SCCM Troubleshooting Tools: Free Options & When to Use Each

Updated 13 November 2026 · Standard formula, shown below

This article covers the free troubleshooting tools built into or commonly used with Microsoft Endpoint Configuration Manager (SCCM), now called Microsoft Endpoint Configuration Manager (MECM). You will learn what each tool does and the specific scenario where it is the right choice, so you can diagnose client, deployment, and site issues faster.

Why Free Tools Matter in SCCM

SCCM is a complex enterprise management platform. When something goes wrong—a client won’t install, a deployment is stuck, or a report shows no data—you need to isolate the cause quickly. Paid third-party tools exist, but Microsoft ships a set of free utilities with the product, and several more are available as free downloads. Knowing which one to launch first saves hours of guesswork and avoids making changes to a production environment without evidence.

Client Center and the Console’s Built-In Actions

The Configuration Manager console itself includes several troubleshooting actions under Devices > Client > Client Operations. These are not separate tools, but they are the first step for many issues:

Load or unload client – restarts the CcmExec service (the core client service). Use when a client is unresponsive or shows an error in the console.
Verify client – forces the client to re-evaluate its assigned site and policy. Use after a client has been moved to a new site or when policy isn’t arriving.
Collect client logs – gathers logs from the client and uploads them to the site server. Use before opening a support case or when you need to analyze logs on a machine you can’t access directly.

These actions are free and require no extra installation. They are the most underused tools because many administrators jump straight to log files, but the console actions can trigger a client to retry a failed operation without a reboot.

Log File Viewer: CMTrace

CMTrace is a lightweight log viewer that ships with the SCCM installation media and is also available as a free standalone download. It reads the .log files that SCCM components write, and it is designed to handle the specific format those logs use—including the hash marks that indicate a thread is still running.

When to use it: Whenever you need to read a client or site server log. CMTrace is not a diagnostic tool by itself; it is the viewer that makes other tools’ output usable. It supports filtering, a search function, and it can decode the binary log format used by some components. Use it instead of Notepad, because Notepad will show the logs as one long line with no color coding or filtering.

Common logs you will open with CMTrace:

Client: PolicyAgent.log, AppEnforce.log, DataTransferService.log, LocationServices.log
Site server: MP_ClientIDManager.log, MP_LocationManager.log, SMS_Executive.log

Policy Spy (PolicySpy.exe)

PolicySpy is a free tool from the Microsoft System Center 2012 Toolkit, and it still works with current versions. It reads the policy assignments that the SCCM client has received and displays them in a readable tree structure.

When to use it: When a client is not applying a setting or deployment that you know was targeted to it. PolicySpy shows the actual policy instances on the client, including the version and the assignment ID. You can see whether the policy arrived at all, whether it is the latest version, and whether the client has evaluated it. If the policy is missing, the problem is upstream—site assignment, boundary groups, or the management point. If the policy is present but not acting, the problem is in the client’s evaluation or the specific component (like the application deployment type).

PolicySpy is not a replacement for the console’s Resource Explorer, which shows hardware and inventory. PolicySpy is specifically for policy, so use it when policy is the suspected culprit.

Software Distribution Monitoring and the Deployment Status Views

For application and software update deployments, the console has built-in monitoring under Monitoring > Deployments. This is not a separate tool, but it is the first place to look when a deployment is not completing.

When to use it: When you need a high-level view of how many machines succeeded, failed, or are in progress. The deployment status shows the compliance state per device, and you can drill into a specific device to see the last status message. This is faster than opening logs for every machine. Use it to identify the pattern: if all failures are on the same subnet, suspect a distribution point issue; if they are random, suspect a client-side problem.

For a deeper look, the Status Message Viewer (under Monitoring > System Status) shows the raw status messages that components generate. Use it when the deployment status shows an error but you need the exact error code and the component that reported it.

Client Spy (ClientSpy.exe)

ClientSpy is another free tool from the System Center Toolkit. It monitors the client’s activity in real time, showing what the client is doing—checking for policy, downloading content, evaluating deployments—and the results of those actions.

When to use it: When you need to see a live view of a client’s behavior. For example, if a client is stuck in a loop or not initiating a download, ClientSpy shows the sequence of operations and the error that occurs. It is more interactive than reading logs after the fact. Use it when you are actively reproducing a problem on a test machine, because it gives you a timeline of events as they happen.

ClientSpy is not as commonly used as PolicySpy, but it is valuable for intermittent issues that only happen during a specific action, like a logon script or a scheduled task.

Content Library Explorer and Distribution Point Troubleshooting

When a client cannot download content, the problem is often on the distribution point. The Content Library Explorer (available in the console under Monitoring > Distribution Point Configuration) lets you browse the content library on a distribution point and see which packages are stored and their version.

When to use it: When a client reports a content download error (like 0x80070002 or 0x87D00607). Open the Content Library Explorer for the specific distribution point and verify that the package is actually there and that the version matches the one in the console. If the content is missing, the distribution point did not receive the update from the site server—check the PrestageContent or DistMgr.log on the site server.

For a more detailed view of the content transfer, use the Distribution Point Configuration status and the PkgXferMgr.log on the site server. The Content Library Explorer is the quickest way to confirm whether the issue is missing content or a client-side download problem.

Free Community Tools: Right Click Tools and More

Beyond Microsoft’s built-in tools, there are free community tools that have become standard in many SCCM environments. The most well-known is the Right Click Tools (formerly from Recast Software, now part of the Microsoft Endpoint Manager ecosystem). It adds a right-click menu to the console with actions like:

Client Center – a quick view of client health, including last policy request, last inventory, and client version.
Wake Up – sends a wake-on-LAN packet to a device.
Run Script – executes a PowerShell script on a remote client.
Log Viewer – launches CMTrace with the client’s logs.

When to use them: These tools are for convenience and speed. They do not replace the built-in tools, but they reduce the number of clicks needed to get the same information. For example, instead of navigating to a device, then to Client Operations, then to Collect Logs, you can right-click and do it in one step. They are especially useful for help desk staff who need to troubleshoot without deep SCCM knowledge.

Another free tool is CMTrace (already mentioned) and ConfigMgr Support Center, which is a newer Microsoft tool that combines log viewing with client diagnostics. Support Center can gather client logs, policy, and certificate information into a single file for analysis. Use it when you need to collect a comprehensive client state for a support case or a complex issue.

How to Choose the Right Tool

The choice of tool depends on the symptom you are seeing:

Client not installing or not reporting – Start with the console’s Client Operations (Load/Unload, Verify). Then check the client’s CcmExec.log and ClientIDManagerStartup.log with CMTrace.
Policy not applying – Use PolicySpy to see if the policy is present on the client. If it is, check the specific component log (like AppEnforce.log for applications).
Deployment stuck or failed – Use the console’s Deployment Status view first, then drill into a device. If the error is content-related, use Content Library Explorer.
Intermittent client issue – Use ClientSpy to monitor live activity, or use Support Center to collect a full client snapshot.
Need to read logs quickly – Always use CMTrace. It is the foundation for all log-based troubleshooting.

A common mistake is to open a log file with Notepad and search for the word “error.” CMTrace has a red error filter and a blue warning filter that highlight the lines you need. Also, remember that logs are written in a circular buffer, so if you are looking for an event that happened hours ago, you may need to increase the log size before reproducing the issue.

Frequently Asked Questions

Is CMTrace still free and where can I get it?

Yes, CMTrace is free. It is included with the Configuration Manager installation media in the SMSSETUP\TOOLS\CMTrace folder. You can also find it as part of the Windows Assessment and Deployment Kit (Windows ADK) when you install the Configuration Manager tools. There is no separate download page from Microsoft, but the file is widely mirrored on tech sites.

Do I need to install anything to use PolicySpy?

PolicySpy is a standalone executable, but it must be run on the client machine you want to inspect. It does not require installation. You can copy the .exe to the client and run it, or run it from a network share. It works on current SCCM versions, though it was originally designed for System Center 2012.

What is the difference between PolicySpy and the console’s Resource Explorer?

Resource Explorer shows inventory data (hardware, software, and compliance) that the client has reported. PolicySpy shows the policy assignments that the client has received from the site. They are complementary: Resource Explorer tells you what the client reported, PolicySpy tells you what the client was told to do. If a client is not applying a setting, check PolicySpy first to confirm the policy arrived.

Can I use these tools on a server that is not a client?

Yes, but only if the server has the SCCM client installed. The client-side tools (CMTrace, PolicySpy, ClientSpy) read the client’s local logs and policy store. If the server has no client, there is nothing to troubleshoot with these tools. For site server issues, you would use the site server logs and the console’s built-in status views instead.

Are there any free tools for troubleshooting distribution points?

Yes, the Content Library Explorer is built into the console and is free. For more detailed transfer logs, you can use CMTrace to read PkgXferMgr.log and DistMgr.log on the site server. There is also a free community tool called Distribution Point Troubleshooting Tool that can test connectivity and content access, but it is not from Microsoft and may not be updated for all versions.

What should I do if a client log shows an error but I don’t know what it means?

First, note the exact error code (like 0x87D00324). Then search that code in CMTrace or online—many errors are documented in Microsoft’s troubleshooting guides. You can also use the Log Parser tool from Microsoft to query logs for patterns. If the error is not clear, collect the client logs using the console’s Collect Client Logs action and open a support case with Microsoft, providing the logs and the error code.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.