MECM - Appoach to Logging in Detection Scripts

Question

I'm starting to work with SCCM/MECM and creating a lot of powershell detection scripts for application deployments. Most I write are simple and need no logging but some are complex. I of course test them before deploying to MECM but sometimes I need debug them running in the actual MECM client. As such, I need some method of logging from the scripts. My understanding is that if I write to STDOUT/STDERR in a detection script this directly impacts the outcome of detection as per this article https://learn.microsoft.com/en-us/mem/configmgr/apps/deploy-use/create-applications#bkmk_dt-detect. If I write to verbose/debug streams in powershell they also end up in stdout unless I re-direct to a file (which is an option).

Is anyone doing something in this respect? My thoughts:

• transcript logging in powershell
• re-direct another stream to file and write to that
• writeto windows event logs

Answer 1

Start- and stop-Transcript works great, but as a personal preference, (this is just personal preference), I prefer to 'know exactly where the log file will be, and what it will be called'.

With that in mind, in the script within this: https://tcsmug.org/blogs/sherry-kissinger/568-cm-all-members-of-all-local-groups-powershell is an example of writing a log file, in cmtrace format, to a specific folder and logfile name of your choice; the example(s) with the script is either to %temp%, or "wherever the CM client drops it's logs".

Answer 2

Hi,

You're correct that writing to STDOUT/STDERR can affect the detection outcome.

As your mentioned, you can use transcript for logging without impacting the detection results:

• You can use Start-Transcript and Stop-Transcript to log the output of your script to a file. This method captures all output, including verbose and debug messages.

Start-Transcript -Path "C:\Path\To\LogFile.txt"
# Your script here
Stop-Transcript