Get started · DoctorDO is in preview
Three ways to run DoctorDO, from one device to the whole estate.
DoctorDO shows where each Windows device managed with Microsoft Intune got its updates and Win32 apps through Delivery Optimization, and why it didn’t get more from peers or Microsoft Connected Cache. Run it as the full solution in your own Azure subscription, as a PowerShell module on one device, or from an Intune remediation with no Azure at all.
DoctorDO is in preview. The first public release is coming. All three arrive with it: the collector module isn’t on the PowerShell Gallery yet, and the repository is private during the preview and will be public.
- The full solution, in your AzureEvery managed device reports every day into the portal in your own subscription.Azure: yes
- One device, with PowerShellRun one command on a device and get its report as a single HTML file. Nothing leaves it.Azure: no
- Through Intune, with Collect diagnosticsA remediation writes the report into the Intune logs folder, and Collect diagnostics brings it back.Azure: no
1 · The full solution
Every device, every site, in your own Azure subscription.
The portal, the ingest functions, the processor and the database run in your subscription. An Intune remediation installs the collector on each device and runs it every day, and every report is signed by the device and stored only in your Azure.
- Who it’s for
- Intune administrators and network teams who want the whole estate: every site against a goal, the trend after each policy change, and the Intune fix for each finding.
- What you get
- The portal, signed in with Microsoft Entra ID: the overview, the estate map, every site and device, recommendations with settings catalog files to import, network design, and reporting. It keeps the history, so a change shows on the trend. Explore the Overview in the demo.
- What it costs
- DoctorDO is free to use; you pay only for the Azure resources it runs on. At the demo’s size, 46,000 devices reporting daily, that is less than a cent per device a month, about $0.08 a device a year. Work out your own on the costs page.
What it needs
- An Azure subscription in the same tenant as your devices, and Owner on it, or Contributor with User Access Administrator.
- Application Administrator or Cloud Application Administrator in Microsoft Entra ID, and Privileged Role Administrator to grant the read-only Microsoft Graph permissions.
- Windows devices that are Microsoft Entra joined or hybrid joined, and enrolled in Intune.
- Rights in Intune to create a remediation, which installs, checks, and runs the collector.
- The collector runs from an Intune remediation, and Remediations need the devices’ users to have a Windows Enterprise E3 or E5, Windows Education A3 or A5, or Windows VDA licence (included in Microsoft 365 F3, E3, E5, A3, and A5).
- PowerShell 7.2 or later, the Azure CLI, Node.js 22 or later, and pnpm 9 on the machine that runs the deployment scripts.
The steps
- Deploy to Azure. One script deploys the template into your subscription: the Static Web App for the portal, Function Apps for ingest, the processor and the portal’s API, a Service Bus queue, storage, PostgreSQL, a key vault, and monitoring.
- Connect your tenant. A second script sets up sign-in for your tenant, grants the read-only Microsoft Graph permissions, and makes you the first DoctorDO administrator.
- Roll out the collector. Add the two remediation scripts to Intune and assign them to your devices. Each day the remediation installs or checks the module, then runs it as SYSTEM, and the device sends its signed report to your ingest endpoint.
- Review, act, and measure. Sign in to the portal, import the Intune policy a finding exports, assign it, and watch the trend.
Tested in a lab and on the author’s own devices. Run by hand there, the collector has sent signed reports to a deployment in the author’s lab tenant; running it from the Intune remediation, and signing as SYSTEM, are still being tested.
2 · One device, with PowerShell
One command, one report, and nothing leaves the device.
New-DoctorDODeviceReport collects once and writes a single HTML file: the portal’s device page for this device, with the same analysis the portal runs. No Azure, no deployment, and no upload.
- Who it’s for
- An administrator looking at one device that won’t peer, a support ticket that needs evidence, or anyone who wants to see what DoctorDO finds before deploying anything.
- What you get
- Delivery Optimization health, network health and its topology, the data flow by source, download sources, and configuration, with what was not collected and why. Open it in Microsoft Edge or Google Chrome, offline: the page makes no network requests.
- What it needs
- A Windows device and PowerShell 5.1 or 7. Run it from an elevated prompt: without elevation the Delivery Optimization logs and some settings can’t be read, and the report lists what is missing. There is nothing to pay and no Azure.
The steps
The module isn’t on the PowerShell Gallery yet; it arrives with the first public release. Then it is these commands:
# From an elevated PowerShell prompt (Windows PowerShell 5.1 or PowerShell 7)
Install-Module -Name DoctorDO.Collector -Scope CurrentUser
# A report of this device, written to your temp folder and opened in your browser
New-DoctorDODeviceReport
# One to share: no host name or device IDs, as a page and a PDF
New-DoctorDODeviceReport -OutputPath C:\Temp -Anonymise -Format Html,PdfThe options
-OutputPath- The folder to write to, created if it doesn’t exist. Default: your temp folder.
-Format- Html (the default), Pdf, Json, or Both (Html and Json), or several, as Html,Pdf. The PDF is printed by Microsoft Edge, or Chrome, on the device; nothing is downloaded for it.
-Anonymise- A report to share: no host name, no Microsoft Entra, tenant, or Intune device IDs, and hashes that can’t be matched to your fleet.
-FileName- A fixed name, without a folder or an extension, in place of the host name and time. Each run replaces the files of that name.
-NoOpen- Leaves the report closed. It opens by itself only when a person is at the session, never as SYSTEM or from an Intune script.
-SkipConnectivityChecks- No endpoint probes; the report shows those checks as not collected.
The command is read-only. It changes no setting, doesn’t stop the Delivery Optimization service, writes one file per format, and uploads nothing. Without -Anonymise the report names the device, so treat it like any other device log.
3 · Through Intune, with no Azure
A remediation writes the report. Collect diagnostics brings it back.
Intune’s Collect diagnostics action gathers every file in the Intune Management Extension’s logs folder, C:\ProgramData\Microsoft\IntuneManagementExtension\Logs, into the zip you download from the Intune admin center.1 Write the device report there from a remediation, and it comes back with the device’s other logs.
- The remediation runs as SYSTEM on the device and writes
DoctorDO-DeviceReport.htmlinto the logs folder. - In the Intune admin center, the device’s Collect diagnostics action asks it for its logs.
- The device uploads the zip; Monitor > Device diagnostics shows it, ready to download.
- Open the zip, find the report in the Intune Management Extension logs, and open it in Edge or Chrome.
- Who it’s for
- A helpdesk that needs one remote device’s report without asking the user to run anything, or an estate that wants reports from a few devices before deciding on Azure.
- What you get
- The same report as the PowerShell way, from devices you can’t reach by hand, one zip per device. There is no portal, no history, and no estate view: that is the full solution.
- What it needs
- Devices that are Microsoft Entra joined or hybrid joined, enrolled in Intune, on Windows Enterprise, Professional, or Education,2 and corporate-owned for Collect diagnostics.1 The collector runs from an Intune remediation, and Remediations need the devices’ users to have a Windows Enterprise E3 or E5, Windows Education A3 or A5, or Windows VDA licence (included in Microsoft 365 F3, E3, E5, A3, and A5).
The steps
- In the Intune admin center, go to Devices > Manage devices > Scripts and remediations, create a script package, and upload the two scripts below.2
- Set Run this script using the logged-on credentials to No, so it runs in the system context;3 Run script in 64-bit PowerShell to Yes, as DoctorDO’s own remediation does; and Enforce script signature check to No, unless you sign the scripts.
- Assign it to a device group with a schedule of Once, Hourly, or Daily, or run it on one device with the Run remediation (preview) device action.2
- Once it has run, open the device under Devices > All devices, select Collect diagnostics, and confirm with Collect data.1
- Under Monitor > Device diagnostics, when the action has completed, select … > Download in its row. The zip goes to your browser’s downloads.1
The permissions and limits
- Creating the remediation takes permissions under the Device configurations category; running it on demand takes Run remediation, under Remote tasks.2
- Collect diagnostics takes the Help Desk Operator or School Administrator role, or a custom role with Remote tasks/Collect diagnostics and read access to managed devices.1
- It is on by default, under Tenant administration > Device diagnostics, for Windows 10, version 1909 and later, and Windows 11. The device must be online.1
- Each device keeps up to 10 collections, for 28 days. The bulk action collects from up to 25 devices at a time.1
- A remediation’s output is limited to 2,048 characters,2 so the script reports one line and the report itself goes to the folder.
# Detect-DoctorDOReport.ps1: is there a DoctorDO report from the last 24 hours?
$report = Join-Path $env:ProgramData 'Microsoft\IntuneManagementExtension\Logs\DoctorDO-DeviceReport.html'
$file = Get-Item -LiteralPath $report -ErrorAction SilentlyContinue
if ($file -and $file.LastWriteTime -gt (Get-Date).AddHours(-24)) { Write-Output "Report present: $($file.LastWriteTime)"; exit 0 }
Write-Output 'No DoctorDO report from the last 24 hours'
exit 1# Remediate-DoctorDOReport.ps1: write a fresh report where Collect diagnostics looks.
# Runs as SYSTEM. The report is never opened here (-NoOpen says so plainly).
$ErrorActionPreference = 'Stop'
$logs = Join-Path $env:ProgramData 'Microsoft\IntuneManagementExtension\Logs'
try {
# -FileName needs version 0.7.0 or later.
if (-not (Get-Module -ListAvailable -Name DoctorDO.Collector | Where-Object { $_.Version -ge [version]'0.7.0' })) {
# Once the module is on the PowerShell Gallery; or deploy it as a Win32 app instead.
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force | Out-Null
Install-Module -Name DoctorDO.Collector -MinimumVersion 0.7.0 -Scope AllUsers -Force
}
Import-Module -Name DoctorDO.Collector -MinimumVersion 0.7.0
# One fixed name, so each run replaces the last report and the folder keeps one.
$r = New-DoctorDODeviceReport -OutputPath $logs -FileName 'DoctorDO-DeviceReport' -Format Html -NoOpen
Write-Output ('Report written: {0} ({1:N0} KB)' -f (Split-Path -Path $r.Path -Leaf), ($r.Bytes / 1KB))
exit 0
} catch {
Write-Output "DoctorDO report failed: $($_.Exception.Message)"
exit 1
}The detection script asks for a new report once a day; the remediation script gives the report one fixed name, so each run replaces the last and the folder keeps one. Microsoft’s page states no size limit for this folder; a report is about a megabyte. Run as SYSTEM, the report is never opened on the device, and nobody at it sees anything.
Where the report goes. Unlike the PowerShell way, the report leaves the device, into Intune’s diagnostics. Microsoft says diagnostics might include user or device names, and that its personnel might access them to help resolve incidents.1 Add -Anonymise to the command if the report shouldn’t name the device. Installing the module from the remediation, as SYSTEM, hasn’t been run on a real device yet.
Intune facts checked against Microsoft Learn on 19 October 2026.
Whichever way you choose
The collector reads what Windows already records and changes no Delivery Optimization, firewall, proxy, or service setting. DoctorDO is an independent community project; it isn’t produced by, affiliated with, or endorsed by Microsoft (the independence statement says more).
All 3 Microsoft pages cited on this page
- 1Device action: collect diagnostics (opens in a new tab)learn.microsoft.com/intune/device-management/actions/collect-diagnostics
- 2Remediations (opens in a new tab)learn.microsoft.com/intune/device-management/tools/deploy-remediations
- 3Use PowerShell scripts on Windows devices in Intune (opens in a new tab)learn.microsoft.com/intune/device-management/tools/run-powershell-scripts-windows#create-a-script-policy-and-assign-it
Not ready to run it? See it first.
This portal runs every page on ContosoAI, a fictitious company with 46,000 devices, at 41 sites in 16 countries and working remotely. Its figures are modelled, not computed from collector reports.