Monitor connection health
Use the Connection Health dashboard in Configuration Manager to drill down into categories by device health. In the Configuration Manager console, go to the Software Library workspace, expand the Desktop Analytics Servicing node, and select the Connection Health dashboard.
When you first set up Desktop Analytics, these charts may not show complete data. It can take 2-3 days for active devices to send diagnostic data to the Desktop Analytics service, the service to process the data, and then synchronize with your Configuration Manager site.
Connection details
This tile displays the following basic information about the connection from Configuration Manager to Desktop Analytics:
Tenant Name: The name of the Desktop Analytics connection in the Azure Services node
Target Collection: The same target collection you specified when connecting Configuration Manager to Desktop Analytics. This collection includes all devices that Configuration Manager configures with your commercial ID and diagnostic data settings. It's the full set of devices that Configuration Manager connects to the Desktop Analytics service.
Devices Targeted: All of the devices in the target collection, minus the following types of devices:
Decommissioned
Obsolete
Inactive
Unmanaged
Devices running Long Term Servicing Channel (LTSC) versions of Windows 10
Devices running Windows Server
For more information on these device states, see About client status.
Note
Configuration Manager uploads to Desktop Analytics all of the devices in the target collection minus decommissioned and obsolete clients.
Devices eligible for DA: The number of devices targeted minus devices that are ineligible for Desktop Analytics. For example, devices in the target collection that run Windows Server or Windows 10 long-term servicing channel (LTSC).
Last sync details
This tile shows when Configuration Manager syncs with the Desktop Analytics cloud service, and how many devices it syncs.
Devices synced: The number of eligible devices that Configuration Manager sent to Desktop Analytics. The service includes these devices in the currently visible snapshot.
Last service sync: The same as the Last updated time in the Desktop Analytics portal.
Next service sync: When you can expect the next daily snapshot in Desktop Analytics.
Note
When you first enroll devices into Desktop Analytics, it can take several days for data to upload and process. During this time, the Last sync details tile may appear blank. Additionally, none of the values in this tile automatically update when you request an on-demand snapshot. For more information, see Data latency.
If you think some devices aren't showing in Desktop Analytics, make sure the devices are supported by Desktop Analytics. For more information, see Prerequisites.
Connection health
The Connection health chart displays the number of devices in the following health states:
- Properly enrolled: The device appears in Desktop Analytics with a complete inventory
- Unable to enroll: There's a blocking issue that prevents device enrollment
- Configuration alert: The device doesn't appear in Desktop Analytics or appears with an incomplete inventory. Configuration Manager also identified an issue with device enrollment.
- Awaiting enrollment: Configuration Manager configured the device, but it doesn't yet appear in Desktop Analytics
- Status pending: Configuration Manager is still configuring this device, or doesn't have enough data from the device to determine its state
- Missing data: Configuration Manager configured the device, but Desktop Analytics only has partial data
The total number of devices in this chart should be the same as the Devices eligible for DA value in the Connection Details tile.
Select the slice in the chart to drill down to a list of devices with that state. For more information, see Device list.
Select the category name in the legend to remove or add it from the chart. This action helps to zoom the chart so you can see the relative sizes of smaller segments.
Properly enrolled
The device has the following attributes:
- A supported version of the Configuration Manager client
- There are no configuration errors
- Desktop Analytics received complete diagnostic data from this device in the past 28 days
- Desktop Analytics has a complete inventory of the device's configuration and installed apps
Unable to enroll
Configuration Manager detects one or more blocking issues that prevent device enrollment. For more information, see the list of Desktop Analytics device properties in Configuration Manager.
For example, the Configuration Manager client isn't a supported version. Update the client to the latest version. Consider enabling automatic client upgrade for the Configuration Manager site. For more information, see Upgrade clients.
You can more easily identify client proxy configuration issues in two areas:
Endpoint connectivity checks: If clients can't reach a required endpoint, you see a configuration alert in the dashboard. Drill down into clients that are unable to enroll to see the endpoints to which clients can't connect due to proxy configuration issues. For more information, see Endpoint connectivity checks.
Connectivity status: If your clients use a proxy server to access Desktop Analytics, Configuration Manager displays proxy authentication issues from clients. Drill down to see clients that are unable to enroll due to proxy authentication issues. For more information, see Connectivity status.
Configuration alert
The device doesn't appear in Desktop Analytics or appears with an incomplete inventory. Configuration Manager also identified an issue with device enrollment. For more information, see the list of Desktop Analytics device properties in Configuration Manager.
For example, the device doesn't have connectivity to the service. For more information, see Windows diagnostic endpoint connectivity.
Awaiting enrollment
Desktop Analytics doesn't have diagnostic data for this device. This issue can be because you recently added the device to the target collection and it hasn't yet sent data. It can also mean the device isn't properly communicating with the service, and the latest diagnostic data is more than 28 days old.
Make sure the device can communicate with the service. For more information, see Endpoints.
Status pending
Configuration Manager is still configuring this device, or doesn't have enough data from the device to determine its state.
Missing data
Configuration Manager successfully configured the device, but Desktop Analytics can't create a compatibility assessment. It doesn't have a complete data set for the device's configuration (census) or installed apps (inventory).
This issue is often fixed automatically when the device retries. If it persists, make sure the device can communicate with the service. For more information, see Endpoints.
Device list
To see a specific list of devices by status, start with the Connection Health dashboard. Select one of the segments of the Connection health tile and drill down to a list of devices in this state. This custom device view displays the following Desktop Analytics columns by default:
- Commercial ID configuration
- Minimum compatibility update
- Windows diagnostic data opt-in
- Windows commercial data opt-in
- Windows diagnostic endpoint connectivity
- Connectivity status
- Endpoint connectivity checks
These columns correspond to the key prerequisites for devices to communicate with Desktop Analytics.
Select a device to see the full list of available properties in the detail pane. You can also add any of these properties as columns to the device list.
Device properties
The following Desktop Analytics device properties are available as columns in the Configuration Manager device list:
- Endpoint connectivity checks
- Connectivity status
- Appraiser configuration
- Minimum compatibility update
- Appraiser version
- Last successful full run of Appraiser
- Appraiser data collection
- Last successful full run of Census
- Census data collection
- Windows diagnostic endpoint connectivity
- Check end-user diagnostic data
- Check user proxy
- Commercial ID configuration
- Windows commercial data opt-in
- Check device name in diagnostic data
- DiagTrack service configuration
- DiagTrack version
- SQM ID retrieval
- Unique device identifier retrieval
- Windows diagnostic data opt-in
The Most frequent enrollment blockers and configuration alerts tile of the Connection Health dashboard displays the properties that devices most often report as an issue.
Endpoint connectivity checks
To detect proxy authentication issues, clients perform connectivity checks against required endpoints. If a client can't reach a required endpoint, this property shows a numbered list of endpoints to which it can't connect due to proxy configuration issues. Compare this list with the published list of required endpoints.
Connectivity status
If your clients use a proxy server to access Desktop Analytics, this property shows proxy authentication issues. It includes the following details related to proxy authentication:
- Status code
- Return code
You'll see errors similar to the following in the log file:
Error 407: Can't connect to Microsoft %s. Check your network/proxy settings
Where %s
is the URL of a required endpoint.
You may also see non-deterministic error messages that don't need attention until devices have enrollment issues. For example:
This status is not related to proxy configuration, consider to investigate only if you are experiencing device enrollment or configuration alert issues.
For more information on configuring proxy servers for use with Desktop Analytics, see Proxy server authentication.
Appraiser configuration
Appraiser is the Windows component that corresponds to the compatibility updates. It assesses the apps and drivers on the device for compatibility with the latest version of Windows.
If this check is successful, then the appraiser component is properly configured on the device.
Otherwise, it might display one of the following errors:
Can't configure device app compatibility data collection (SetRequestAllAppraiserVersions). Check the logs for the exception details
Can't configure device app compatibility data collection (SetRequestAllAppraiserVersions). Check the logs for the exception details
Can't write the RequestAllAppraiserVersions to registry key
HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Appraiser
. Check permissions
Check the permissions on this registry key. Make sure that the local System account can access this key for the Configuration Manager client to set.
For more information, review M365AHandler.log on the client.
Minimum compatibility update
The compatibility update (appraiser.dll) isn't installed or out of date on the device. It's older than the minimum requirement for Desktop Analytics, 10.0.17673.
Install the latest compatibility update. For more information, see Compatibility updates.
Appraiser version
This property displays the current version of the Appraiser component on the device. It shows the file version on %windir%\System32\appraiser.dll
, without the decimal points. For example, file version 10.0.17673 displays as 10017673.
Last successful full run of Appraiser
This property displays the date and time that the device last successfully ran Appraiser.
Appraiser data collection
This property shows the latest result from Windows running the appraiser component.
If not successful, it might show one of the following errors:
Can't collect app compatibility data (RunAppraiser). Check the logs for details
App compatibility data collection (CompatTelRunner.exe) ended with an error code
For more information, review M365AHandler.log on the client.
Check for the following file: %windir%\System32\CompatTelRunner.exe
. If it doesn't exist, reinstall the required compatibility updates. Make sure no other system component is removing this file, such as group policy or an antimalware service.
If the M365AHandler.log file on the client includes one of the following errors:
RunAppraiser failed. CompatTelRunner.exe exited with last error code: 0x800703F1
RunAppraiser failed. CompatTelRunner.exe exited with last error code: 0x80070005
RunAppraiser failed. CompatTelRunner.exe exited with last error code: 0x80080005
To help remediate these errors, run the following commands from an elevated Windows PowerShell console on the affected client:
# stop associated services
Stop-Service -Name diagtrack #Connected User Experiences and Telemetry
Stop-Service -Name pcasvc #Program Compatibility Assistant Service
Stop-Service -Name dps #Diagnostic Policy Service
# regenerate diagnostic data cache
Remove-Item -Path $Env:WinDir\appcompat\programs\amcache.hve
Remove-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" -Name AmiHivePermissionsCorrect -Force
# set ASL logging level to output log files in %windir%\temp
New-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" -Name LogFlags -Value 4 -PropertyType DWord -Force
# restart services
Start-Service -Name diagtrack
Start-Service -Name pcasvc
Start-Service -Name dps
Last successful full run of Census
This property displays the date and time that the device last successfully ran Census.
Census data collection
Census is the Windows component that inventories the device. This inventory data is used to understand the device and its configuration.
This property shows the latest result from Windows running the census component.
If not successful, it might show one of the following errors:
Can't collect data about the device and its configuration (RunCensus). Check the logs for the exception details
Device and configuration data collection tool (devicecensus.exe) not found
For more information, review M365AHandler.log on the client.
Check for the following file: %windir%\System32\DeviceCensus.exe
. If it doesn't exist, reinstall the required compatibility updates. Make sure no other system component is removing this file, such as group policy or an antimalware service.
Windows diagnostic endpoint connectivity
If this check is successful, then the device can connect to the Connected User Experience and Telemetry endpoint (Vortex).
Otherwise, it may show one of the following errors:
Can't connect to the connected user experience and telemetry endpoint (Vortex). Check your network/proxy settings
Can't check connectivity to the connected user experience and telemetry endpoint (CheckVortexConnectivity). Check the logs for the exception details
Devices verify connectivity with a GET request to the following endpoint based on OS version:
OS version | Endpoint |
---|---|
- Windows 10, version 1809 or later - Windows 10, version 1803 with the 2018-09 cumulative update or later |
https://v10c.events.data.microsoft.com/health/keepalive |
Windows 10, version 1803 without the 2018-09 or later cumulative update | https://v10.events.data.microsoft.com/health/keepalive |
Windows 10, version 1709 or earlier | https://v10.vortex-win.data.microsoft.com/health/keepalive |
Windows 7 or Windows 8.1 | https://vortex-win.data.microsoft.com/health/keepalive |
Make sure the device can communicate with the service. This check validates some but not all of the required endpoints. For more information, see Endpoints.
Also make sure that the signed-in user of the device has a valid license. For more information on the prerequisites, see Desktop Analytics licensing and costs.
For more information, review M365AHandler.log on the client.
Check end-user diagnostic data
If this check isn't successful, a user selected a lower Windows diagnostic data on the device. It can also be caused by a conflicting group policy object. For more information, see Windows settings.
Depending upon your business requirements, you can disable user choice via group policy. Use the setting to Configure telemetry opt-in setting user interface. For more information, see Configure Windows diagnostic data in your organization.
Check user proxy
The DisableEnterpriseAuthProxy setting is enabled by default for Windows 7. For Windows 8.1 computers, Configuration Manager sets the DisableEnterpriseAuthProxy setting to 0 (not disabled).
This property may display the following errors:
Authentication proxy is enabled. Set DisableEnterpriseAuthProxy to 0 in
HKLM:\Software\Policies\Microsoft\Windows\DataCollection
Can't check for the Authentication proxy status. Check the logs for the exception details
For more information, review M365AHandler.log on the client.
Check the permissions on this registry key. Make sure that the local System account can access this key for the Configuration Manager client to set. It can also be caused by a conflicting group policy object. For more information, see Windows settings.
Commercial ID configuration
Microsoft uses a unique commercial ID to map information from devices to your Desktop Analytics workspace. When you integrate Configuration Manager with Desktop Analytics, it automatically queries the service for this ID. Configuration Manager should automatically apply this ID to clients to which you target Desktop Analytics settings.
If this check is successful, then the device is properly configured with a commercial ID.
Otherwise, it may show one of the following errors:
Can't write the CommercialId to registry key
HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection
. Check permissionsCan't update the CommercialId in registry key
HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection
. Check the logs for the exception detailsProvide the correct CommercialId value at
HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection
For more information, review M365AHandler.log on the client.
Check the permissions on this registry key. Make sure that the local System account can access this key for the Configuration Manager client to set. It can also be caused by a conflicting group policy object. For more information, see Windows settings.
There's a different ID for the device. This registry key is used by group policy. It takes precedence over the ID provided by Configuration Manager.
To view the commercial ID in the Desktop Analytics portal, use the following procedure:
Go to the Desktop Analytics portal, and select Connected services in the Global Settings group.
In the Connected services pane, the Enroll devices pane is selected by default. In the Enroll devices pane, the Information section displays your Commercial ID key.
Important
Only use the option to Get new ID key when you can't use the current one. You can't undo the action to regenerate your commercial ID. Until devices receive the new commercial ID, this action results in temporary functionality and data loss for all solutions and devices that have the current commercial ID. If you regenerate the commercial ID, re-enroll your devices with the new ID. If you use Update Compliance, confirm that it has the new commercial ID in the settings page. If necessary, re-enroll devices.
Windows commercial data opt-in
This property is specific to devices running Windows 7 or Windows 8.1. It runs similar tests as Windows diagnostic data opt-in, except for the CommercialDataOptIn value.
Check device name in diagnostic data
If this check is successful, then the device is properly configured to share the device name.
Otherwise, it may show one of the following errors:
Can't check for the device name to be sent to Microsoft as part of the Windows diagnostic data. Check the logs for the exception details
Can't write AllowDeviceNameInTelemetry to registry key
HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection
. Check permissions
For more information, review M365AHandler.log on the client.
Check the permissions on this registry key. Make sure that the local System account can access this key for the Configuration Manager client to set. It can also be caused by a conflicting group policy object. For more information, see Windows settings.
Make sure that another policy mechanism, such as group policy, isn't disabling this setting.
DiagTrack service configuration
If this check is successful, then the DiagTrack component is properly configured on the device. The minimum version required by Desktop Analytics is 10010586 (10.0.10586).
Otherwise, it might display one of the following errors:
Connected User Experience and Telemetry (diagtrack.dll) component is outdated. Check requirements
Can't find the Connected User Experience and telemetry (diagtrack.dll) component. Check requirements
Enable and start the Connected User Experiences and Telemetry service to send data to Microsoft
Install the latest updates. For more information, see Device updates.
Make sure that the Connected User Experiences and Telemetry service on the device is running.
DiagTrack version
This property displays the current version of the Connected User Experience and Telemetry component on the device. It shows the file version on %windir%\System32\diagtrack.dll
, without the decimal points. For example, file version 10.0.10586 displays as 10010586.
SQM ID retrieval
This property is primarily for Windows 7 devices. It may be used by later OS versions as a fallback identifier for the device.
If not successful, it may display the following error:
- Can't retrieve the legacy device telemetry identifier (SQM ID)
For more information, review M365AHandler.log on the client.
Make sure you don't have duplicate IDs in your environment. For example, if devices were deployed with an OS image that wasn't generalized.
Unique device identifier retrieval
Desktop Analytics uses the Microsoft Account service for a more reliable device identity.
Make sure the Microsoft Account Sign-In Assistant service isn't disabled. The startup type should be Manual (Trigger Start).
To disable end-user Microsoft account access, use policy settings instead of blocking this endpoint. For more information, see The Microsoft account in the enterprise.
Windows diagnostic data opt-in
This property checks that Windows is properly configured to allow diagnostic data. It checks the AllowTelemetry value in the following registry keys:
HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection
HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection
Check the permissions on these registry keys. Make sure that the local System account can access these keys for the Configuration Manager client to set. It can also be caused by a conflicting group policy object. For more information, see Windows settings.
For more information, review M365AHandler.log on the client.
Connected Services
On the Desktop Analytics portal, under Connected services in the Global Settings group, the number of Enrolled devices sending data is the sum of Properly enrolled devices and devices Missing data.
Next steps
Feedback
Submit and view feedback for