Consultant operating as Mand-IT, based in Alkmaar, Netherlands.

My day job centres on the Microsoft ecosystem — Intune, Entra ID, Azure Virtual Desktop, and modern workplace design.

Sherlog is a side project — I spend a lot of time digging through Intune Management Extension logs and wanted the timeline analysis and a CMTrace-style viewer one drag-and-drop away, right in the browser.

LinkedIn Mand-IT

Troubleshoot Intune‑managed Windows devices

Upload IME logs or a full diagnostics package and see what actually happened — app installs, scripts, errors, device health and applied policies. Runs in your browser; nothing touches the device or Intune.

No accountBrowser-only Deleted after 24h

4,040 uploads analysed so far

Drop a diagnostics .zip, .log files or a whole folder or ·

    .log.zip Max 50 MB

    A single .zip opens the device health dashboard right away. Loose .log files or a folder open the file viewer; the timeline analysis is one click away there.

    Get started

    Diagnostics Package

    Collect-IntuneDiagnostics.ps1

    Run the collector in an elevated PowerShell on the device, then upload the zip: 30+ health checks, Win32 app status, applied policies and the timeline, with every file browsable.

    Details Download .ps1

    Collect straight from Intune

    Remediation → /api/diagnostics

    Deploy the collector as an Intune remediation. Devices upload here on their own; review each one in your token-scoped inbox.

    Open inbox

    CMTrace Viewer

    %ProgramData%\Microsoft\IntuneManagementExtension\Logs

    Only have loose IME logs? Read them in a colored, filterable CMTrace table — warnings yellow, errors red — and run the timeline analysis when you need it.

    Open viewer

    How it works

    1. 1
      Get the logs. From %ProgramData%\Microsoft\IntuneManagementExtension\Logs, the Intune Collect diagnostics export, or the collector script.
    2. 2
      Upload here. Drop a .zip, loose .log files or a folder — a zip goes to Diagnostics, loose logs to the CMTrace viewer.
    3. 3
      Read it in the browser. A device health dashboard (with the Win32 timeline inside) or a colored log table — every result links back to the raw evidence.