Skip to content

IntuneLogWatch CLI Guide

Jump to bottom
Gil Burns edited this page Sep 1, 2025 · 1 revision

IntuneLogWatch CLI Tool Guide

The IntuneLogWatch CLI provides command-line access to inspect MDM certificates on macOS devices managed by Microsoft Intune. This tool is designed for endpoint administrators who need to quickly verify certificate information, extract specific values, or integrate certificate inspection into scripts and workflows.

Overview

The CLI tool extracts and displays information from the MDM device certificate installed by Microsoft Intune, including:

  • Basic certificate information (Common Name, Issuer, Serial Number, Validity dates)
  • Microsoft Intune-specific extensions (Device ID, Tenant ID, User ID, etc.)
  • Certificate fingerprints (SHA-256, SHA-1, MD5)

Installation and Access

The CLI tool is bundled with the IntuneLogWatch application. Once IntuneLogWatch is installed, you can access the CLI tool in several ways:

Method 1: From IntuneLogWatch App Menu

  1. Open IntuneLogWatch
  2. Go to Help → Inspect MDM Certificate with CLI…
  3. This opens Terminal with the CLI tool ready to use

Method 2: Direct Terminal Access

The CLI tool is located at:

/Applications/IntuneLogWatch.app/Contents/MacOS/intunelogwatch-cli

You can create an alias for easier access:

alias intunelogwatch-cli="/Applications/IntuneLogWatch.app/Contents/MacOS/intunelogwatch-cli"

Basic Usage

Display All Certificate Information

intunelogwatch-cli

Example Output:

MDM Certificate Information
==========================
Common Name: f795c2de-198c-4964-9e26-9a108a26fda9
Issuer: Microsoft Intune MDM Device CA
Serial Number: 7D C8 5D 55 EE 41 FB A9 4A FF 5A 6E 9E 6B 3F 8D
Not Valid Before: Jun 21, 2025 at 8:34 PM
Not Valid After: May 1, 2026 at 9:38 PM

Microsoft Intune Extensions
==========================
Intune Device ID: f795c2de-198c-4964-9e26-9a108a26fda9
Tenant ID: 90b9b64e-9eb6-4285-9fcf-d3cc6630aade
Entra User ID: 3b1bd7ad-d47b-4f85-823f-a42bbf7ca6c9
Account ID: 801bd21c-54b3-461d-89e6-7fc2d2c80ad8
MdmEnrollment ID: 2
Policy ID: 24
Resource ID: 36
Profile ID: 1

Certificate Fingerprints
=======================
SHA-256: A1 B2 C3 D4 E5 F6 78 90 AB CD EF 12 34 56 78 90 AB CD EF 12 34 56 78 90 AB CD EF 12 34 56 78 90 AB
SHA-1: A1 B2 C3 D4 E5 F6 78 90 AB CD EF 12 34 56 78 90 AB CD
MD5: A1 B2 C3 D4 E5 F6 78 90 AB CD EF 12 34 56 78 90

Command Line Options

Help and Version

# Display help information
intunelogwatch-cli --help

# Display version information
intunelogwatch-cli --version

Verbose Output

Add detailed logging and troubleshooting information:

intunelogwatch-cli --verbose

JSON Output

Export certificate information in JSON format for automation and scripting:

intunelogwatch-cli --json

Example JSON Output:

{
  "commonName": "f795c2de-198c-4964-9e26-9a108a26fda9",
  "issuer": "Microsoft Intune MDM Device CA",
  "serialNumber": "7D C8 5D 55 EE 41 FB A9 4A FF 5A 6E 9E 6B 3F 8D",
  "notValidBefore": "2025-06-21T20:34:15Z",
  "notValidAfter": "2026-05-01T21:38:15Z",
  "fingerprints": {
    "sha1": "A1 B2 C3 D4 E5 F6 78 90 AB CD EF 12 34 56 78 90 AB CD",
    "sha256": "A1 B2 C3 D4 E5 F6 78 90 AB CD EF 12 34 56 78 90 AB CD EF 12 34 56 78 90 AB CD EF 12 34 56 78 90 AB",
    "md5": "A1 B2 C3 D4 E5 F6 78 90 AB CD EF 12 34 56 78 90"
  },
  "extensions": {
    "1.2.840.113556.5.4": {
      "name": "Intune Device ID",
      "value": "f795c2de-198c-4964-9e26-9a108a26fda9"
    },
    "1.2.840.113556.5.14": {
      "name": "Tenant ID",
      "value": "90b9b64e-9eb6-4285-9fcf-d3cc6630aade"
    }
  }
}

Extract Specific Fields

Use the --field option to extract specific certificate information:

Basic Certificate Fields

# Get the device's common name (typically the Intune Device ID)
intunelogwatch-cli --field commonName

# Get the certificate issuer
intunelogwatch-cli --field issuer

# Get the serial number
intunelogwatch-cli --field serialNumber

# Get validity dates
intunelogwatch-cli --field validFrom
intunelogwatch-cli --field validTo

Microsoft Intune Extension Fields

# Get Tenant ID
intunelogwatch-cli --field tenantId

# Get Intune Device ID
intunelogwatch-cli --field deviceId

# Get Entra User ID
intunelogwatch-cli --field userId

# Get Account ID
intunelogwatch-cli --field accountId

# Get MDM Enrollment ID
intunelogwatch-cli --field enrollmentId

Certificate Fingerprints

# Get SHA-256 fingerprint (recommended)
intunelogwatch-cli --field sha256

# Get SHA-1 fingerprint
intunelogwatch-cli --field sha1

# Get MD5 fingerprint
intunelogwatch-cli --field md5

List Extensions

Display only the Intune extension values:

# List all extensions with names
intunelogwatch-cli --list-extensions

# List extension values only (useful for scripting)
intunelogwatch-cli --list-extensions --values-only

Common Use Cases

Device Identification

Quickly identify a device's Intune Device ID and Tenant ID:

# Get Device ID for support tickets
DEVICE_ID=$(intunelogwatch-cli --field deviceId)
echo "Device ID: $DEVICE_ID"

# Get Tenant ID for verification
TENANT_ID=$(intunelogwatch-cli --field tenantId)
echo "Tenant ID: $TENANT_ID"

Certificate Validation

Verify certificate validity and fingerprints:

# Check certificate expiration
intunelogwatch-cli --field validTo

# Get certificate fingerprint for verification
intunelogwatch-cli --field sha256

Automation and Scripting

Export certificate data for processing:

# Export to JSON file
intunelogwatch-cli --json > device_certificate.json

# Extract specific data for inventory scripts
DEVICE_INFO=$(intunelogwatch-cli --json | jq -r '.commonName + "," + .extensions."1.2.840.113556.5.14".value')
echo "$DEVICE_INFO" >> device_inventory.csv

Troubleshooting

Use verbose output for troubleshooting certificate issues:

# Detailed troubleshooting output
intunelogwatch-cli --verbose

# Check if certificate exists and is accessible
intunelogwatch-cli --field deviceId || echo "Certificate not found or inaccessible"

Understanding the Output

Certificate Information

  • Common Name: Usually the Intune Device ID (GUID format)
  • Issuer: Always "Microsoft Intune MDM Device CA" for Intune-managed devices
  • Serial Number: Unique identifier for this specific certificate
  • Validity Dates: When the certificate becomes valid and when it expires

Microsoft Intune Extensions

These extensions contain device-specific information used by Intune:

  • Intune Device ID: Unique identifier for the device in Intune
  • Tenant ID: Your organization's Microsoft 365 tenant identifier
  • Entra User ID: The user ID from Microsoft Entra (formerly Azure AD)
  • Account ID: Internal Intune account identifier
  • MdmEnrollment ID: MDM enrollment sequence number
  • Policy ID: Internal policy identifier
  • Resource ID: Internal resource identifier
  • Profile ID: Configuration profile identifier

Certificate Fingerprints

Digital fingerprints used to verify certificate authenticity:

  • SHA-256: Most secure, recommended for modern systems
  • SHA-1: Legacy standard, still commonly used
  • MD5: Older standard, included for compatibility

Troubleshooting

Common Issues

"Certificate not found" Error

# Verify certificate exists with verbose output
intunelogwatch-cli --verbose

Possible causes:

  • Device is not enrolled in Intune
  • MDM certificate has been removed or expired
  • Keychain access permissions issue

"Keychain access failed" Error

Possible causes:

  • Insufficient permissions to access system keychain
  • Try running with administrator privileges if needed

Empty or Missing Fields

If specific fields return empty values:

# Check what extensions are available
intunelogwatch-cli --list-extensions --verbose

Security Considerations

  • The certificate information displayed is already visible to the device user
  • Tenant IDs and Device IDs are not considered sensitive but should be handled appropriately
  • Use the --field option to extract only needed information in scripts
  • Consider redacting GUIDs when sharing logs or output for support purposes

Integration Examples

Microsoft Intune Shell Script

#!/bin/bash
# Verify device enrollment
TENANT_ID=$(/Applications/IntuneLogWatch.app/Contents/MacOS/intunelogwatch-cli --field tenantId 2>/dev/null)
EXPECTED_TENANT="your-tenant-id-here"

if [[ "$TENANT_ID" == "$EXPECTED_TENANT" ]]; then
    echo "Device properly enrolled in expected tenant"
    exit 0
else
    echo "Device enrollment issue detected"
    exit 1
fi

For additional support and feature requests, visit the IntuneLogWatch GitHub repository.

Clone this wiki locally