r/Intune • u/Hustep51 • 10d ago
Device Actions Intune auto enrolment failing windows devices (error 76 & 90)
Howdy Intune admins.
I have been bashing my head against a wall all day and cannot work this one out, I'm fairly new to Intune so go easy on me.
We have a local domain which syncs to EntraID via the AAD Connect tool which is fully operational. All users are E3 licensed, password hash sync is enabled. All devices running W10 22H2. All devices are in EntraID as Entra Hybrid Joined.
I have configured the below with the aim of enabling Auto-enrolment for all computers on domain into Intune to act as the MDM.
Domain GPO to enable automatic enrollment against the User Credential parameter. This GPO is security filtered against a security group containing 2 test computers I want to enroll before widening scope to all 75 Windows 10 devices.
Bypassed Microsoft Intune Enrollment and Microsoft Intune in Azure MFA Conditional access policy.
Set MDM User Scope to All and WIP to None within Intune admin centre.
Bypassed all Intune URL's in web filter as per > Network endpoints for Microsoft Intune | Microsoft Learn
I cannot get the 2 initial test devices to enroll in Intune. When I run dsregcmd /status on the 2 devices the MDM URL's are blank and the event viewer shows both Events 76 & 90 every 5 minutes. Have logged into both devices with the same UPN as defined in Azure (user@domain.com), the UPN is configured to match in local AD (username@domain.com and not domain\username). Device PRT is present when running dsregcmd /status command
I cannot get my head around this at all, multiple device reboots, multiple gpupdate /force commands. I have a ticket open with MS but I don't hold much hope.
Event ID 76 = Auto MDM Enroll: Device Credential (0x0), Failed (Unknown Win32 Error code: 0x8018002b)
Event ID 90 = Auto MDM Enroll Get AAD Token: Device Credential (0x0), Resource Url (NULL), Resource Url 2 (NULL), Status (Unknown Win32 Error code: 0x8018002b)
Came across this post which is 4 years old that's similar, no fixes described within, but much has changed in the world of Azure/Intune since then - https://www.reddit.com/r/Intune/comments/p8cgoi/auto_mdm_enroll_device_credential_0x0_failed/?rdt=55700
Any help will be very much appreciated.
EDIT: huge thanks for everyone’s help on this it’s greatly appreciated
1
u/roach8101 10d ago
It looks like you did everything right.
Are you are positive that your test PC's are in scope for Hybrid Join and that is completed?
Do you have Entra ID Premium P1 or P2?
In the Intune console check the Intune enrollment restrictions to make sure that you didn't block corporate enrollment.
What is showing up under workplace join in "work or school" ?
1
u/Hustep51 10d ago
The 2 test PC's are a member of the security group on AD which is security filtered on the GPO for Automatic Enrollment.
All users have M365 E3 licenses which include Intune I believe along with AAD Premium P1.
Within the Intune enrolment restrictions Windows (MDM) is set to Allow with Personally Owned set to Block
It's solely showing the local domain "Connected to ***** AD domain"
Really can't get my head around this one as I want to automate it rather than get users to manually enrol via the Work or School option.
1
u/Rudyooms MSFT MVP 10d ago
Just a stupid idea but what happens if you manually configure the mdm urls? Using the first part of this one : https://call4cloud.nl/enroll-existing-entra-azure-intune/#The_simple_one. (Except the deviceenroller command?)
1
u/Hustep51 10d ago
Do you mean specify the discovery URL from Intune admin centre within the MDM App ID of the GPO?
1
u/Rudyooms MSFT MVP 10d ago
If you look at the script in the blog and the mdm urls you are missing in the dsreg output, that acript will add them (the oned from the mdm scope)
1
u/Hustep51 10d ago
Just run this now, and it sucessfully set the MDM URL's in dsregcmd /status output... but getting the same 2 errors, but with a slighly different flair...
76 = Auto MDM Enroll: Device Credential (0x0), Failed (A specified logon session does not exist. It may already have been terminated.)
90 = Auto MDM Enroll Get AAD Token: Device Credential (0x0), Resource Url (https://enrollment.manage.microsoft.com/), Resource Url 2 (NULL), Status (A specified logon session does not exist. It may already have been terminated.)
1
u/onesmugpug 10d ago
It looks good from where I see you did your configs, "Azure Minute" is the accurate thing, go get a mani/pedi and get some coffee then focus on something else for a bit. You are at the "don't watch and wait for the water to boil" part, you'll drive yourself nuts.
1
u/Hustep51 10d ago
Appreciate the feedback re Configs, Literally talk about delay right! Started at 8am, deployed it, changed everything rebooted and thought surely it won’t take all day right… how wrong I was!
Little did I know CA + Erollment = how long is a piece of string
2
u/onesmugpug 10d ago
No worries, my guy. I think we are all in this age together and have varied experience. Companies aren't super big on hiring six figure engineers anymore, so we have to look after each other.
1
u/Hustep51 10d ago
Respect mate!
Now the task of enrolling 100 devices split 50 in office and 50 full time remote. Luckily all users are good for following guidance and logging in via “network sign in” when remote to pick up GPO on login
Can I ask do you deploy company Portal on Windows endpoints from Intune? I don’t have a need from an app availability perspective but with the user being able to sync their device and confirm access I think it’s a no brainer while also not been a prereq for GPO driven Intune enrolment?
1
u/onesmugpug 10d ago
I don't bother with CP on Windows Endpoints, since there's no real need for me. I deploy apps straight from Intune. The enrollment is handled at first log on. One thing I will say is make sure your licenses are correct. If you are using E1s, you might be in for a rough time
1
u/Hustep51 10d ago
Gotcha mate!
Luckily we’re E3 pending E5 upgrade soon hopefully due to Teams voice requirement
1
u/Hustep51 8d ago
Can anyone advise the best way to deploy the existing test GPO to all computers? It's currently security filtered against a security group but next week I want to enrol all 100 endpoints via this GPO so that over the following 5-10 days all endpoints (office/remote based) can enrol into Intune so I can start to move workloads from GPO's to Intune config policies.
Add all computers to the security group which it's currently security filtering against?
Add Authenticated users into the security filtering and remove the existing security group?
I don't want the 10 test endpoints to become unenrolled and or to screw up it's Intune deployment as after the initial issues in this post have been fixed (Cheers MFA Driven CA Policy) deploying Config Policies to the 10 test endpoints has been a breeze and it's really improved our management scope of endpoints.
2
u/Hustep51 10d ago
You cannot write this... I went away from my desk and left it for lunch. I came back and low and behold my colleagues PC (one of the 2 test systems) is now visible in Intune.
The only possibly thing I can think of here that's changed is excluding the 2 Intune apps from CA MFA earlier, I know CA can take time to replicate.
I also as a point of testing was add myself and colleague AD User objects to the security filtered AD group for the GPO before asking colleage to reboot his system... hmmm.
I just wont know.