We are rolling out Intune Compliance and Configuration Policies. MDM (Enrolled) for corporate devices and MAM (unenrolled) for Personal devices. We are using MDM and MAM to rollout (Windows Information Protection) WIP. We are not using Config Manager, and all devices are Azure AD Hybrid Joined.
This blog focusses on Windows 10 devices and does not cover MacOS, iOS or Androids.
First off, let me tell you, you’re probably going to have to raise a ticket with Microsoft so if you haven’t done that yet, you might as well go and do it now. Two of my tickets ran for 4 months, in fact the second one for WIP is still running… I have spoken to around 12-15 different Intune support staff. Be prepared to run dsregcmd – a lot.
Remote Access: If you are troubleshooting your own device great! The support engineer at some point will ask to see the problem and direct you here https://support.microsoft.com/help pop in a code and you can share the issue. However, if you are trying to resolve an end user device that is going to be pretty unlikely and very few support engineers are willing to come on to a Teams meeting and share screen that way. So now you have to act as the middleman and go back and forth with the end-user asking them to get screenshots, logs. Asking users to access the registry and event logs is really not something you want to do. They may be required to run certain tasks from an elevated prompt – which they might not be able to do.
For my first ticket it took a lot of escalation and ticket transfers only to learn that this “error”
State Details -2016345708 (Syncml(404): The requested target was not found.) Error Code 0x87d10194
Simply means that Windows itself can’t report back to the Intune agent for Code integrity, BitLocker or Secure Boot. This is because the device does not support it and therefore the device does not in fact pass the test and is essentially simply NOT COMPLIANT. For us, this was because the workstations had older TPMs or no TPM. For checking for BitLocker we had to go away from Windows Health Attestation Service evaluation rules “require BitLocker” and only use System Security and set Require Encryption of data storage on device
Minimum Requirements
The second thing I’ll tell you is that unless you are Using Windows 10 Enterprise with modern hardware, you’re probably not having much joy. If you are still using Windows 7 – Intune isn’t for you.
A few nuggets early on:
Workstation accounts are synchronized to Azure AD via AAD Connect. You may see the devices you want to work with in “Azure AD Devices” but not yet under “All Devices” All Devices is where you see Intune managed devices after they have been enrolled. This is relevant when you are trouble shooting because you will find yourself at some point unenrolling devices at the workstation and deleting devices from Azure AD Devices and All Devices. At that point you need to then initiate an AAD Connect sync to get the device back.
NOTE: Only auto-enrolled devices via GPO will show up as Corporate. If a user or administrator undertakes any of the enrolment task manually at the device, then it will be recorded as a Personal Device
For Windows 10 we use a GPO to enrol Windows 10 machines into Intune: https://docs.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy
When a group policy refresh occurs on the client, a task is created and scheduled to run every 5 minutes for the duration of one day. Those computer accounts also obviously need to be in the OU where you are applying the GPO!
The task is called “Schedule created by enrollment client for automatically enrolling in MDM from AAD.” (Look for it in Task Scheduler Library\Microsoft\Windows\EnterpriseMgmt)
When (not if) you raise a Microsoft ticket they will want to know the version of Windows you are running, and then tell you to update it.
WinVer at start run, (or just run “ver” from a command prompt) e.g. Microsoft Windows [Version 10.0.18363.836]
Group Policy Objects
Task Scheduler
Access work or school and Advanced Diagnostic Report
Go to Windows Settings (Windows Key + I) \ Accounts\Access work or school. If you don’t see the monochrome briefcase icon, then your machine is not enrolled. Check at dsregcmd /status
Click on Info. Here you should see a useful section called: Areas managed by [organization name]
Policies e.g.
Further down you also will see Device sync status. It is here where a user can manually initiate a device sync back to Intune
Advanced Diagnostic Report:
Scroll to Bottom “Create Report”
The report is created here: C:\Users\Public\Documents\MDMDiagnostics\MDMDiagReport.html There is useful extended information here.
Device State – dsregcmd
From an elevated command prompt: dsregcmd /status
Windows Event Logs:
Look at both Admin & Operations
Admin is where you will be mainly looking. You can also enable Debug by going to View on the Menu bar and choosing “Show Analytics and Debug Logs” Filter by Critical, Warning and Error
Windows Information Protection (WIP) is here:
The registry:
The Intune portal would lead you to believe it has good reporting capabilities. It doesn’t.
Sure, if you want some high-level overall stats then maybe, but if you want to do filtering down to certain types of issues it’s pretty much hopeless. There is no ‘one place’ that you can do reports from. It jumps all over the place. Sometimes you can filter and choose columns, other places you can’t. Some columns are sortable, some are not. Some views have the column for Error state, some do not. Policy compliance does, Settings compliance does not.
Now, you would think with Microsoft touting all its Machine Learning, AI, Big Data Analytics, Power BI it would be there. It isn’t. There is a Power BI module but there isn’t really any documentation how to make that work for your specific needs. It’s “pretty” of course.
I’ve heard people say “use the Graph API”. Well, that has limitations and it’s complicated to use when really you should just be able to drill down and down to what you need from the UI. Plus, the Graph has limitations due to throttling and often you will have to loop in batches of 100.
What I wanted a report of was:
A list of only the Windows 10 Devices failing any one specific setting e.g. Require secure boot.
If I go to Microsoft Intune\Device compliance\Settings compliance I can see that I have:
(Total 1,410)
Where is the Error devices column when you need it?! I know for a fact some are in an error state.
So I click on the row for my Compliance setting (Require secure boot) that I want to check. I can now see a list of devices with headings for: Device, UPN, Compliance Status, Device Model. I can’t filter here and I can’t sort on Compliance Status.
OK, no worries I’ll export the CSV and work with that. So I export the CSV and I have 3,526 rows returned?! What happened to the 1,410.
18 are listed as Compliance Status as Error. Un, so is that error for the one setting I am wanting to work with, or a general error status for the whole device across all policies? Useless.
If I run de-dupe on the Device column, turns out I have 2,122 duplicate values. Not sure I can use that data. Even a full export from Devices returns me 1,421 Windows Devices (with 12 duplicates)
Every time I get on a call with Microsoft I ask them how I can do this. I get a variation of responses from “I see your point, that would be a good feature”, to, “I’ll take that away and see what we can do” – so far I have not yet been able to get this report.
How did we get around this?
I ended up creating a single compliance policy per setting that I want to isolate then go to the Microsoft Intune\Device compliance\Policy Compliance (under Monitor).
That shows me completely different numbers:
When I click on my Policy row my headings are Device, UPN, Compliance Status, last update status. In here I also see a whole ton of not evaluated devices, so I export this to CSV.
I have 1,368 rows in the CSV – but at least I now have the 15 Error devices. (Three of which start with a devices name that should be excluded from this policy. Sigh).
The CSV export tells me I have 299 Compliant devices. Um…. what happened to the 512 number? 238 not compliant (so what was the 226?) 611 Not evaluated. I also have 5 Not applicable. That’s helpful.
If I pick one device name at random and go look in All devices it tells me it is Compliant – until I click on it and then I see it is only Compliant for the Built-in Device Compliance Policy but the other 7 are still not evaluated.
Did I already say that Intune Reporting is, shall we say, not where it needs to be?
Troubleshoot Windows device enrollment problems in Microsoft Intune https://docs.microsoft.com/en-us/mem/intune/enrollment/troubleshoot-windows-enrollment-errors
For us, this is a baseline requirement along with Windows Defender and Firewall. If you want to do anything like Security checking of workstations including checking for BitLocker, SecureBoot and Code Integrity the golden rule will be:
Taken from here: https://docs.microsoft.com/en-us/windows-hardware/test/hlk/testref/954cf796-a640-4134-b742-eaf0ed2663ff
How to check.
From an elevated PowerShell prompt run:
A Windows 10 device with secure boot enabled shows as Not Compliant in Intune https://support.microsoft.com/en-us/help/4456680/windows-10-device-with-secure-boot-enabled-shows-as-not-compliant-intu