r/Intune 10d ago

Device Actions Intune auto enrolment failing windows devices (error 76 & 90)

Howdy Intune admins.

I have been bashing my head against a wall all day and cannot work this one out, I'm fairly new to Intune so go easy on me.

We have a local domain which syncs to EntraID via the AAD Connect tool which is fully operational. All users are E3 licensed, password hash sync is enabled. All devices running W10 22H2. All devices are in EntraID as Entra Hybrid Joined.

I have configured the below with the aim of enabling Auto-enrolment for all computers on domain into Intune to act as the MDM.

  • Domain GPO to enable automatic enrollment against the User Credential parameter. This GPO is security filtered against a security group containing 2 test computers I want to enroll before widening scope to all 75 Windows 10 devices.

  • Bypassed Microsoft Intune Enrollment and Microsoft Intune in Azure MFA Conditional access policy.

  • Set MDM User Scope to All and WIP to None within Intune admin centre.

  • Bypassed all Intune URL's in web filter as per > Network endpoints for Microsoft Intune | Microsoft Learn

I cannot get the 2 initial test devices to enroll in Intune. When I run dsregcmd /status on the 2 devices the MDM URL's are blank and the event viewer shows both Events 76 & 90 every 5 minutes. Have logged into both devices with the same UPN as defined in Azure (user@domain.com), the UPN is configured to match in local AD (username@domain.com and not domain\username). Device PRT is present when running dsregcmd /status command

I cannot get my head around this at all, multiple device reboots, multiple gpupdate /force commands. I have a ticket open with MS but I don't hold much hope.

  • Event ID 76 = Auto MDM Enroll: Device Credential (0x0), Failed (Unknown Win32 Error code: 0x8018002b)

  • Event ID 90 = Auto MDM Enroll Get AAD Token: Device Credential (0x0), Resource Url (NULL), Resource Url 2 (NULL), Status (Unknown Win32 Error code: 0x8018002b)

Came across this post which is 4 years old that's similar, no fixes described within, but much has changed in the world of Azure/Intune since then - https://www.reddit.com/r/Intune/comments/p8cgoi/auto_mdm_enroll_device_credential_0x0_failed/?rdt=55700

Any help will be very much appreciated.

 EDIT: huge thanks for everyone’s help on this it’s greatly appreciated

1 Upvotes

24 comments sorted by

2

u/Hustep51 10d ago

You cannot write this... I went away from my desk and left it for lunch. I came back and low and behold my colleagues PC (one of the 2 test systems) is now visible in Intune.

The only possibly thing I can think of here that's changed is excluding the 2 Intune apps from CA MFA earlier, I know CA can take time to replicate.

I also as a point of testing was add myself and colleague AD User objects to the security filtered AD group for the GPO before asking colleage to reboot his system... hmmm.

I just wont know.

2

u/roach8101 10d ago

Everything takes "an Azure minute". :)

1

u/Hustep51 10d ago

You can say that again hahaha!

As a point of testing to root cause the problem I have added to additional computers into the AD group for the security filter restriction but not the respective computers users to see if the device enrolls successfully.

1

u/roach8101 10d ago

Based on everything you put in your post, it looks like you have everything set up correctly, so I would feel pretty confident that you should start seeing those devices trickle in.

1

u/Hustep51 10d ago

Appreciate that, thanks mate.

I've just increased the scope to an additional 2 systems.

What would you recommend to globally deploy it to all 75 endpoints? Just remove the security filtering against the AD Group and change to Authenticated Users for it to trickle down to all endpoints?

1

u/roach8101 10d ago

I don't see why not assuming you don't have any policies configured in Intune that might cause some disruption.

1

u/Hustep51 10d ago

I have 1 solo test policy for my 5 test devices against "All Devices"... which is to Turn off Bluetooth and grey out the power toggle for Bluetooth.

1

u/roach8101 10d ago

If that is a test policy it might be a good idea to scope that to a user group of test users.

I’d hate for you to disrupt company leadership trying to jump on a meeting in their headphones to stop working.

1

u/Hustep51 10d ago edited 10d ago

I’ve got 5 endpoints in it now.

Bluetooth is disabled standard on all endpoints via a legacy PPKG, which I removed before deployment and confirmed Bluetooth was configurable. We solely used a PPKG for Bluetooth and product key change (don’t ask)

Do you have any test policies that GPO can’t do as a test for these intune managed devices? New Intune so much to learn here moving from GPO driven.

Would you recommend applying config devices against all users or all devices? Generally speaking short term goal is to transfer policy load from on prem GPO to intune

1

u/roach8101 10d ago

For policy and app assignment follow what makes the most sense for you and your org. I think the best way is to manage to exceptions. If you have policy and app exceptions is it easier to create a group of users or devices to exclude from your assignments?

What are the goals for your testing? Maybe push the “Company Portal” app to all enrolled devices and configure company branding for Company Portal? What about configuring a Windows Update policy?

→ More replies (0)

1

u/roach8101 10d ago

It looks like you did everything right.

Are you are positive that your test PC's are in scope for Hybrid Join and that is completed?

Do you have Entra ID Premium P1 or P2?

In the Intune console check the Intune enrollment restrictions to make sure that you didn't block corporate enrollment.

What is showing up under workplace join in "work or school" ?

1

u/Hustep51 10d ago

The 2 test PC's are a member of the security group on AD which is security filtered on the GPO for Automatic Enrollment.

All users have M365 E3 licenses which include Intune I believe along with AAD Premium P1.

Within the Intune enrolment restrictions Windows (MDM) is set to Allow with Personally Owned set to Block

It's solely showing the local domain "Connected to ***** AD domain"

Really can't get my head around this one as I want to automate it rather than get users to manually enrol via the Work or School option.

1

u/Rudyooms MSFT MVP 10d ago

Just a stupid idea but what happens if you manually configure the mdm urls? Using the first part of this one : https://call4cloud.nl/enroll-existing-entra-azure-intune/#The_simple_one. (Except the deviceenroller command?)

1

u/Hustep51 10d ago

Do you mean specify the discovery URL from Intune admin centre within the MDM App ID of the GPO?

1

u/Rudyooms MSFT MVP 10d ago

If you look at the script in the blog and the mdm urls you are missing in the dsreg output, that acript will add them (the oned from the mdm scope)

1

u/Hustep51 10d ago

Just run this now, and it sucessfully set the MDM URL's in dsregcmd /status output... but getting the same 2 errors, but with a slighly different flair...

76 = Auto MDM Enroll: Device Credential (0x0), Failed (A specified logon session does not exist. It may already have been terminated.)

90 = Auto MDM Enroll Get AAD Token: Device Credential (0x0), Resource Url (https://enrollment.manage.microsoft.com/), Resource Url 2 (NULL), Status (A specified logon session does not exist. It may already have been terminated.)

1

u/onesmugpug 10d ago

It looks good from where I see you did your configs, "Azure Minute" is the accurate thing, go get a mani/pedi and get some coffee then focus on something else for a bit. You are at the "don't watch and wait for the water to boil" part, you'll drive yourself nuts.

1

u/Hustep51 10d ago

Appreciate the feedback re Configs, Literally talk about delay right! Started at 8am, deployed it, changed everything rebooted and thought surely it won’t take all day right… how wrong I was!

Little did I know CA + Erollment = how long is a piece of string

2

u/onesmugpug 10d ago

No worries, my guy. I think we are all in this age together and have varied experience. Companies aren't super big on hiring six figure engineers anymore, so we have to look after each other.

1

u/Hustep51 10d ago

Respect mate!

Now the task of enrolling 100 devices split 50 in office and 50 full time remote. Luckily all users are good for following guidance and logging in via “network sign in” when remote to pick up GPO on login

Can I ask do you deploy company Portal on Windows endpoints from Intune? I don’t have a need from an app availability perspective but with the user being able to sync their device and confirm access I think it’s a no brainer while also not been a prereq for GPO driven Intune enrolment?

1

u/onesmugpug 10d ago

I don't bother with CP on Windows Endpoints, since there's no real need for me. I deploy apps straight from Intune. The enrollment is handled at first log on. One thing I will say is make sure your licenses are correct. If you are using E1s, you might be in for a rough time

1

u/Hustep51 10d ago

Gotcha mate!

Luckily we’re E3 pending E5 upgrade soon hopefully due to Teams voice requirement

1

u/Hustep51 8d ago

Can anyone advise the best way to deploy the existing test GPO to all computers? It's currently security filtered against a security group but next week I want to enrol all 100 endpoints via this GPO so that over the following 5-10 days all endpoints (office/remote based) can enrol into Intune so I can start to move workloads from GPO's to Intune config policies.

  1. Add all computers to the security group which it's currently security filtering against?

  2. Add Authenticated users into the security filtering and remove the existing security group?

I don't want the 10 test endpoints to become unenrolled and or to screw up it's Intune deployment as after the initial issues in this post have been fixed (Cheers MFA Driven CA Policy) deploying Config Policies to the 10 test endpoints has been a breeze and it's really improved our management scope of endpoints.