Pete Hinchley: Export Offline Files Synchronization Log

If you are experiencing issues using the Offline Files capability within Windows to synchronize files and folders from a network share to a computer, you may benefit from enabling the Offline Files Sync Log.

This analytic log is not enabled by default. To enable the log, run the following command on the client device from an elevated PowerShell prompt:

wevtutil sl Microsoft-Windows-OfflineFiles/SyncLog /e:true /q

After forcing a sync, use the following PowerShell command to retrieve the list of successfully synchronized files (limited to the last 24 hours):

get-winevent -oldest -filterhashtable @{ logname = "Microsoft-Windows-OfflineFiles/SyncLog"; starttime = (get-date).adddays(-1); id = 2005 } |  select-object TimeCreated, @{ name = "Path"; expression = { ([xml]$_.toxml()).Event.UserData.SyncSuccessInfo.Path } }

This command will export the synchronization history in the following format:

4/09/2017 6:00:49 PM \\lab\users\phinchley
4/09/2017 6:00:49 PM \\lab\users\phinchley\stuff.txt
4/09/2017 6:34:32 PM \\lab\users\phinchley\nonsense.txt
4/09/2017 6:34:32 PM \\lab\users\phinchley\woot.txt  

And finally, to disable the log:

wevtutil sl Microsoft-Windows-OfflineFiles/SyncLog /e:false /q