Muokkaa

Jaa

Diagnose MDM enrollment

This article provides suggestions for troubleshooting device enrollment issues for MDM.

Verify autoenrollment requirements and settings

To ensure that the autoenrollment feature is working as expected, you must verify that various requirements and settings are configured correctly. The following steps demonstrate required settings using the Intune service:

  1. Verify that the user who is going to enroll the device has a valid Intune license.

    Screenshot of Intune license verification.

  2. Verify that autoenrollment is activated for those users who are going to enroll the devices into Mobile Device Management (MDM) with Intune. For more information, see Microsoft Entra ID and Microsoft Intune: Automatic MDM enrollment in the new Portal.

    Auto-enrollment activation verification.

    Important

    For bring-your-own devices (BYOD devices), the Mobile Application Management (MAM) user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled.

    For corporate-owned devices, the MDM user scope takes precedence if both scopes are enabled. The devices get MDM enrolled.

  3. Verify that the device is running a supported version of Windows.

  4. Autoenrollment into Intune via Group Policy is valid only for devices that are Microsoft Entra hybrid joined. This condition means that the device must be joined into both local Active Directory and Microsoft Entra ID. To verify that the device is Microsoft Entra hybrid joined, run dsregcmd /status from the command line.

    You can confirm that the device is properly hybrid-joined if both AzureAdJoined and DomainJoined are set to YES.

    Auto-enrollment device status result.

    Additionally, verify that the SSO State section displays AzureAdPrt as YES.

    Auto-enrollment Microsoft Entra prt verification.

    This information can also be found on the Microsoft Entra device list.

  5. Verify that the MDM discovery URL during autoenrollment is https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc.

    MDM discovery URL.

  6. Some tenants might have both Microsoft Intune and Microsoft Intune Enrollment under Mobility. Make sure that your autoenrollment settings are configured under Microsoft Intune instead of Microsoft Intune Enrollment.

    Screenshot of Mobility setting MDM Intune.

  7. When using group policy for enrollment, verify that the Enable Automatic MDM enrollment using default Microsoft Entra credentials group policy (Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM) is properly deployed to all devices that should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully.

  8. Verify that Microsoft Intune allows enrollment of Windows devices.

    Screenshot of Enrollment of Windows devices.

Troubleshoot group policy enrollment

Investigate the logs if you have issues even after performing all the verification steps. The first log file to investigate is the event log, on the target Windows device. To collect Event Viewer logs:

  1. Open Event Viewer.

  2. Navigate to Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider > Admin.

    Tip

    For guidance on how to collect event logs for Intune, see Collect MDM Event Viewer Log YouTube video.

  3. Search for event ID 75, which represents a successful autoenrollment. Here's an example screenshot that shows the autoenrollment completed successfully:

    Screenshot of Event ID 75.

If you can't find event ID 75 in the logs, it indicates that the autoenrollment failed. This failure can happen because of the following reasons:

  • The enrollment failed with error. In this case, search for event ID 76, which represents failed autoenrollment. Here's an example screenshot that shows that the autoenrollment failed:

    Screenshot of Event ID 76.

    To troubleshoot, check the error code that appears in the event. For more information, see Troubleshooting Windows device enrollment problems in Microsoft Intune.

  • The autoenrollment didn't trigger at all. In this case, you won't find either event ID 75 or event ID 76. To know the reason, you must understand the internal mechanisms happening on the device as described here:

    The autoenrollment process is triggered by a task (Microsoft > Windows > EnterpriseMgmt) within the task-scheduler. This task appears if the Enable automatic MDM enrollment using default Microsoft Entra credentials group policy (Computer Configuration > Policies > Administrative Templates > Windows Components > MDM) is successfully deployed to the target machine as shown in the following screenshot:

    Screenshot of Task scheduler.

    Note

    This task isn't visible to standard users, run Scheduled Tasks with administrative credentials to find the task.

    This task runs every 5 minutes for the duration of one day. To confirm if the task succeeded, check the task scheduler event logs: Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from Microsoft Entra ID is triggered by event ID 107.

    Screenshot of Event ID 107.

    When the task is completed, a new event ID 102 is logged.

    Screenshot of Event ID 102.

    The task scheduler log displays event ID 102 (task completed) regardless of the autoenrollment success or failure. This status-display means that the task scheduler log is only useful to confirm if the autoenrollment task is triggered or not. It doesn't indicate the success or failure of autoenrollment.

    If you can't see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from Microsoft Entra ID is initiated, there's possibly an issue with the group policy. Immediately run the command gpupdate /force in a command prompt to get the group policy object applied. If this step still doesn't help, further troubleshooting on Active Directory is required. One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (HKLM > Software > Microsoft > Enrollments). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen:

    Screenshot of Outdated enrollment entries.

    By default, these entries are removed when the device is unenrolled, but occasionally the registry key remains even after unenrollment. In this case, gpupdate /force fails to initiate the autoenrollment task and error code 2149056522 is displayed in the Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational event log file under event ID 7016.

    A resolution to this issue is to remove the registry key manually. If you don't know which registry key to remove, go for the key that displays most entries as the previous screenshot shows. All other keys display fewer entries as shown in the following screenshot:

    Screenshot showing manually deleted entries.

Error codes

Code ID Error message
0x80180001 "idErrorServerConnectivity", // MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}
0x80180002 "idErrorAuthenticationFailure", // MENROLL_E_DEVICE_AUTHENTICATION_ERROR There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.
0x80180003 "idErrorAuthorizationFailure", // MENROLL_E_DEVICE_AUTHORIZATION_ERROR This user isn't authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.
0x80180004 "idErrorMDMCertificateError", // MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.
0x80180005 "idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}
0x80180006 "idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}
0x80180007 "idErrorAuthenticationFailure", // MENROLL_E_DEVICE_INVALIDSECURITY_ERROR There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.
0x80180008 "idErrorServerConnectivity", // MENROLL_E_DEVICE_UNKNOWN_ERROR There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}
0x80180009 "idErrorAlreadyInProgress", // MENROLL_E_ENROLLMENT_IN_PROGRESS Another enrollment is in progress. You can try to do this again or contact your system administrator with the error code {0}.
0x8018000A "idErrorMDMAlreadyEnrolled", // MENROLL_E_DEVICE_ALREADY_ENROLLED This device is already enrolled. You can contact your system administrator with the error code {0}.
0x8018000D "idErrorMDMCertificateError", // MENROLL_E_DISCOVERY_SEC_CERT_DATE_INVALID There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.
0x8018000E "idErrorAuthenticationFailure", // MENROLL_E_PASSWORD_NEEDED There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.
0x8018000F "idErrorAuthenticationFailure", // MENROLL_E_WAB_ERROR There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.
0x80180010 "idErrorServerConnectivity", // MENROLL_E_CONNECTIVITY There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}
0x80180012 "idErrorMDMCertificateError", // MENROLL_E_INVALIDSSLCERT There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.
0x80180013 "idErrorDeviceLimit", // MENROLL_E_DEVICECAPREACHED Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.
0x80180014 "idErrorMDMNotSupported", // MENROLL_E_DEVICENOTSUPPORTED This feature isn't supported. Contact your system administrator with the error code {0}.
0x80180015 "idErrorMDMNotSupported", // MENROLL_E_NOTSUPPORTED This feature isn't supported. Contact your system administrator with the error code {0}.
0x80180016 "idErrorMDMRenewalRejected", // MENROLL_E_NOTELIGIBLETORENEW The server did not accept the request. You can try to do this again or contact your system administrator with the error code {0}.
0x80180017 "idErrorMDMAccountMaintenance", // MENROLL_E_INMAINTENANCE The service is in maintenance. You can try to do this again later or contact your system administrator with the error code {0}.
0x80180018 "idErrorMDMLicenseError", // MENROLL_E_USERLICENSE There was an error with your license. You can try to do this again or contact your system administrator with the error code {0}.
0x80180019 "idErrorInvalidServerConfig", // MENROLL_E_ENROLLMENTDATAINVALID Looks like the server isn't correctly configured. You can try to do this again or contact your system administrator with the error code {0}.
"rejectedTermsOfUse" "idErrorRejectedTermsOfUse" Your organization requires that you agree to the Terms of Use. Please try again or ask your support person for more information.
0x801c0001 "idErrorServerConnectivity", // DSREG_E_DEVICE_MESSAGE_FORMAT_ERROR There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}
0x801c0002 "idErrorAuthenticationFailure", // DSREG_E_DEVICE_AUTHENTICATION_ERROR There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.
0x801c0003 "idErrorAuthorizationFailure", // DSREG_E_DEVICE_AUTHORIZATION_ERROR This user isn't authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.
0x801c0006 "idErrorServerConnectivity", // DSREG_E_DEVICE_INTERNALSERVICE_ERROR There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}
0x801c000B "idErrorUntrustedServer", // DSREG_E_DISCOVERY_REDIRECTION_NOT_TRUSTED The server being contacted isn't trusted. Contact your system administrator with the error code {0}.
0x801c000C "idErrorServerConnectivity", // DSREG_E_DISCOVERY_FAILED There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}
0x801c000E "idErrorDeviceLimit", // DSREG_E_DEVICE_REGISTRATION_QUOTA_EXCCEEDED Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.
0x801c000F "idErrorDeviceRequiresReboot", // DSREG_E_DEVICE_REQUIRES_REBOOT A reboot is required to complete device registration.
0x801c0010 "idErrorInvalidCertificate", // DSREG_E_DEVICE_AIK_VALIDATION_ERROR Looks like you have an invalid certificate. Contact your system administrator with the error code {0}.
0x801c0011 "idErrorAuthenticationFailure", // DSREG_E_DEVICE_ATTESTATION_ERROR There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.
0x801c0012 "idErrorServerConnectivity", // DSREG_E_DISCOVERY_BAD_MESSAGE_ERROR There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}
0x801c0013 "idErrorAuthenticationFailure", // DSREG_E_TENANTID_NOT_FOUND There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.
0x801c0014 "idErrorAuthenticationFailure", // DSREG_E_USERSID_NOT_FOUND There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.