Enhanced Inventory Data Reference (Windows)

This page lists everything the Windows Enhanced Inventory script (Intune_Windows_Inventory.ps1) collects from a device and sends to your Log Analytics workspace. Use it to answer security and privacy reviews, to decide which collection categories to turn on, and to understand what each dashboard in BI for Intune is built from.

The reference matches script version 19 (August 10, 2026) in the Windows-Enhanced-Inventory repository. For deployment steps, see Set up Enhanced Inventory.

What the script doesn’t collect

The script doesn’t read user files, documents, browser history, email, credentials, or network traffic. It doesn’t send the signed-in user’s name or SID. The user account is resolved locally only so the script can read that user’s per-user installed-application registry keys, and the account name is written to the local log file on the device, not to Log Analytics.

How Collection Works

The script runs as SYSTEM from an Intune remediation, once per day. Each run:

1. Reads the Intune enrollment ID and computer name from the device.
2. Collects each category you’ve turned on (device, application, driver).
3. Converts each category to JSON, compresses it with GZip, and Base64-encodes the result.
4. Splits the encoded text into chunks of up to 64,512 characters and writes each chunk to a numbered string column (up to 10 columns per table).
5. Sends one record per category to your Data Collection Endpoint through the Logs Ingestion API, authenticating with the app registration from Step 1 of the setup guide.

BI for Intune decodes the chunks when it refreshes. If a category exceeds 10 chunks, the script logs an error and that category isn’t sent for that run.

Settings That Control What Is Collected

All settings are variables near the top of the script. $true collects the category; $false skips it.

Setting	Default	What it controls
$CollectDeviceInventory	$true	The entire PowerStacksDeviceInventory_CL record: hardware, monitors, disks, chassis, battery, OS install date, and the two sub-categories below.
$CollectMicrosoft365	$true	Microsoft 365 Apps version, update channel, and release data. Sub-setting of device inventory; ignored when device inventory is off.
$CollectWarranty	$false	Warranty lookup against the Dell, HP, Lenovo, or Getac API. Sub-setting of device inventory. Also requires vendor API credentials.
$RemoveBuiltInMonitors	$false	When $true, excludes the laptop’s internal display from the monitor list.
$CollectAppInventory	$true	The entire PowerStacksAppInventory_CL record: installed Win32 applications.
$CollectUWPInventory	$false	Adds Microsoft Store (UWP) packages to the application list. Sub-setting of application inventory.
$CollectDriverInventory	$true	The entire PowerStacksDriverInventory_CL record: installed and optional drivers.
$MatchDrivers	$true	When $true, matches installed driver packages to Windows Update package names and queries Windows Update for optional driver updates. When $false, reports installed PnP drivers only and skips the Windows Update query.
$WarrantyMaxCacheAgeDays	352	Days a cached warranty result stays valid before the script calls the vendor API again.
$WarrantyForceRefresh	$false	When $true, ignores the cache and calls the vendor API on every run.
$InventoryDateFormat	"MM-dd HH:mm"	Format of the timestamp in the remediation status message. Doesn’t affect the data sent.
$Transcribe	$false	When $true, writes a full PowerShell transcript to C:\Windows\Logs.

The remaining settings ($LogAPIMode, $TenantId, $ClientId, $ClientSecret, $DceURI, $DcrImmutableId, the optional $BrokerUrl and $BrokerClientId, the $Submission* retry values, and the $Warranty*ClientID and $Warranty*ClientSecret credentials) control how the script authenticates and where it sends data. They don’t change what is collected.

Fields Common to Every Table

Every record in all three tables has these columns.

Column	Source on the device	Notes
TimeGenerated	Added by Azure Monitor	Ingestion time.
ComputerName_s	Get-ComputerInfo (CsName)	The device’s computer name.
ManagedDeviceID_g	Registry: HKLM\SOFTWARE\Microsoft\Enrollments\<id>\MS DM Server, value EntDMID	The Intune managed device ID. BI for Intune uses it to join inventory to the Intune device record. Empty if the device isn’t enrolled.

The payload columns differ per table and are listed in each section below.

PowerStacksDeviceInventory_CL

Collected when $CollectDeviceInventory is $true. One record per device per run.

Table Columns

Column	Notes
Microsoft365_b	true when $CollectMicrosoft365 is on.
Warranty_b	true when warranty data was collected for this run, otherwise false.
DeviceDetails1_s through DeviceDetails10_s	Chunks of the compressed, Base64-encoded device JSON described below.

Device Fields

These fields are always collected when device inventory is on.

Field	Source on the device	Notes
DeviceManufacturer	Get-ComputerInfo (CsManufacturer)
DeviceModel	Get-ComputerInfo (CsModel); for Lenovo and IBM, Win32_ComputerSystemProduct.Version	Lenovo reports the friendly model name in Version.
Memory	Get-ComputerInfo (CsTotalPhysicalMemory)	Bytes.
CPUManufacturer	Win32_Processor.Manufacturer
CPUName	Win32_Processor.Name
CPUMaxClockSpeed	Win32_Processor.MaxClockSpeed	MHz.
CPUPhysical	Win32_ComputerSystem.NumberOfProcessors	Physical processor count.
CPUCores	Win32_Processor.NumberOfCores
CPULogical	Win32_Processor.NumberOfLogicalProcessors
LastBootTime	Get-ComputerInfo (OsLastBootUpTime)	UTC.
OSInstallDate	Get-ComputerInfo (OsInstallDate)	UTC.
BatteryDesignedCapacity	WMI ROOT\WMI\BatteryStaticData.DesignedCapacity	mWh. Empty on devices without a battery.
BatteryFullChargedCapacity	WMI ROOT\WMI\BatteryFullChargedCapacity.FullChargedCapacity	mWh. Compared with designed capacity to show battery health.
Monitors	Array, see Monitor Fields
PhysicalDisks	Array, see Physical Disk Fields
Chassis	Array, see Chassis Fields
Microsoft365	Object, see Microsoft 365 Fields	Present only when $CollectMicrosoft365 is $true.
Warranty	Object, see Warranty Fields	Present only when $CollectWarranty is $true.

Monitor Fields

One entry per display reported by WMI class ROOT\WMI\WMIMonitorID. When $RemoveBuiltInMonitors is $true, displays that also appear in Win32_DesktopMonitor (the built-in laptop panel) are excluded.

Field	Source	Notes
Manufacturer	WMIMonitorID.ManufacturerName	Three-letter EDID manufacturer code, for example DEL.
Model	WMIMonitorID.UserFriendlyName
SerialNumber	WMIMonitorID.SerialNumberID	The monitor’s serial number from EDID.
WeekOfManufacture	WMIMonitorID.WeekOfManufacture
YearOfManufacture	WMIMonitorID.YearOfManufacture

Physical Disk Fields

One entry per physical disk from Get-PhysicalDisk with a bus type of NVMe, SATA, SAS, ATAPI, or RAID. USB and other removable bus types are excluded.

Field	Source	Notes
Number	Get-PhysicalDisk (DeviceId)
BusType	Get-PhysicalDisk (BusType)
FirmwareVersion	Get-PhysicalDisk (FirmwareVersion)
HealthStatus	Get-PhysicalDisk (HealthStatus)	Healthy, Warning, or Unhealthy.
Manufacturer	Get-PhysicalDisk (Manufacturer)
Model	Get-PhysicalDisk (Model)
Name	Get-PhysicalDisk (FriendlyName)
SerialNumber	Get-PhysicalDisk (SerialNumber)	The disk’s serial number.
Size	Get-PhysicalDisk (Size)	Bytes.
Type	Get-PhysicalDisk (MediaType)	SSD, HDD, or Unspecified.
SMARTPredictFailure	WMI ROOT\WMI\MSStorageDriver_FailurePredictStatus.PredictFailure	true when the drive’s SMART status predicts failure.
SMARTReason	MSStorageDriver_FailurePredictStatus.Reason
Wear	Get-StorageReliabilityCounter (Wear)	Percent.
ReadErrorsUncorrected	Get-StorageReliabilityCounter
ReadErrorsTotal	Get-StorageReliabilityCounter
WriteErrorsUncorrected	Get-StorageReliabilityCounter
WriteErrorsTotal	Get-StorageReliabilityCounter
Temperature	Get-StorageReliabilityCounter	Celsius.
TemperatureMax	Get-StorageReliabilityCounter	Celsius.

Chassis Fields

One entry per chassis type code reported by Win32_SystemEnclosure.

Field	Source	Notes
ChassisTypeCode	Win32_SystemEnclosure.ChassisTypes	SMBIOS chassis type, for example 10 (Notebook) or 3 (Desktop).
ChassisTag	Win32_SystemEnclosure.SMBIOSAssetTag	The asset tag set in firmware, if any.

Microsoft 365 Fields

Collected when $CollectMicrosoft365 is $true and Microsoft 365 Apps (Click-to-Run) is installed. If Office isn’t installed with Click-to-Run, the object is empty.

Field	Source	Notes
InstalledVersion	Registry: HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration, value VersionToReport
UpdateChannel	Registry: HKLM\SOFTWARE\Policies\Microsoft\Office\16.0\Common\OfficeUpdate, value UpdateBranch; otherwise the channel GUID in CDNBaseUrl	Monthly, Monthly Enterprise, Semi-Annual, Beta, or their Preview variants.
LatestReleaseType	Microsoft release data API	Whether the installed build is a feature or security release.
LatestReleaseVersion	Microsoft release data API	Newest build available on the device’s channel.
EndOfSupportDate	Microsoft release data API	When the installed build leaves support.
ReleaseDate	Microsoft release data API	When the installed build was released.
ReleaseID	Microsoft release data API	For example 2409.

The release data comes from two public, unauthenticated Microsoft endpoints listed under Network Endpoints. The script sends only HTTP GET requests to them and doesn’t send any device data.

Warranty Fields

Collected when $CollectWarranty is $true and credentials are supplied for the device’s manufacturer. The script sends the device’s serial number from Win32_BIOS.SerialNumber to the manufacturer’s warranty API and stores the response.

Field	Source	Notes
ServiceProvider	Script	Dell, HP, Lenovo, or Getac.
ServiceModel	Vendor API	The vendor’s product description.
ServiceTag	Win32_BIOS.SerialNumber	The serial number sent to the vendor.
ServiceLevelDescription	Vendor API	Entitlement names, one per line.
WarrantyStartDate	Vendor API	UTC. Earliest entitlement start.
WarrantyEndDate	Vendor API	UTC. Latest entitlement end.

Manufacturers are matched on the Win32_BIOS.Manufacturer value: Dell, HP, Lenovo or IBM, and Insyde (Getac). Other manufacturers are skipped. The result is cached on the device at C:\Windows\Warranty_<serial>.json for $WarrantyMaxCacheAgeDays days so the vendor API is called at most a few times per year per device. For HP, the raw API response is also written to C:\Windows\Temp\HPWarranty_Raw_<serial>.json for troubleshooting.

PowerStacksAppInventory_CL

Collected when $CollectAppInventory is $true. One record per device per run. The payload is in InstalledApps1_s through InstalledApps10_s.

Where Applications Come From

Win32 applications are read from the Windows uninstall registry keys, the same source Settings > Apps uses:

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
• HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall
• HKU\<SID of the signed-in user>\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
• HKU\<SID of the signed-in user>\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall

The signed-in user is taken from Win32_ComputerSystem.UserName, or from the owner of explorer.exe if no one is signed in interactively. If no user can be resolved, only machine-scope applications are collected. Entries without a DisplayName are ignored.

Microsoft Store (UWP) packages are added only when $CollectUWPInventory is $true. They come from Get-AppxPackage -AllUsers, filtered to packages with an install state of Installed, with the publisher read from each package manifest.

When the same application name appears more than once (for example, a 32-bit and a 64-bit entry), only the entry with the highest version is kept.

Application Fields

One entry per application.

Field	Source	Win32	UWP	Notes
AppName	DisplayName / package Name	Yes	Yes
AppVersion	DisplayVersion / package Version	Yes	Yes
AppPublisher	Publisher / manifest PublisherDisplayName	Yes	Yes
AppType	Script	Win32	UWP
AppInstallDate	InstallDate	Yes	No	Formatted dd-MM-yyyy. Empty when the installer didn’t record a date.
AppUninstallString	UninstallString	Yes	No	The command Windows runs to uninstall the application.
AppUninstallRegPath	Registry key path	Yes	No	The full path of the uninstall key the entry was read from. For per-user applications this path contains the user’s SID.

PowerStacksDriverInventory_CL

Collected when $CollectDriverInventory is $true. One record per device per run. The payload is in ListedDrivers1_s through ListedDrivers10_s.

Where Drivers Come From

Installed drivers come from Win32_PnPSignedDriver. Drivers whose manufacturer or provider is Microsoft, and entries without a device name, are excluded. This keeps the list to third-party hardware drivers.

When $MatchDrivers is $true, the script also:

• Reads installed driver packages from Get-Package -ProviderName msu and matches them to the PnP list by version, so an installed driver can be tied to the Windows Update package that delivered it (WUName).
• Queries the Windows Update Agent (Microsoft.Update.Session) for updates matching IsInstalled=0 AND Type='Driver'. These appear with a status of Optional. The query goes to whatever update source the device is configured for (Windows Update or WSUS).

When $MatchDrivers is $false, only the PnP list is reported and the Windows Update query is skipped. Turn it off if driver collection takes too long on some devices.

Driver Fields

One entry per driver.

Field	Source (installed)	Source (optional)	Notes
WUName	Matched Get-Package name	Windows Update Title	Empty when no package matched.
DriverName	Win32_PnPSignedDriver.DeviceName	Windows Update DriverModel
DriverVersion	DriverVersion	Not available
DriverReleaseDate	DriverDate	DriverVerDate	UTC.
DriverClass	DeviceClass	DriverClass	For example NET, DISPLAY.
DriverID	DeviceID	Not available	PnP device instance ID.
DriverHardwareID	HardwareID	DriverHardwareID
DriverManufacturer	Manufacturer	DriverManufacturer
DriverInfName	InfName	Not available
DriverLocation	Location	Not available	Bus location, for example PCI bus 0, device 2.
DriverDescription	Description	Windows Update Description
DriverProvider	DriverProviderName	DriverProvider
DriverPublishedOn	Not available	LastDeploymentChangeTime	UTC. When Windows Update published the optional driver.
DriverStatus	Installed	Optional

Network Endpoints

The script makes outbound HTTPS connections only to the endpoints below. Which ones it contacts depends on the settings you turn on.

Endpoint	When	Purpose
login.microsoftonline.com	Always	Acquires the ingestion token with the app registration’s client ID and secret.
Your Data Collection Endpoint (*.ingest.monitor.azure.com)	Always	Sends the inventory records.
Your Entra Token Broker URL	Only when $BrokerUrl is set	Secretless token exchange. Replaces the client secret, not the DCE call.
mrodevicemgr.officeapps.live.com	$CollectMicrosoft365	Microsoft 365 Apps release data. Anonymous GET, no device data sent.
clients.config.office.net	$CollectMicrosoft365	Microsoft 365 Apps channel release list. Anonymous GET, no device data sent.
Windows Update or your WSUS server	$CollectDriverInventory and $MatchDrivers	Optional driver search through the Windows Update Agent.
apigtwb2c.us.dell.com	$CollectWarranty, Dell devices	Warranty lookup. Sends the device serial number.
warranty.api.hp.com	$CollectWarranty, HP devices	Warranty lookup. Sends the device serial number.
supportapi.lenovo.com	$CollectWarranty, Lenovo devices	Warranty lookup. Sends the device serial number.
api.getac.us	$CollectWarranty, Getac devices	Warranty lookup. Sends the device serial number.

Files Written on the Device

Path	When	Contents
C:\Windows\Logs\Enhanced_Intune_Inventory_<timestamp>.log	Always	CMTrace-format run log. Includes the computer name, signed-in user, counts, and upload results. Older copies are deleted at the start of each run.
C:\Windows\Logs\Inventory_Script_<timestamp>.log	$Transcribe is $true	Full PowerShell transcript. Older copies are deleted at the start of each run.
C:\Windows\Warranty_<serial>.json	$CollectWarranty	Cached warranty result.
C:\Windows\Temp\HPWarranty_Raw_<serial>.json	$CollectWarranty, HP devices	Raw HP API response for troubleshooting.

View the Raw Data in Log Analytics

To inspect exactly what a device sent, decode the chunk columns in the Log Analytics Logs blade. This example decodes the most recent device inventory record for one computer:

PowerStacksDeviceInventory_CL
| where ComputerName_s == "PC-NAME"
| top 1 by TimeGenerated desc
| extend Encoded = strcat(DeviceDetails1_s, DeviceDetails2_s, DeviceDetails3_s, DeviceDetails4_s, DeviceDetails5_s,
                          DeviceDetails6_s, DeviceDetails7_s, DeviceDetails8_s, DeviceDetails9_s, DeviceDetails10_s)
| extend Inventory = parse_json(gzip_decompress_from_base64_string(Encoded))
| project TimeGenerated, ComputerName_s, ManagedDeviceID_g, Inventory

Replace the table and column names to decode application inventory (PowerStacksAppInventory_CL, InstalledApps1_s through InstalledApps10_s) or driver inventory (PowerStacksDriverInventory_CL, ListedDrivers1_s through ListedDrivers10_s).

macOS

The macOS script collects a smaller set: device hardware and installed applications. It doesn’t collect drivers, Microsoft 365 release data, or warranty data. See the macOS data reference.