Audit Show Remote Locked Devices
Query
// Show devices that have been remote locked and who initiated that.
IntuneAuditLogs
| where OperationName has "remoteLock"
| extend User = todynamic(Properties).Actor.UPN
| extend IntuneDeviceID = todynamic(Properties).TargetObjectIds[0]
| project TimeGenerated, IntuneDeviceID, User
| sort by TimeGenerated descExplanation
This query is used to display a list of devices that have been locked remotely. It also shows who initiated the remote lock. The results are sorted by the time the action was generated, with the most recent actions shown first.
Details
Ugur Koc
Released: July 24, 2022
Tables
IntuneAuditLogs
Keywords
IntuneAuditLogsOperationNameRemoteLockPropertiesActorUPNTargetObjectIdsTimeGeneratedIntuneDeviceIDUser
Operators
IntuneAuditLogswherehasextendtodynamicprojectsort bydesc