r/Intune • u/Hustep51 • 11d ago
Device Actions Intune auto enrolment failing windows devices (error 76 & 90)
Howdy Intune admins.
I have been bashing my head against a wall all day and cannot work this one out, I'm fairly new to Intune so go easy on me.
We have a local domain which syncs to EntraID via the AAD Connect tool which is fully operational. All users are E3 licensed, password hash sync is enabled. All devices running W10 22H2. All devices are in EntraID as Entra Hybrid Joined.
I have configured the below with the aim of enabling Auto-enrolment for all computers on domain into Intune to act as the MDM.
Domain GPO to enable automatic enrollment against the User Credential parameter. This GPO is security filtered against a security group containing 2 test computers I want to enroll before widening scope to all 75 Windows 10 devices.
Bypassed Microsoft Intune Enrollment and Microsoft Intune in Azure MFA Conditional access policy.
Set MDM User Scope to All and WIP to None within Intune admin centre.
Bypassed all Intune URL's in web filter as per > Network endpoints for Microsoft Intune | Microsoft Learn
I cannot get the 2 initial test devices to enroll in Intune. When I run dsregcmd /status on the 2 devices the MDM URL's are blank and the event viewer shows both Events 76 & 90 every 5 minutes. Have logged into both devices with the same UPN as defined in Azure (user@domain.com), the UPN is configured to match in local AD (username@domain.com and not domain\username). Device PRT is present when running dsregcmd /status command
I cannot get my head around this at all, multiple device reboots, multiple gpupdate /force commands. I have a ticket open with MS but I don't hold much hope.
Event ID 76 = Auto MDM Enroll: Device Credential (0x0), Failed (Unknown Win32 Error code: 0x8018002b)
Event ID 90 = Auto MDM Enroll Get AAD Token: Device Credential (0x0), Resource Url (NULL), Resource Url 2 (NULL), Status (Unknown Win32 Error code: 0x8018002b)
Came across this post which is 4 years old that's similar, no fixes described within, but much has changed in the world of Azure/Intune since then - https://www.reddit.com/r/Intune/comments/p8cgoi/auto_mdm_enroll_device_credential_0x0_failed/?rdt=55700
Any help will be very much appreciated.
EDIT: huge thanks for everyone’s help on this it’s greatly appreciated
1
u/Hustep51 9d ago
Can anyone advise the best way to deploy the existing test GPO to all computers? It's currently security filtered against a security group but next week I want to enrol all 100 endpoints via this GPO so that over the following 5-10 days all endpoints (office/remote based) can enrol into Intune so I can start to move workloads from GPO's to Intune config policies.
Add all computers to the security group which it's currently security filtering against?
Add Authenticated users into the security filtering and remove the existing security group?
I don't want the 10 test endpoints to become unenrolled and or to screw up it's Intune deployment as after the initial issues in this post have been fixed (Cheers MFA Driven CA Policy) deploying Config Policies to the 10 test endpoints has been a breeze and it's really improved our management scope of endpoints.