Endpoint Analytics Device Timeline Audits

Question

Hi all

One of our users says their laptop slows down badly every day around 2 PM, but when the helpdesk connects, Task Manager doesn’t show anything unusual. How can we use the Device Timeline tab in Intune Endpoint Analytics to look back at historical CPU spikes and driver crashes ?

Answer 1

Hello,

The Device Timeline tab in Intune Endpoint Analytics is exactly what you need in this case because it provides historical telemetry at the device level, not just the live snapshot you see in Task Manager. When you open Endpoint Analytics for the affected laptop, navigate to the Device Timeline view. There you can scroll back to the specific date and time window, in your case around 2 PM, and review metrics such as CPU utilization, memory pressure, disk I/O, and driver reliability events.

The timeline aggregates data collected by the Intune management extension and Windows telemetry, so you can see if there was a CPU spike caused by a background process, a scheduled task, or even a driver crash that didn’t leave obvious traces in Task Manager when the helpdesk connected later. For example, if a driver reset occurred, you’ll see it logged under “Device Reliability Events” in the timeline, with the exact timestamp and the driver name. Similarly, if a process consumed CPU heavily for a short burst, the timeline will show the spike graphically even though it had subsided by the time someone checked manually.

This feature is particularly useful for diagnosing intermittent performance issues because it gives you retrospective visibility. Once you confirm the pattern, you can correlate the spike with scheduled tasks in Task Scheduler, Windows Update activity, or third-party agents. If necessary, you can export the timeline data for further analysis.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.