How to find Microsoft Intune Device Enrollment issues

Troubleshoot Microsoft Intune Device Enrollment Issues

Successfully deploying devices at scale through Microsoft Intune in your enterprise environment is key for your operations, however enrollment failures – regardless of it occurring through Windows Autopilot or standard MDM registration – will quickly bring your entire provisioning flow to a halt, and debugging failures can feel like finding a needle in a hay-stack.

This article outlines the precise tools, logs and registry keys to examine in order to isolate and fix bottlenecks during Intune device enrollment.

1. Understand ESP Errors

Often a device will stall on the ESP during Windows Autopilot, presenting "Something went wrong". This can often be attributed to an error the device returned when trying to enroll.

Do not click the "Show details" button, often this provides a Hex error code for the specific enrollment issue. Some of the most commonly seen codes are:

0x801c0003 This often signifies that the user does not have permission to enroll the device into Windows Autopilot, check Intune Device Enrollment restrictions to ensure the user has this permission.

0x800705b4 This is your standard timeout, it commonly occurs with Win32 applications which install slowly, or the heavy configuration policy took longer than allowed on the ESP to apply.

2. A Dive into Windows Event Viewer

When the cloud interface alone does not suffice to gather information, the local client's Event Viewer contains the definitive truth.

On the local Windows box exhibiting the problem, launch Event Viewer (eventvwr.msc) and expand the following path:

Applications and Services Logs -> Microsoft -> Windows -> DeviceManagement-Enterprise-Diagnostics-Provider -> Admin

Find the Error level events within the Event Log. This log captures each sweep, certificate exchange, and policy check between the local Windows machine and Intune.

3.Collect logs with MDM Diagnostic Tool

This produces an all-in-one CAB or ZIP file with event logs and registry dumps.

When OOBE/ESP (Stuck setup): Open command prompt with shift + F10 then run

powershell.exe

mdmdiagnosticstool.exe -area "DeviceEnrollment;DeviceProvisioning;Autopilot" -cab C:\AutopilotLogs.cab

When Post- provisioning (Device is on Desktop): run from elevated PowerShell or Command Prompt:

mdmdiagnosticstool.exe -area "DeviceEnrollment;DeviceProvisioning;Autopilot" -zip C:\MDMDiagReport.zip

Also have some custom module Autopilot diagnostics in poershell to easily inteprpet the logs

Install-Script -Name Get-AutopilotDiagnostics -Force

 

Improve ESP Configuration

A quick win to shorten time to enrollment is by reducing what the device must be configured to block at setup.

1. Update the "Block device use until all apps and profiles are installed" setting from All to Selected and only list the mission-critical applications, and let other secondary productivity applications continue to install silently in the background when the user logs in.

2. Review and Optimize App Bundling

If you are pushing Win32 apps using Powershell wrappers or custom detection scripts ensure that the scripts themselves are optimized: