诊断日志

无论你是报告了问题还是我们的服务发现了问题，我们都可能需要从设备收集某些诊断日志，而无需用户干预。

我们不会从用户目录收集任何用户生成的内容或信息。 我们仅收集与设备运行状况和状态有关的诊断和日志数据。

我们将收集的任何日志存储 28 天，然后将其删除。 我们将按照数据处理标准处理从设备收集的任何日志。

收集的数据

以下列表包括托管桌面可能从中收集诊断日志的所有文件夹、事件日志、可执行文件或注册表位置Microsoft。

收集的实际数据将是此列表的子集，具体取决于所识别的问题。

注册表项

HKLM\\SYSTEM\\CurrentControlSet\\Services HKLM\\SOFTWARE\\Microsoft\\Surface HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate HKLM\\SYSTEM\\CurrentControlSet\\Control\\MUI\\UILanguages HKLM\\Software\\Policies\\Microsoft\\WindowsStore HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsStore\\WindowsUpdate HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel HKLM\\SYSTEM\\CurrentControlSet\\Control\\FirmwareResources HKLM\\SOFTWARE\\Microsoft\\WindowsSelfhost HKLM\\SOFTWARE\\Microsoft\\WindowsUpdate HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Superfetch HKLM\\SYSTEM\\Setup HKLM\\Software\\Microsoft\\IntuneManagementExtension HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot HKLM\\SOFTWARE\\Microsoft\\Windows Advanced Threat Protection HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\LogonUI HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall HKLM\\Software\\Policies HKLM\\SOFTWARE\\Policies\\Microsoft\\Cryptography\\Configuration\\SSL HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Advanced Threat Protection HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall HKLM\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL

命令

%programfiles%\\windows defender\\mpcmdrun.exe -GetFiles %windir%\\system32\\certutil.exe -store %windir%\\system32\\certutil.exe -store -user my %windir%\\system32\\Dsregcmd.exe /status %windir%\\system32\\ipconfig.exe /all %windir%\\system32\\ipconfig.exe /displaydns %windir%\\system32\\mdmdiagnosticstool.exe %windir%\\system32\\msinfo32.exe /report %temp%\\MDMDiagnostics\\msinfo32.log %windir%\\system32\\netsh.exe advfirewall show allprofiles %windir%\\system32\\netsh.exe advfirewall show global %windir%\\system32\\netsh.exe lan show profiles %windir%\\system32\\netsh.exe winhttp show proxy %windir%\\system32\\netsh.exe wlan show profiles %windir%\\system32\\netsh.exe wlan show wlanreport %windir%\\system32\\ping.exe -n 50 localhost %windir%\\system32\\powercfg.exe /batteryreport /output %temp%\\MDMDiagnostics\\battery-report.html %windir%\\system32\\powercfg.exe /energy /output %temp%\\MDMDiagnostics\\energy-report.html bitsadmin /list /allusers /verbose fltMC.exe bcdedit /enum all /v manage-bde -protectors -get Windows PowerShell commands: Get-appxpackage -allusers Get-appxpackage -packagetype bundle Get-Service wuauserv Get-NetFirewallRule Get-WmiObject -Class win32\_product Get-ComputerInfo Get-Service Get-Process Get-WmiObject Win32\_PnPSignedDriver

事件日志

Application Microsoft-Windows-AppLocker/EXE and DLL Microsoft-Windows-AppLocker/MSI and Script Microsoft-Windows-AppLocker/Packaged app-Deployment Microsoft-Windows-AppLocker/Packaged app-Execution Microsoft-Windows-Bitlocker/Bitlocker Management Microsoft-Windows-SENSE/Operational Microsoft-Windows-SenseIR/Operational Setup System

文件

%ProgramData%\\Microsoft\\DiagnosticLogCSP\\Collectors\\\*.etl %ProgramData%\\Microsoft\\IntuneManagementExtension\\Logs\\\*.\* %ProgramData%\\Microsoft\\Windows Defender\\Support\\MpSupportFiles.cab %ProgramData%\\Microsoft\\Windows\\WlanReport\\wlan-report-latest.html %ProgramData%\\Microsoft\\Windows\\WlanReport -SourceFileName wlan-report-latest.html %windir%\\ccm\\logs\*.log %windir%\\ccmsetup\\logs\*.log %windir%\\logs\\CBS\\cbs.log %windir%\\logs\\measuredboot\*.\* %windir%\\Logs\\WindowsUpdate\*.etl %windir%\\inf\\\*.log %windir%\\servicing\\sessions\\ActionList.xml %windir%\\servicing\\sessions\\Sessions.xml %windir%\\SoftwareDistribution\\DataStore\\Logs\\edb.log %windir%\\SoftwareDistribution\\DataStore\\DataStore.edb %windir%\\logs\\dism\\dism.log %SystemRoot%\\System32\\Winevt\\Logs\\ %appdata%\\Microsoft\\Teams\\media-stack\\\*.blog %appdata%\\Microsoft\\Teams\\skylib\\\*.blog %appdata%\\Microsoft\\Teams\\media-stack\\\*.etl %appdata%\\Microsoft\\Teams\\logs.txt %windir%\\Windows\\System32\\winevt\\\*.\*