KQL Search

Query Details

HomeAI ToolsDevice Query

Audit Show Remote Locked Devices

Query

// Show devices that have been remote locked and who initiated that.
IntuneAuditLogs
| where OperationName has "remoteLock"
| extend User = todynamic(Properties).Actor.UPN
| extend IntuneDeviceID = todynamic(Properties).TargetObjectIds[0]
| project TimeGenerated, IntuneDeviceID, User
| sort by TimeGenerated desc

Explanation

This query is used to display a list of devices that have been locked remotely. It also shows who initiated the remote lock. The results are sorted by the time the action was generated, with the most recent actions shown first.

Details

Ugur Koc profile picture

Ugur Koc

Released: July 24, 2022

Tables

IntuneAuditLogs

Keywords

IntuneAuditLogs,OperationName,RemoteLock,Properties,Actor,UPN,TargetObjectIds,TimeGenerated,IntuneDeviceID,User

Operators

IntuneAuditLogswherehasextendtodynamicprojectsort bydesc

Actions