CMTrace Open: vanhemmat versiot ja versiohistoria

Stable downloads: https://download.cmtraceopen.com/?source=github-release
CMTrace Open v1.6.3
Open-source CMTrace log viewer with built-in Intune diagnostics.
Download shortlinks
Each shortlink always resolves to the current stable release, so it stays valid in
tickets, runbooks, and slides long after this page scrolls out of view.
──────────────────────────────┬───────────────────────────────
Platform │Shortlink
──────────────────────────────┼───────────────────────────────
Windows x64, portable EXE │https://win.cmtrace.net
──────────────────────────────┼───────────────────────────────
Windows ARM64, portable EXE │https://winarm.cmtrace.net
──────────────────────────────┼───────────────────────────────
Windows x64, Lite portable EXE│https://lite.cmtrace.net
──────────────────────────────┼───────────────────────────────
Windows x64, MSI installer │https://msi.cmtrace.net
──────────────────────────────┼───────────────────────────────
macOS Apple silicon, DMG │https://mac.cmtrace.net
──────────────────────────────┼───────────────────────────────
Linux x64, AppImage │https://linux.cmtrace.net
──────────────────────────────┴───────────────────────────────
Nightly channel: https://nightly.cmtrace.net
Artifacts in v1.6.3
─────────────────────┬─────────────────────────────────────────────────────────────────
Platform │Files
─────────────────────┼─────────────────────────────────────────────────────────────────
Windows x64 and ARM64│signed .msi, signed portable .exe (Full and Lite), signed
│-setup.exe
─────────────────────┼─────────────────────────────────────────────────────────────────
macOS Apple silicon │signed and notarized .dmg, plus the .app.tar.gz updater archive
─────────────────────┼─────────────────────────────────────────────────────────────────
Linux x64 │.AppImage, .deb, .rpm
─────────────────────┴─────────────────────────────────────────────────────────────────
The MSI installs both the Full and Lite editions. Portable EXEs require no installation.
CycloneDX SBOMs (sbom-rust.cdx.json, sbom-npm.cdx.json) and build provenance
attestations are published alongside the binaries.
Changes
Removed
- Hot Dog Stand theme: Remove the theme. Anyone who had it selected opens in the Light theme.
Changed
- Desktop build compiler: Raise the desktop Rust minimum from 1.88 to 1.89 for the maintained Linux D-Bus dependency. The parser crate remains at version 0.4.0 with its existing Rust 1.88 minimum. Supported desktop OS baselines are unchanged.
- Reference screenshots: Remove outdated reference screenshots that showed identifying environment details, and replace the 0.3.0 workspace screenshot with a text caption.
- Parser source compatibility (#814): Advance cmtraceopen-parser to 0.4.0 for breaking source API changes from new Windows Firewall enum variants and public struct fields. Update affected exhaustive matches and struct literals; see the migration notes.
- DsRegCmd diagnostics link to event-log entries (#870): Diagnostics from rules that fire on a specific 0x code now carry related_error_codes (public field on DsregcmdDiagnosticInsight; struct literals need related_error_codes: Vec::new()), and the analyzer links event-log entries that cite those codes on token boundaries. Only codes that appear in the rule's fields on token boundaries are recorded; a rule firing on a substring hit records none. See the migration notes.
Fixed
- Linux single-instance handoff: Port an owned copy of the single-instance plugin to maintained zbus 6, preserving exclusive election, file handoff and name cleanup. An unavailable session bus retains startup without instance enforcement and reports a warning; a failed delivery to an existing primary reports an error instead of successful delivery. Windows and macOS implementations are unchanged.
- Archive and TLS dependencies: Update ZIP to 9.0.4 and Rustls to 0.23.46, retain archive symlink/special-file rejection, and remove the updater's unused legacy ZIP extraction path without suppressing the new adviso

Stable downloads: https://download.cmtraceopen.com/?source=github-release
CMTrace Open v1.6.2
Download shortlinks
Each shortlink always resolves to the current stable release, so it stays valid in
tickets, runbooks, and slides long after this page scrolls out of view.
──────────────────────────────┬───────────────────────────────
Platform │Shortlink
──────────────────────────────┼───────────────────────────────
Windows x64, portable EXE │https://win.cmtrace.net
──────────────────────────────┼───────────────────────────────
Windows ARM64, portable EXE │https://winarm.cmtrace.net
──────────────────────────────┼───────────────────────────────
Windows x64, Lite portable EXE│https://lite.cmtrace.net
──────────────────────────────┼───────────────────────────────
Windows x64, MSI installer │https://msi.cmtrace.net
──────────────────────────────┼───────────────────────────────
macOS Apple silicon, DMG │https://mac.cmtrace.net
──────────────────────────────┼───────────────────────────────
Linux x64, AppImage │https://linux.cmtrace.net
──────────────────────────────┴───────────────────────────────
Nightly channel: https://nightly.cmtrace.net
The MSI installs both the Full and Lite editions. Portable EXEs require no installation.
CycloneDX SBOMs (sbom-rust.cdx.json, sbom-npm.cdx.json) and build provenance
attestations are published alongside the binaries.
Changed
- Parser and IPC source compatibility: The parser source version advances from 0.1.1 at v1.6.0 through 0.2.0 to 0.3.0. Changes include the required ErrorCodeSpan.outcome field, caller-supplied DsRegCmd evaluation time, canonical Intune/CCM module paths, the removal of environment expansion from the parser crate and of the timeline error variant, new ParseResult.modified_unix_ms / AggregateParseResult.child_errors fields for Rust struct constructors, and expanded event/provenance data contracts. Downstream source consumers must update; desktop version 1.6.2 does not publish the parser crate.
- Observed BGB source contract (#775): Record sanitized client-notification evidence and the Simple-framed BgbServer.log format for the observed site version. The card remains capture guidance: its keys are unvalidated and the SCCM evidence admission path does not admit this Simple-framed source as supported diagnostic evidence.
- Redaction architecture decision (#589): Record accepted ADR-004 revision 2 for context-bound publication. The ADR defines later implementation work; this release does not claim that all Intune lanes implement its future contract.
- Canonical Intune parser ownership (#356): IME analysis now lives under intune::apps::windows::ime, ESP under intune::enrollment::windows::esp, and shared logical CCM framing under parser::ccm::logical. The former public paths and ESP-only administrator-restart command are removed. Captured ESP bundles require a manifest; a missing manifest is reported as missing coverage without discovering undeclared evidence.
Added
- Expanded Event Viewer (#583): Add provider-database import/export and packaged provider metadata, recovery and source-coverage reporting, event diagnosis, reusable filters, triage highlights, durable event markers, and a unified timeline. Event identities and source provenance survive merged and streamed loads; records without a placeable timestamp remain visible. Exact evidence keys drive correlation, and incomplete evidence stays explicit.
- Live Event Log operations and portable evidence (#583): Add Windows live tail and an explicitly confirmed channel-clear operation, diagnostic ZIP intake, bounded capture/archive handling, and streamed exports that follow the visible filter and ordering. Provider handling retains coverage gaps; normalized event exports apply identity masking. Provider-database export preserves the validated database bytes. Live Windows operations remain Windows-only; offline evidence has separate supported paths.
- Stop large explicit event loads (#639, #643): Stop a running channel load, retain the fe

Stable downloads: https://download.cmtraceopen.com/?source=github-release
CMTrace Open v1.6.0
The first release to carry the ConfigMgr/SCCM diagnostics work and the expanded Intune parser family. None of it was in 1.5.2: that was a scoped patch cut from the 1.5.1 branch for a single clipboard fix, so everything below is new to anyone upgrading from it.
Highlights
ConfigMgr/SCCM diagnostics, client and server — a native evidence path with a diagnostics workspace behind it: site core, management point, distribution point, software update point, hierarchy and replication, task-sequence provenance, client health, policy, deployment, updates, and inventory/compliance/metering analysis, plus bounded database export and advanced server capture contracts. Every finding cites the artifact it came from, coverage gaps stay visible instead of being reported as success, and nothing is inferred from timestamp proximity.
The Intune parser family, well past IME and ESP — Win32 app deployment transactions, Windows configuration policy evidence, Microsoft Store app evidence, Company Portal on Windows (LocalState), macOS (Apple unified log) and iOS/iPadOS (Console exports), the full Device Inventory Agent log family with rotation-aware tailing, an Autopilot evidence parser that works outside the ESP workspace, and a four-phase Windows compliance analyzer that will not promote a Conditional Access denial into a local setting verdict.
Privacy fixed at the export boundary — the ESP session export and the Intune Compliance lane were each binding at the wrong place. Both now project at the crate boundary, so an unredacted snapshot can no longer be written to a file you choose, and SIDs, tenant domains and device names no longer survive an export.
Microsoft Graph sign-in without freezing the UI — enable Graph with an explicit Sign in, cancellable interactive auth, and fast-fail when the host cannot do it (personal MSA, missing org account, provider unavailable). The Entra interactive path is retained where real consent is needed.
Restart as administrator, keeping your work — an application-wide elevated restart that restores the sources you had open.
Upgrading from 1.5.2
- msiexec /i app-1.6.0-x64.msi DISABLEUPDATECHECKS=1 now completes. On managed Windows 11 running Constrained Language Mode the custom action threw, and with the install not tolerated to continue it rolled the whole installation back; the policy is written through the 64-bit reg.exe instead (#576).
- Auto-update is intact: latest.json is rebuilt from the release's own signature assets and carries all eight updater targets — both Windows architectures, the macOS app and its archive, and the AppImage, .deb and .rpm.
- winget carries 1.6.0. Scoop is one review away: the bucket update is open as a pull request (#625), and until it merges scoop install cmtrace serves the previous version. The shortlinks below are unaffected either way.
Download shortlinks
Each shortlink always resolves to the current stable release, so it stays valid in
tickets, runbooks, and slides long after this page scrolls out of view.
──────────────────────────────┬───────────────────────────────
Platform │Shortlink
──────────────────────────────┼───────────────────────────────
Windows x64, portable EXE │https://win.cmtrace.net
──────────────────────────────┼───────────────────────────────
Windows ARM64, portable EXE │https://winarm.cmtrace.net
──────────────────────────────┼───────────────────────────────
Windows x64, Lite portable EXE│https://lite.cmtrace.net
──────────────────────────────┼───────────────────────────────
Windows x64, MSI installer │https://msi.cmtrace.net
──────────────────────────────┼───────────────────────────────
macOS Apple silicon, DMG │https://mac.cmtrace.net
──────────────────────────────┼───────────────────────────────
Linux x64, AppImage │https://linux.cmtrace.net
──────────────────────────────┴───────────────────────────────
Nightly channel: https://nightly.cmtrace.net
Artifacts in v1.6.

Stable downloads: https://download.cmtraceopen.com/?source=github-release
CMTrace Open v1.5.2
A focused maintenance release based on v1.5.1. This release includes the Windows clipboard-history fix from #520 and the associated test correction from #559, without pulling the later development work from main into the release.
Fixed
- Windows clipboard history (#520): Copies made from the Info pane are now registered in Windows clipboard history (Win+V).
- Info-pane text selection: Ctrl+C now preserves a selected portion of the message. When no text is selected, it continues to copy the complete log entry.
- Clipboard mirror test reliability (#559): Tests now advance the hook’s intentional deferred clipboard write before asserting the plugin call.
Downloads
─────────────┬───────────────────────────────────────────────────────────────────────────────────────
Platform │Downloads
─────────────┼───────────────────────────────────────────────────────────────────────────────────────
Windows x64 │Full portable EXE · Lite portable EXE · MSI installer · NSIS installer
─────────────┼───────────────────────────────────────────────────────────────────────────────────────
Windows ARM64│Full portable EXE · Lite portable EXE · MSI installer · NSIS installer
─────────────┴───────────────────────────────────────────────────────────────────────────────────────
The MSI includes both the Full and Lite editions. Portable EXEs require no installation.
Verification
- Clipboard tests: 8 passed
- TypeScript check: passed
- Signed Windows x64 and ARM64 builds: passed
- MSI, portable EXE, installer, signature, and updater metadata artifacts published
Checksums
GitHub displays SHA-256 checksums for each release asset in the asset list.

Stable downloads: https://download.cmtraceopen.com/?source=github-release
CMTrace Open v1.5.1
Added
- JAMF workspace for macOS investigations.
- Company Portal macOS app-log parsing with robust format handling.
- Expanded Intune evidence models for package state, platform scripts, and remediations.
- Native Recent submenu under File.
Changed
- Hardened supported log parsers with explicit format contracts.
- Improved Intune name-resolution performance and fallback behavior.
- Published crates.io metadata for cmtraceopen-parser and cmtrace-open.
Fixed
- Corrected Intune identity/name scoping and AppId GUID validation behavior.
- Redacted IP and MAC data in Company Portal macOS diagnostics.
- Kept Microsoft Graph sign-in window in front on Windows.
- Prevented parser temp-fixture collisions in concurrent test runs.
Build & CI
- Added macOS Developer ID signing/notarization configuration.
- Added repository-owned Scoop/Homebrew/Winget packaging metadata automation.
- Expanded CI/automation coverage (SCCM integration PRs, labeling, CodeRabbit handling).
Dependencies
- Updated Rust crates and select GitHub Action dependencies.
Full Changelog: v1.5.0...v1.5.1

Stable downloads: https://download.cmtraceopen.com/?source=github-release
CMTrace Open v1.5.0
Open-source CMTrace log viewer with built-in Intune diagnostics.
What's New
Added
- ESP Diagnostics workspace: Added a dedicated, full-width, no-sidebar workspace for troubleshooting Windows Autopilot Enrollment Status Page, Autopilot Device Preparation, and software deployment failures. It combines scenario/phase progress, actionable evidence-backed findings, workload state, enrollment/profile/registry/event evidence, Delivery Optimization, coverage gaps, and a live What MSIEXEC is doing now sampler on one page. Live Windows sessions continue collecting while the log surface is collapsed or another workspace is active; captured CMTrace Open evidence folders, manifests, CABs, and ZIPs are also supported. Features include failure detection (InstallationState / ErrorHresult from Sidecar registry), live current-task hero showing what's installing now with progress, session capture/replay (export live/failed sessions as JSON for offline analysis), workloads search/filter (name, ID, status) plus Failed / Running / Installed / Queued category chips, section jump navigation (sticky bar with per-section jump pills and return-to-top), and timeline GUID→name resolution (Intune app names in event stream). Read-only throughout except one opt-in, backed-up remediation action: on Windows with elevation, a Force past ESP button backs up the failing app's registry key, sets InstallationState=3, clears ErrorHresult, and offers one-click restore—allowing a Try again to proceed when ESP is blocked by a false negative.
- Bounded live deployment evidence: Added curated IME, ConfigMgr, Patch My PC, PSAppDeployToolkit, installer, and shallow high-signal temporary-log discovery with rotation/truncation handling and explicit retention limits. The live-log surface is collapsed by default, vertically resizable when docked, expandable to the full workspace, and available from a prominent Open live logs app-chrome action. No deep-scan or full-drive route is provided.
- Optional ESP Microsoft Graph enrichment: When the existing Graph option is enabled and its WAM connection is already authenticated, the workspace can add managed-device, Autopilot profile/event, ESP configuration, app, policy, certificate, platform-script, and remediation context while preserving raw local IDs. Per-section permission, offline, throttled, skipped, beta, partial, cancelled, and ambiguous-device states remain visible; connecting never queues work or opens a second sign-in flow. The managed-device correlation now captures the device's Entra device ID via NetGetAadJoinInformation (the same source Windows dsregcmd uses), so device matching resolves reliably and Graph sections enrich even on re-imaged VMs where serial-number fallback would fail.
- User-triggered Graph permission upgrade: Settings now offers Request missing permissions for an authenticated partial WAM connection. One explicit click re-requests the fixed five delegated read permissions; successful candidates can add capabilities without removing working ones. Unchanged, cancelled, denied, or failed outcomes retain the existing in-memory partial connection, while a stale outcome leaves the newer authoritative authentication state untouched. Startup and ESP refresh never initiate the upgrade, and tokens remain excluded from IPC and logs.
- Window state persistence (#260, closes #253): The app now restores its window size, position, and maximized state across launches via the official Tauri window-state plugin, so a resized, moved, or maximized window comes back the way you left it. The configured 1200×800 geometry remains the first-launch default.
Changed
- Administrator coverage guidance and retained sessions: ESP Diagnostics now checks elevation on workspace entry, recommends administrator access before collection when needed, and offers an explicit administrator restart on supported Windows builds. Non-elevated sessions re

CMTrace Open v1.4.0
A modern, open-source, cross-platform replacement for Microsoft's CMTrace.exe — a log viewer for Windows troubleshooting with built-in Intune (IME) diagnostics, DSRegCmd analysis, and real-time log tailing.
Highlights
- CCM/PSADT type="0" now renders as a first-class Success (green tick) instead of being flattened into Info — matching OneTrace. Wired through the severity filter, row rendering, Quick Stats, and status bar, with Success palettes across all 8 themes. (#248, closes #211)
- Error navigation — jump straight to the next or previous error/warning without scrolling. (#192)
- Teams (MSIX) client log collection — the collector and known-sources list now cover the new Microsoft Teams log locations. (#205, #242)
- Log Text column auto-fits to its widest message the first time you open a file.
- Now built on Tauri 2.11 and TypeScript 7, with signed builds for Windows (x64/arm64), macOS (Apple Silicon), and Linux — in both Full and Lite editions.
Downloads
─────────────────────┬───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Platform │Files
─────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Windows x64 / arm64 │CMTrace-Open_1.4.0_<arch>-setup.exe (NSIS installer), CMTrace-Open_1.4.0_<arch>.msi, CMTrace-Open_1.4.0_<arch>.exe (Full standalone), CMTrace-Open-Lite_1.4.0_<arch>.exe (Lite
│standalone)
─────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
macOS (Apple Silicon)│CMTrace.Open_1.4.0_aarch64.dmg (signed + notarized)
─────────────────────┼───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Linux x64 │CMTrace.Open_1.4.0_amd64.deb, CMTrace.Open_1.4.0_amd64.AppImage, or CMTrace.Open-1.4.0-1.x86_64.rpm
─────────────────────┴───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
Windows builds are signed with Azure Trusted Signing (a re-issued certificate — SmartScreen reputation is rebuilding, so fresh installs may briefly show an "unknown publisher" prompt; More info → Run anyway is safe). CycloneDX SBOMs (sbom-rust.cdx.json, sbom-npm.cdx.json) and build-provenance attestations are attached.
Added
- Log Text column auto-fit on load: The Log Text (message) column now expands automatically to fit its widest visible content the first time a file is opened, so long messages are readable without a manual resize. Auto-fit runs once per source, measures against an actually rendered row so the resolved font matches the double-click Fit action exactly, and only ever grows the column past its baseline width — never shrinks it. A manual drag-resize or explicit Fit is treated as a user-owned override that auto-fit will not overwrite.
- CCM type="0" Success severity (#248, closes #211): CCM/PSADT log lines with type="0" — a completed operation that OneTrace renders with a green tick — now map to a new first-class Success severity instead of being flattened into Info. Severity gains a Success variant end-to-end (Rust and TypeScript) and is wired through the severity filter, row rendering, the Quick Stats cards, and the status bar, with per-theme Success palette entries added across all 8 themes. A sanitized real-world PSADT install log is bundled as a regression fixture with an integration test.
- Log error navigation (#192): Toolbar controls to jump straight to the previous or next error/warning entry in the log view, so you c

CMTrace Open v1.3.2
Patch release with managed update-check controls and a Secure Boot scan polish fix.
Added
- Startup update checks are now disabled by default and can be enabled from Settings > Updates.
- Managed Windows deployments can force-disable all app update checks:
- NSIS: CMTrace-Open_*_x64-setup.exe /S /DisableUpdateChecks
- MSI: msiexec /i CMTrace-Open_<version>_x64.msi /qn DISABLEUPDATECHECKS=1
Fixed
- Secure Boot scan PowerShell checks no longer flash a console window.
Windows Downloads
──────────────────────────────────┬─────────────────────────────────────────────
File │Description
──────────────────────────────────┼─────────────────────────────────────────────
CMTrace-Open_1.3.2_x64.msi │MSI installer for x64, includes Full + Lite
──────────────────────────────────┼─────────────────────────────────────────────
CMTrace-Open_1.3.2_x64-setup.exe │NSIS installer for x64
──────────────────────────────────┼─────────────────────────────────────────────
CMTrace-Open_1.3.2_x64.exe │Standalone full edition for x64
──────────────────────────────────┼─────────────────────────────────────────────
CMTrace-Open-Lite_1.3.2_x64.exe │Standalone lite edition for x64
──────────────────────────────────┼─────────────────────────────────────────────
CMTrace-Open_1.3.2_arm64.msi │MSI installer for arm64, includes Full + Lite
──────────────────────────────────┼─────────────────────────────────────────────
CMTrace-Open_1.3.2_arm64-setup.exe│NSIS installer for arm64
──────────────────────────────────┴─────────────────────────────────────────────

CMTrace Open v1.3.1
Fixed
- CCM entries with type="" or thread="" now parse as structured CCM records instead of falling through to plain text. Empty values default to 0, preserving severity classification and thread display for agent-generated logs. (#184)
Downloads
- Windows x64/arm64 signed EXE, installer, and MSI
- macOS ARM signed and notarized DMG
- Linux x64 AppImage, DEB, and RPM
- SBOMs and updater metadata

CMTrace Open v1.3.0
Final 1.3.0 release. This replaces the 2026-04-27 prerelease and includes the final PR #180 hardening plus release-build dependency alignment.
Highlights
- Unified multi-file timeline workspace with incident detection and swim lanes
- DNS/DHCP workspace for DNS debug logs, DNS audit EVTX, and server collection
- Parser crate extraction for sharing with cmtraceopen-web
- Design system polish across tokens, icons, ARIA, spacing, and theme coverage
- Cross-platform release builds restored for macOS, Linux, and Windows
Final hardening
- Tailing no longer duplicates partial trailing records
- Date/time filters accept whole-second ISO/US inputs, validate up front, and treat timezone-less values as local time
- Session restore handles partial file-load failures without losing successfully restored tabs
- Aggregate-folder row markers now read and write against each entry's own file path
- Column auto-fit now works from the full column header and includes the message column
- Tauri JavaScript packages are aligned with Rust tauri 2.11.0 for release builds
See CHANGELOG.md for full details.

CMTrace Open 1.2.1
A maintenance release rolling up five community-reported fixes, a ProcMon-style context-menu filter, and signed builds for Windows (x64 + arm64), macOS (arm64), and Linux (x64).
Full changelog: CHANGELOG.md
Added
- Context menu filter from selection (#53) — right-click a log row with text selected for Include/Exclude filter items scoped to the selection, mirroring ProcMon's "exclude all events with this value" workflow.
- WDAC Managed Installer examples — new PowerShell tools under scripts/powershell/CmtLog/examples/ for detecting, remediating, and restoring WDAC Managed Installer configurations (CIP files, SiPolicy, AppLocker MI rules, CiTool integration), plus a sample .cmtlog output.
Fixed
- Hidden console windows for background spawns on Windows (#138) — background diagnostics no longer flash visible powershell.exe/cmd.exe/reg.exe windows during collection runs. A new helper applies CREATE_NO_WINDOW to DNS/DHCP probes, dsregcmd /status, registry exports, schtasks, nltest, AD lookups, and the collector's reg.exe export.
- File association status reflects reality (#113) — the Settings → File Associations tab now queries the current .log handler on mount and switches to a "currently registered" view when CMTrace Open is the active handler, instead of always rendering the "Associate" button.
- Folder open skips inaccessible files (#136) — parse_files_batch and open_log_folder_aggregate no longer abort the entire load on the first per-file error (e.g. permission denied); the failure is logged and the rest of the folder still opens.
- Ctrl+L mapped to Error Lookup (#137) — restores legacy CMTrace muscle memory. Filter moves to Ctrl+Shift+L; Ctrl+E remains an Error Lookup alias.
- Clippy warnings blocking CI (#140) — resolved unnecessary_sort_by, collapsible_match, and related lints to keep cargo clippy -- -D warnings green.
Changed
- CI build matrix: dropped macOS and Linux from the CI Tauri build matrix — the project targets Windows as its primary platform. Release artifacts are still produced for all three OSes.
- Komac v2 winget publishing: release workflow now uses the portable Komac binary with dynamic latest-release lookup and GITHUB_TOKEN env var.
- Playwright E2E scaffolding: added Playwright test configuration, Vite-served test harness, and a Rust IPC bridge so end-to-end tests can drive the app against the real backend.
Downloads
─────────────────────┬───────────────────────────────────────────────────────
Platform │File
─────────────────────┼───────────────────────────────────────────────────────
Windows x64 │CMTrace-Open_1.2.1_x64.msi / .exe / -setup.exe (signed)
─────────────────────┼───────────────────────────────────────────────────────
Windows arm64 │CMTrace-Open_1.2.1_arm64.msi / .exe / -setup.exe
│(signed)
─────────────────────┼───────────────────────────────────────────────────────
Windows Lite │CMTrace-Open-Lite_1.2.1_x64.exe / _arm64.exe
─────────────────────┼───────────────────────────────────────────────────────
macOS (Apple Silicon)│CMTrace.Open_1.2.1_aarch64.dmg (notarized)
─────────────────────┼───────────────────────────────────────────────────────
Linux x64 │CMTrace.Open_1.2.1_amd64.deb / .AppImage / x86_64.rpm
─────────────────────┴───────────────────────────────────────────────────────
SBOMs (sbom-rust.cdx.json, sbom-npm.cdx.json) and Tauri updater signatures are attached as well.

What's New in v1.2.0
.cmtlog Format & Interactive Markers
- New .cmtlog file format - extends CCM's <![LOG[...]LOG]!> with sections, iterations, WhatIf flags, and tags. Fully backward-compatible with CMTrace.exe.
- Color-coded user markers - annotate log entries with Bug (red), Investigate (blue), or Confirmed (green) via right-click, gutter click, or Ctrl+M. Persisted to AppData.
- Section dividers - colored banner rows and left-edge bands for visual phase/loop grouping
- WhatIf rendering - dimmed italic lines with purple badge for simulated actions
- Multi-select copy - Ctrl+Click, Shift+Click, Ctrl+A, Ctrl+C
- PowerShell CmtLog module - CmtLog.psm1 for writing .cmtlog files from scripts
CleanShot 2026-04-15 at 09 48 06
New Parsers
- DNS debug log parser - Windows DNS Server debug logs with structured DNS fields
- DNS audit EVTX parser - DNS Server audit event logs with EventID-based schema dispatch
- PatchMyPC detection parser - structured field extraction and "Open All" family action
New Workspaces
- Secure Boot Certificate workspace - timeline, raw data, and certificate detail views
UI Improvements
- Auto-fit column widths - double-click resize handle or click fit-all button
- Quick Stats enhancements - severity filter toggles, column sorting
- Multi-line CCM parser - multi-line log entries grouped into single entries
- Pluggable workspace registry - refactored for easier extensibility
ARM64 & Build Improvements
- ARM64 Windows build support with MSVC tools and LLVM/Clang
- PowerShell 5.1 compatibility (ASCII-only, UTF-8 no-BOM)
- Automated winget publishing via komac
Security
- GitHub Actions hardened: SHA-pinned actions, scoped permissions, SECURITY.md
- SLSA provenance attestations and CycloneDX SBOMs on all release artifacts
- Azure trusted signing upgraded to v1.2.0
- Cargo security audit in CI
Dependencies
- windows 0.58 -> 0.61, ureq 2 -> 3, winreg 0.52 -> 0.55, notify 7 -> 8, evtx 0.8 -> 0.11
Full changelog: https://github.com/adamgell/cmtraceopen/blob/main/CHANGELOG.md

What's New in v1.1.0
New Workspaces
- Event Log Viewer — Parse .evtx files or query live Windows Event Log channels. "This Computer" auto-loads Application, System, Security, and Setup in parallel. Event Viewer-style nested tree sidebar, severity badges, channel grouping, and resizable detail pane.
- Sysmon Dashboard — Full Sysmon analysis workspace: open .evtx files or query the live Sysmon event log. Dashboard with metric cards, event type chart, timeline histogram, security alerts, and top process/network/DNS/registry lists. Events table with virtual scrolling and severity filtering. Classifies 23 Sysmon event types with structured field extraction.
Intune Enhancements
- Microsoft Graph API integration (Windows, opt-in) — Resolve app GUIDs to display names via Graph API. Authenticates silently using WAM with the device's existing Entra ID session — no app registration required. Pre-populate cache fetches apps, remediation scripts, platform scripts, and shell scripts. Gated behind Settings > Graph API toggle.
- AppWorkload enrichment — Parse "Get policies" JSON payloads to build GUID-to-app-name mappings. InfoPane shows resolved app names, structured policy metadata cards, and decoded base64 PowerShell detection scripts.
- Activity view — Groups timeline events by app into collapsible cards with worst status, event count, duration, and parsed structured fields (intent, detection, applicability, reboot, enforcement).
- GUID Registry dialog — Searchable table of all GUID-to-app-name mappings with source confidence ranking and tabbed view (All/Apps/Scripts/Remediations).
- SideCarScriptDetectionManager events — PowerShell script detection lifecycle events in the Intune timeline.
Log Viewer Features
- Settings dialog — Full settings UI replacing the Accessibility dialog: Appearance, Columns, Behavior, Updates, File Associations tabs. Ctrl+, to open.
- Context menu — Right-click any log row for Copy, Jump to Line, Quick Filter, Reveal in File Manager, and Error Lookup via native OS menu.
- Multi-file unified timeline — Merge entries from multiple open log files into a single time-sorted view with color-coded source borders and cross-file timestamp correlation.
- Session save/restore — Save workspace state to .cmtrace JSON files (Ctrl+Shift+S). Files integrity-checked with SHA-256 hashes on restore.
- Log diff — Compare two open log files side-by-side or inline. Fuzzy matching normalizes GUIDs and timestamps for smarter diffing.
- Resizable InfoPane, Jump to Line, Reveal in File Manager, Quick Filter
Bug Fixes
- Rotated AppWorkload files now correctly parse as LogicalRecord framing
- GUID extraction prefers "for app <GUID>" patterns over generic first-GUID matching
- Session save no longer silently fails when no tabs are open
- Session restore no longer bails entirely when saved files are missing
- Tab close properly clears log content, filters, and UI state
Downloads
───────────────────────────────┬────────────────────────────────────
File │Description
───────────────────────────────┼────────────────────────────────────
CMTrace-Open_1.1.0_x64.msi │MSI installer (includes Full + Lite)
───────────────────────────────┼────────────────────────────────────
CMTrace-Open_1.1.0_x64.exe │Standalone full edition
───────────────────────────────┼────────────────────────────────────
CMTrace-Open-Lite_1.1.0_x64.exe│Standalone lite edition
───────────────────────────────┴────────────────────────────────────

CMTrace Open v1.0.2
Open-source CMTrace log viewer with built-in Intune diagnostics.
Windows Downloads
- Signed standalone EXE (x64)
- Signed MSI installer (x64)
- Signed standalone EXE (arm64)
- Signed MSI installer (arm64)

Fixed
- Timestamp display offset: Timestamps from logs written on machines in different timezones (e.g., UTC+8) now display correctly, matching the original CMTrace behavior. Previously, the app converted UTC epoch millis back to the viewer's local timezone, causing an 8-hour (or other) offset.
- 24h/12h time format refresh: Date/time format preferences are now refreshed from the Windows registry when the app regains focus, so switching between 24-hour and AM/PM in Windows Settings takes effect without restarting the app.

CMTrace Open v1.0.0
First stable release. Since v0.5.0, CMTrace Open has received a complete UX overhaul — eight themes, multi-tab browsing, dynamic parser-aware columns, six new log parsers, a registry file viewer, an embedded 411-code error intelligence layer, a Software Deployment workspace, a Windows Diagnostics Collection tool, and timezone-correct timestamps across all parsers.
New: Registry File (.reg) Viewer
Open .reg files exported by regedit.exe directly in CMTrace Open. Auto-detected via the Windows Registry Editor Version 5.00 header. Supports REG_SZ, REG_DWORD, REG_QWORD, REG_BINARY, REG_EXPAND_SZ, REG_MULTI_SZ, REG_NONE, and delete markers. Hex continuations and UTF-16LE values decoded automatically. Renders in a regedit-style two-pane UI with a virtualized key tree (handles 22 MB+ files) and a Name / Type / Data value table. Integrates into the tab system alongside log files.
Workspaces
- Software Deployment — Analyze MSI, PSADT, and WiX/Burn deployment folders in one click with recursive scanning, exit code extraction, and error summarization with code lookups
- Diagnostics Collection (Windows) — Collect 32 log patterns, 61 registry keys, 42 event log channels, 6 file exports, and 30 command outputs. Preset picker (Full / Intune+Autopilot / Networking / Security / Quick) with granular family-level scoping
- DSRegCmd MDM cross-reference — Eliminates false "enrollment missing" warnings by cross-referencing scheduled task GUIDs against enrollment registry keys
Log Parsing
Six new parsers: Windows DHCP Server, macOS Intune MDM Daemon, WiX/Burn bootstrapper, MSI verbose, PSADT Legacy, and Windows Registry (.reg)
- Dynamic columns auto-derived from detected parser type
- Panther enrichment with result codes, GLE codes, setup phases, and operation names
- IME subsystem enrichment extracting source tags into a dedicated column
- Timestamp corrections: IME 4-hour offset fixed, CCM/SCCM/ISO timezone offsets applied correctly
Error Intelligence
- 411-code embedded database — Win32, HRESULT, ConfigMgr, and Windows Update codes highlighted inline in log entries
- HRESULT decomposition with FACILITY_WIN32 fallback
- Rebuilt Error Lookup dialog with live search and category badges
UI
- 8 themes with toolbar picker
- Multi-tab file browser with cached instant switching
- Resizable and reorderable columns (persisted)
- Inline find bar (Ctrl+F) with regex, match case, live hit count
- Font family picker in Accessibility settings
- Collapsible sidebar (Ctrl+B)
- Multi-file open via dialog, drag-drop, CLI args, and OS file association
Performance
- Zero-allocation severity detection
- Cached thread display strings (~15 allocations vs ~30K)
- Rayon-powered parallel folder parsing
- In-memory tab cache (zero re-parse on switch)
- Progressive folder loading with batch size of 4 and live progress bar — fixes UI freeze when opening large folders
- O(1) GUID lookups in DSRegCmd workspace
Bug Fixes
- Large folder opening — Progressive batch loading (batch size 4) with live progress bar replaces the previous approach that could freeze the UI on folders with many log files
- Scroll jump when clicking an already-visible row
- Tab strip overflow dropdown clipping
- Sidebar routing for Deployment and macOS workspaces
- Burn log classification and hex exit code extraction
- NeXTSTEP payload parser: quoted keys, arrays-of-dicts, nested arrays
- Invalid Date in macOS packages tab
- False hex matches in GUID error-code lookups
- Row height overlap at large font sizes
- GUID-to-app-name deduplication across download stats and event tracker
Build & Dependencies
- TypeScript 6.0 migration
- macOS code signing and notarization in CI
- Windows prerequisite script hardening
- picomatch 4.0.3 → 4.0.4

CMTrace Open v0.5.1
Open-source CMTrace log viewer with built-in Intune diagnostics.
Downloads
─────────────────────┬─────────────────────────────────
Platform │File
─────────────────────┼─────────────────────────────────
Windows (x64 / arm64)│signed .msi / signed .exe
─────────────────────┼─────────────────────────────────
macOS (ARM) │signed + notarized .dmg disk
│image
─────────────────────┼─────────────────────────────────
Linux (x64) │.deb / .AppImage
─────────────────────┴─────────────────────────────────

CMTrace Open v0.5.0
Open-source CMTrace log viewer with built-in Intune diagnostics.
Windows Downloads
- Signed standalone EXE (x64)
- Signed MSI installer (x64)
- Signed standalone EXE (arm64)
- Signed MSI installer (arm64)
macOS Downloads
- Unsigned DMG/APP file
xattr -cr /Applications/CMTrace\ Open.app
What's Changed
- Bump rustls-webpki from 0.103.9 to 0.103.10 in /src-tauri in the cargo group across 1 directory by @dependabot[bot] in #20
- feat: macOS Diagnostics workspace by @adamgell in #21
- feat: themes
CleanShot 2026-03-21 at 18 47 32 dark dracula hot_dog_stand nord solarized
Full Changelog: v0.4.0...v0.5.0