Verify Intune Policies on Windows: Step-by-Step Local Checks

Verify Intune Policies on Windows: A Step-by-Step Field Guide

This post gives you a practical workflow to prove Intune policies are applied on a Windows device. Each section includes the exact places to check, commands to run, and what “success” looks like.

---

Who this is for

IT admins who need local, defensible evidence that Intune (MDM) settings, apps, scripts, and compliance are actually in effect.

---

Quick prerequisites

• Use an elevated PowerShell or CMD.
• Know which policy or feature you expect (e.g., BitLocker, ASR, Firewall, WUfB).
• Have local admin rights.

---

1) Confirm the device is joined and managed

Command:

dsregcmd /status

Expect:

• AzureAdJoined : YES
• IsManaged : YES
• MDMUrl populated
• Valid DeviceId and TenantId

Enrollment tasks present:

Get-ScheduledTask -TaskPath '\Microsoft\Windows\EnterpriseMgmt\' |
  ft TaskName,State,LastRunTime

---

2) Trigger a manual MDM sync (so you see fresh data)

GUI: Settings > Accounts > Access work or school > your org > Info > Sync

PowerShell (kick the MDM client):

Get-ScheduledTask -TaskPath '\Microsoft\Windows\EnterpriseMgmt\' |
  Where-Object TaskName -like 'Schedule*' |
  Start-ScheduledTask

---

3) Read the core MDM event logs (DMEDP)

Event Viewer:

• Applications and Services Logs Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin
  (Optional: Operational)

Look for:

• 813 – Value set (shows OMA-URI + value)
• 814/815 – Policy applied/updated
• Errors/Warnings around your sync time

CLI filter (last hour, errors/warnings):

wevtutil qe Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin `
  /q:"*[System[(Level=2 or Level=3) and TimeCreated[timediff(@SystemTime) <= 3600000]]]" `
  /f:text /c:50

---

4) Check low-level MDM traces

Folder:

C:\Windows\Logs\DeviceManagement\

Files like MDMDiagLog.etl and ..._Admin.etl help when Event Viewer isn’t enough.

---

5) Verify PolicyManager registry state

Most device-scope CSP settings land in:

• HKLM\SOFTWARE\Microsoft\PolicyManager\Current\Device\...
• HKLM\SOFTWARE\Microsoft\PolicyManager\Providers\{GUID}\default\Device\...

Examples:

# List current device policies
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\PolicyManager\Current\Device' |
  ForEach-Object { Get-ItemProperty $_.PsPath } | Out-Host

# BitLocker-related keys (if configured)
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\PolicyManager\Current\Device\BitLocker' -ErrorAction SilentlyContinue

# Windows Update policy state (WUfB)
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\PolicyManager\Current\Device\Update' |
  ForEach-Object { Get-ItemProperty $_.PsPath }

If you know the OMA-URI, map it to PolicyManager to confirm the exact value.

---

6) Intune Management Extension (IME): Win32 apps, scripts, PR

Service health:

Get-Service IntuneManagementExtension

Expect Running.

Key logs:

C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\
  IntuneManagementExtension.log
  AgentExecutor.log
  Win32App_*.log
  Sensor.log  (Proactive Remediations)
  DetectionScript.log / RemediationScript.log (per PR)

Search for:

• “Policy download succeeded”
• “Detection rule” result
• “Exit code 0 / Install completed”

Win32 app breadcrumbs:

HKLM\SOFTWARE\Microsoft\IntuneManagementExtension\Win32Apps\

---

7) Prove compliance locally

Company Portal path: Company Portal > Devices > This device > Compliance

Common compliance signals (cross-check):

# BitLocker
Get-BitLockerVolume | ft MountPoint, VolumeStatus, ProtectionStatus, EncryptionMethod

# Defender AV
Get-MpComputerStatus |
  Select AMProductVersion, AntispywareEnabled, RealTimeProtectionEnabled, ProtectionStatus | fl

# Firewall
(Get-NetFirewallProfile -All).Enabled

# TPM
Get-Tpm | fl TpmPresent,TpmReady,TpmEnabled

Compliance evaluation events: DMEDP Admin log around the last sync.

---

8) Prove specific configuration profiles changed the OS

Match the Intune setting to a local proof point.

Attack Surface Reduction (ASR):

Get-MpPreference | fl AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions

Firewall rules (MDM store):

Get-NetFirewallRule | ? PolicyStore -match 'MDM' |
  ft DisplayName,Enabled,Direction,Action

Windows Update for Business (WUfB):

# Kick a scan and inspect policy state/logs
usoclient startscan
Get-WindowsUpdateLog  # creates merged log on Desktop

Hello for Business (indicators): dsregcmd /status + User Device Registration logs.

Edge / Chrome ADMX ingestion:

• edge://policy
• chrome://policy
  You should see Managed and each key/value.

---

9) Certificates, Wi-Fi, and VPN profiles

Certificates (computer store): certlm.msc
Check Personal, Trusted Root, Intermediate for expected issuers.

Wi-Fi profiles:

netsh wlan show profiles

VPN profiles:

Get-VpnConnection

---

10) Collect a single evidence bundle (great for audits)

MDMDiagnosticsTool:

mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning;DeviceManagement;Autopilot `
  -cab C:\Temp\MDMDiag.cab

Outputs a CAB with logs, traces, policy state.

---

Copy/Paste Mini-Checklist (fast health snapshot)

# Join + MDM
dsregcmd /status

# EnterpriseMgmt tasks & last run
Get-ScheduledTask -TaskPath '\Microsoft\Windows\EnterpriseMgmt\' | ft TaskName,State,LastRunTime

# IME running
Get-Service IntuneManagementExtension

# Recent MDM errors/warnings (last hour)
wevtutil qe Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin `
  /q:"*[System[(Level=2 or Level=3) and TimeCreated[timediff(@SystemTime) <= 3600000]]]" `
  /f:text /c:50

# BitLocker / Firewall / Defender quick checks
Get-BitLockerVolume | ft MountPoint,ProtectionStatus
(Get-NetFirewallProfile -All).Enabled
(Get-MpComputerStatus).RealTimeProtectionEnabled

---

Troubleshooting gotchas

• GPO vs MDM conflicts:
  Old GPOs can override MDM. Run: gpresult /h C:\Temp\gp.html If GPO is stamping the same setting, migrate or resolve precedence.
• Wrong assignment scope:
  A user-targeted policy won’t change device keys you’re checking (and vice-versa).
• Time skew:
  Large clock drift breaks auth/sync. Fix NTP.
• Proxy/SSL inspection:
  Can block MDM/IME endpoints. Test with inspection bypass.

---

Wrap-up

Use the sequence above in this order:

1. Join/MDM status → 2. Sync → 3. DMEDP logs → 4. Registry →
2. IME + app/script logs → 6. Compliance proofs → 7. Feature-specific checks → 8. MDM diagnostics CAB