How to Collect Windows Registry Data Using Intune (Properties Catalog)

The Shift to Native Registry Inventory in Microsoft Intune

For years, endpoint administrators managing Windows through Microsoft Intune faced a common challenge: how do you collect custom registry keys without building custom infrastructure?

Previously, auditing a registry value required complex workarounds:

• Packaging a PowerShell script inside a Win32 .intunewin file.
• Deploying Proactive Remediations (requiring an Intune Suite or Windows Enterprise E3/E5 license).
• Setting up third-party telemetry tools or custom Azure Log Analytics ingestion pipelines.

With the native Windows Registry Data collector inside the Properties catalog, Microsoft solved this problem. You can now define explicit HKLM registry paths directly in the Intune admin console. The native device agent collects the values on a regular schedule and reports them in the Intune Device Inventory pane.

Architecture Flow: How It Operates Under the Hood

Understanding how the collection pipeline works helps prevent configuration errors and clarifies why data does not appear immediately.

The collection process runs in four steps:

1. Policy Definition & Push: The administrator creates a Properties Catalog policy. The policy containing target registry paths and collection patterns is delivered to the endpoint during standard MDM sync.
2. Execution via Dedicated Agent: The query is executed by the Microsoft Device Inventory Agent running as the InventoryService Windows service, not the legacy Intune Management Extension PowerShell engine.
3. Local Staging & Delta Evaluation: The agent queries the requested HKLM keys, stores the data in an encrypted local SQLite database (InventoryData.db), checks against the 6 KB limit, and compares findings to past scans.
4. Data Ingestion: When changes are detected, the agent uploads the delta to Intune. The Intune backend processes the payload and displays it under the Device Inventory tab.

Rules, Limits, and Prerequisites

Before configuring registry collection profiles, keep these operational limits in mind:

The Three Registry Collection Patterns Explained

When you add a registry key in Intune, you get three collection patterns to choose from:

Here is what each collection pattern does and when to select it:

1. Single value: Specify a registry path and value name to collect one specific value from that path.
   • Best for: Checking a specific application version (e.g. SOFTWARE\Google\Chrome\BLBeacon > version) or an individual security flag.
2. All values under key: Specify a registry path to collect all values directly under that path. This pattern is non-recursive and does not include subkeys.
   • Best for: Auditing configuration keys like SYSTEM\CurrentControlSet\Control\Lsa where multiple values reside in one place.
3. Same value across subkeys: Specify a base registry key path and a value name to collect that value from each immediate subkey.
   • Best for: Querying installed software lists under the Uninstall hive (e.g. extracting DisplayVersion or DisplayName across every installed app).

Step-by-Step: Creating a Registry Collection Policy in Intune

Follow these steps to configure a registry collection policy using the Windows Uninstall registry hive as our practical example:

Step 1: Create a New Properties Catalog Profile

Sign in to the Microsoft Intune admin center. Go to Devices > Windows > Configuration (under Manage devices). Click + Create > New Policy.

• Platform: Select Windows 10 and later.
• Profile type: Select Properties catalog.

Step 2: Enter Profile Basics

On the Basics tab, enter a clear policy name and description:

• Name: Win-Registry-Inventory-CoreBaselines
• Description: Collects installed application inventory via the Uninstall registry hive.

Click Next.

Step 3: Add Registry Properties

On the Configuration properties tab, click + Add properties to open the Properties picker on the right.

1. Locate and expand Registry.
2. Check the box for Registry key.
3. Verify that Registry key appears under Selected properties (1) on the right panel.
4. Close the Properties picker flyout.

Step 4: Specify Registry Key Path and Collection Pattern

Under the Registry category, click + Add to enter your registry details. Take note of how the portal handles the path:

• Registry key path: Specify the HKEY_LOCAL_MACHINE path. The HKEY_LOCAL_MACHINE\ prefix is populated automatically in the console, so you only enter the subpath after the prefix.
• Collection pattern: Select one of the three patterns (Single value, All values under key, or Same value across subkeys).
• Value name: Enter the value name (only required if you selected Single value or Same value across subkeys).

Step 5: Querying the Uninstall Hive

To inventory installed software across all machines, enter the Uninstall registry hive path:

HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

• Registry key path: Enter SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
• Collection pattern: Select All values under key (which auto-populates the Value name with *) or Same value across subkeys with a value name like DisplayName or DisplayVersion.

Step 6: Scope Tags, Assignments, and Policy Creation

1. Click Next. On the Scope tags tab, you do not need to specify anything. Leave it as Default and click Next.
2. On the Assignments tab, click + Add groups and select the target Entra ID device group where you want to deploy the policy.
   
   Note: Always assign registry collection profiles to device groups since HKLM settings apply to the machine level.
3. Click Next, review your settings on the Review + create tab, and click Create.

Where to View Collected Registry Data in Intune

Once assigned endpoints complete their scheduled scan and upload the payload, you can review the collected inventory in the admin portal.

To view the data:

1. Go to Devices > Windows and select your device.
2. Under Tools, click Device inventory.
3. Select the Registry tab in the left sub-navigation.
4. You will see the collected registry inventory with Registry key path, Value name, Value data, Value type (e.g. REG_SZ, REG_DWORD), and collection Status (Success).

Client-Side Mechanics and Troubleshooting

When an expected registry value does not appear in Intune, troubleshooting requires checking the client-side execution logs.

The Dedicated Device Inventory Agent

Properties catalog collection is handled by a dedicated agent rather than the Intune Management Extension:

• Service Name: InventoryService (Microsoft Device Inventory Agent)
• Account: Runs as NT AUTHORITY\SYSTEM
• Binary Location: C:\Program Files\Microsoft Device Inventory Agent\
• Local Cache: InventoryData.db (SQLite database)
• Log Path: C:\Program Files\Microsoft Device Inventory Agent\Logs\InventoryAgent.log

Reading the Diagnostic Log

Open InventoryAgent.log using CMTrace. Look for these key events during a collection cycle:

• Initiating scheduled registry inventory task: The local scan has started.
• Loading Properties Catalog policy GUID: The policy was parsed from Intune MDM.
• Evaluating HKLM\...: The target registry path being inspected.
• Delta comparison: Changes detected: Confirms whether values changed since the last scan.
• Payload encrypted and uploaded successfully: Confirms the upload to Intune cloud completed.

Frequently Asked Questions (FAQ)

Can I collect keys from HKEY_CURRENT_USER (HKCU)?

No. The Microsoft Device Inventory Agent runs in the NT AUTHORITY\SYSTEM background context without access to individual interactive user sessions. If you need user-level registry data, deploy a remediation script set to run in the user context.

How often does Intune collect and update registry data?

Data collection runs once every 24 hours. The agent checks for changes against the local SQLite database and uploads only the updated deltas.

What happens if a requested registry key does not exist on the client?

The agent logs the key as not found in its local cycle. It does not generate an error status or mark the policy as failed in Intune.

Does this feature require Microsoft Intune Suite or Intune Plan 2?

No. The Properties Catalog and native Windows Registry data collection are standard capabilities included with Microsoft Intune Plan 1.

Conclusion

The Properties Catalog simplifies Windows Registry collection in Microsoft Intune by replacing custom PowerShell packages with a lightweight native agent. It provides clean configuration auditing while minimizing device overhead.

For more technical Intune guides and PowerShell automation playbooks, visit TechEUC.com. If you need enterprise endpoint consulting or custom deployment support, get in touch via our Contact Page.