Browse Troubleshooting
- Dashboard overview
- Insights overview
- Sites Overview - Network Deployments
- Policies Overview - Create and Edit
- Custom Lists overview
- Clients Overview - Device Agents and Profiles
- Users Overview - Directory Users and Personas
- Organizations Overview - MSP Tenant Management
- Lookup Tool Overview
- Query Log Overview
- Settings Overview - Account Administration
- Help & Support Overview
- Signing In - Login, 2FA, and Password Reset
- Two-factor authentication (2FA)
- Add system users (role-based access)
- Check domain classification with the Lookup Tool
- Configurable objects and their associations
- Configure notifications
- Working with organizations (multi-tenant)
- Working with policies
- Content categories
- Security categories
- Application categories (Zero Trust app management)
- Working with allow and block lists
- Zero Trust TLD Filters
- Safe Search explained
- Safe Search supported search engines
- YouTube Restricted Mode explained
- Custom block pages
- Prevent DNS bypass
- Don't mix DNS providers
- Active Directory group policies
- Entra ID group policies
- Tracking individual users
Collect Windows Client (v2) diagnostics
Generate the ScoutDNS Windows Client diagnostic bundle with sdns-service.exe diag, and enable DEBUG logging first when support asks for it.
The Windows Client (v2) builds its own diagnostic bundle. One command creates a zip of diagnostic logs that you attach to a support ticket. The Windows Client Diagnostic Tool covers the v1 Scout360 agent.
Generate the bundle
Open PowerShell as Administrator on the affected device and run:
& "$env:ProgramFiles\ScoutDNS\sdns-service.exe" diagThe bundle is written to C:\ProgramData\ScoutDNS\diag\ as sdns-diag-YYYYMMDD-HHMMSS.zip, timestamped to the run. Attach the zip to your support ticket along with what the user saw and when.
Collect the bundle before disabling or uninstalling the agent, so it captures the device in the broken state.
When support asks for DEBUG logs
The standard bundle logs at INFO level, which is enough for broad failures. Support may ask you to enable DEBUG logging first for issues involving:
- a specific domain or an inconsistent policy result
- Local Forwarders or split-horizon routing
- VPN or ZTNA connect, disconnect, forwarding, or recovery failures
- intermittent DNS failures or latency
- DoH resolver selection or failover
- configuration changes not taking effect
DEBUG logging is switched on by a flag file and needs no service restart. The flag expires on its own after 48 hours, but remove it as soon as you have collected the bundle.
-
Open PowerShell as Administrator and create the flag:
New-Item -ItemType File -Force "$env:ProgramData\ScoutDNS\logs\debug.flag" -
Wait up to 30 seconds for the service to pick it up, then reproduce the problem for 5 to 10 minutes, or for as long as support directs.
-
Collect the bundle:
& "$env:ProgramFiles\ScoutDNS\sdns-service.exe" diag -
Remove the flag to return to INFO logging:
Remove-Item "$env:ProgramData\ScoutDNS\logs\debug.flag" -Force -ErrorAction SilentlyContinue
Attach the new zip from C:\ProgramData\ScoutDNS\diag\ to the ticket.
Related
- Windows Client (v2) deployment guide, install, verification, and fail-open behavior.
- VPN and ZTNA compatibility (Windows Client), the capture step for tunnel-related issues.
- Windows Client Diagnostic Tool, the capture procedure for the v1 Scout360 agent.
- Roaming clients (device agents), the v1 agent reference.