Collecting Logs from Windows 8.1/10 Devices

There are two methods of collecting logs from Windows 8.1 and Windows 10 devices. 


Method 1:

Click on Start > Run and type the following:


Click OK.  

On Windows 8/8.1, you can start typing Event from the Start Menu and select the View Events Logs item returned from universal search.

Expand Event Viewer (Local) > Windows Logs and select the Application log. You can filter logs by Event IDor Source if desired.

To export for support, click on either Save All Events As… or Save Selected Events… to export the log entries as an *.evtx file, which can be sent to support.


Method 2:

You can also find logs in the following location: C:\Program Files (x86)\AirWatch\AgentUI\Logs

  • AWProcessCommands.log – contains information on installs that utilize the Protection Agent such as encryption and product provisioning.
  • AWLPC.Log – contains information related to the communications between the Protection Agent and AirWatch.
  • NativeEnrollment.log – contains information around the Agent-Based enrollment method.
  • PowershellExecute.log – contains information on PowerShell commands that are run via product provisioning.
  • AwclClient.log – contains information on communications between AWCM client and AirWatch.
  • TaskScheduler.log – contains information on the Task Scheduler’s local enforcement of policies.
  • SSOCommunicationHandler.log – contains information on post enrollment SSO for AirWatch Agent.
  • RMService.log – contains information around the Agent-Based enrollment method.
Have more questions? Submit a request


Article is closed for comments.