Co-management Series “Merging the Perimeter” – Part 8: Monitoring Co-management

In the final part of the series we will look at the different ways of monitoring Co-management.

• Part 1: What is Co-management?
• Part 2: Paths to Co-management
• Part 3: Co-management Prerequisites
• Part 4: Configuring Hybrid Azure AD
• Part 5: Enabling Co-management
• Part 6: Switching Workloads to Intune
• Part 7: Co-management Capabilities
• Part 8: Monitoring Co-management
• Troubleshooting
  Microsoft Edge stops receiving updates after the Windows Update workload is moved to Intune
  Using MEMCM to fix legacy GPO settings that prevent co-managed clients getting updates from Intune
  Office 365 updates stop working when workloads are switched to Intune

Monitoring Co-Management

In the final part of our co-management series we will look at the different ways to monitor co-management in our environment.

Logs Glorious Logs

Co-management has it’s own log file which we have used throughout this series – CoManagementHandler.log located on each client (Default Client Logs Directory is C:\Windows\CCM\Logs) – Use it! Everything from capability changes to MDM enrollment is recorded in this log file.

As we move workloads to Intune, we can still check the relevant SCCM logs too. For example, the Co-ManagementHandler.log could show a workload shift to Intune, for Compliance Policies, evaluated by the capabilities number change.

We can still check the SCCM Compliance log ComplRelayAgent.log for any impact from a co-management workload move to Intune.

The SCCM client will evaluate if any compliance policies deployed from SCCM should be applied. In the log below we can see that there is a capabilities evaluation. Any compliance policies deployed from SCCM to the client should not be evaluated because the workload has moved to Intune.

Thanks Peter Vanderwoude for the heads up on this info over at https://www.petervanderwoude.nl/post/co-management-and-the-configmgr-client/

SQL Tables

There is a handy view in the CCM database you can play with if you want to report which clients have different workloads moved to Intune

The SQL View is v_ClientCoManagementState

Client Registry

You can view the Co-management settings and perform Configuration Item evaluations against the client registry.

HKLM\Software\Microsoft\CCM\CoManagementFlags

SCCM Co-management Dashboard

Accessible from the Monitoring Work-space, the Co-management dashboard is a great place to head to get an overall picture of your co-management health

Intune

Head over to the Devices blade in Intune to view related information for Co-managed devices.
https://devicemanagement.microsoft.com/#blade/Microsoft_Intune_Devices/DeviceEntryBlade/mDMDevices

WMI

Get-CimInstance -ClassName CCM_System -Namespace ‘root\ccm\invagt’ | Select ComgmtWorkloads

Summary

This concludes the final part of the series for Co-management. I hope you have found the series useful. Please comment or reach out if I can unpack any of these posts in more detail for you to help you better understand the awesome power of SCCM and Intune Co-management.