KQL Search

Query Details

HomeAI ToolsDevice Query

Operational OS Build During Autopilot

Query

// Show the OS Build of Windows during Autopilot. Result also shows DeviceName for analyzing any future update or upgrade events.
IntuneOperationalLogs
| extend DeviceId = tostring(todynamic(Properties).DeviceId)
| extend Version = todynamic(Properties).Version
| where isnotempty(Version)
| join kind=leftouter IntuneDevices on DeviceId 
| summarize arg_max(TimeGenerated, *) by DeviceName
| project DeviceName, ['OS Build during Autopilot'] = Version

Explanation

This query is used to display the operating system (OS) build version of Windows devices during the Autopilot process. It also provides the device name for each device. This information can be useful for tracking and analyzing any future updates or upgrades that may occur on these devices. The query first extracts the device ID and version from the operational logs, then filters out any records without a version. It then joins this data with the device information, and summarizes the most recent record for each device. Finally, it displays the device name and the OS build version during Autopilot.

Details

Ugur Koc profile picture

Ugur Koc

Released: August 10, 2022

Tables

IntuneOperationalLogsIntuneDevices

Keywords

IntuneOperationalLogs,DeviceId,Properties,Version,TimeGenerated,DeviceName,OSBuildduringAutopilot

Operators

extendtostringtodynamicPropertiesDeviceIdVersionisnotemptyjoinkindleftouterIntuneDevicesDeviceIdsummarizearg_maxTimeGenerated*byDeviceNameprojectDeviceNameOS Build during AutopilotVersion.

Actions