Troubleshooting
Systematic diagnosis guides for Intune, Windows, Group Policy, and Entra ID, with decision trees, log locations, validation steps, and practical fixes.
14 articles
Each troubleshooting page is written around observable state: logs, portal status, Graph output, event IDs, policy assignments, and device-side symptoms.
AdminSignal favours diagnosis before reset actions. Clear caches, delete registry keys, or re-enrol devices only when evidence points there and rollback impact is understood.
Validation matters as much as the fix. Use the follow-up checks to confirm policy state, reporting, user impact, and whether the same fault is likely to recur.
A documentation-reviewed path for hybrid devices where a GPO and an Intune profile both target the same Windows setting. Prove the winner before anyone enables MDMWinsOverGP.
Includes a redacted home-lab CoManagementHandler and WUAHandler excerpt for the handler and scan only. The workload-slider decision path was not lab-tested, and UseWUServer was not set.
AppEnforce: installer exit 0, then failed detection. One deployment excerpt.
Classify a Configuration Manager application failure as content, detection, requirement, or enforcement before wrapping the same source as Intune Win32.
A practical troubleshooting guide for Company Portal hangs and incomplete MDM enrollment on Windows, covering Entra join state, licensing, automatic enrollment, Conditional Access catch-22s, logs, safe retry, and prevention.
A practical troubleshooting guide for Windows Autopilot import failures, covering hardware hash collection, CSV validation, duplicate records, tenant permissions, Intune Connector checks, deployment profile assignment, dynamic groups, Graph, safe retry, and recovery.
A practical troubleshooting guide for Windows devices that stop syncing with Intune, covering portal checks, MDM enrolment state, Company Portal, scheduled tasks, event logs, registry evidence, IME health, network issues, Entra device objects, Graph checks, safe retry, and recovery.
A practical troubleshooting guide for Microsoft Entra dynamic groups that do not update, including rule syntax, user and device attributes, Graph checks, processing delays, Intune assignment impact, Autopilot targeting, stale device objects, and safe recovery.
HealthScripts: three policy results and report delivery. Portal statuses not captured.
A practical troubleshooting guide for Intune Remediations that do not run, detect, remediate, or report correctly, covering licensing, exit codes, schedules, IME logs, PowerShell context, reporting delay, retry, and rollback.
A practical troubleshooting guide for stuck Intune Win32 app installs, covering IME health, AppWorkload.log, detection and requirement rules, targeting, dependencies, supersedence, Company Portal sync, retry, and rollback.
A practical diagnostic guide for Windows Update for Business deferrals that are ignored, overwritten, or blocked by feature update policies, quality update policies, Group Policy, WSUS, MECM, or co-management.
The ESP hanging at 0% is one of the most common Autopilot failures. This guide walks through the diagnostic sequence: Event Viewer locations, MDM logs, and the six most frequent root causes.
Computer RSoP: one applied GPO and one denied by security filtering.
Before running gpupdate /force for the third time, follow this decision tree: scope filtering, link order, security filtering, loopback processing, and slow-link detection are all common culprits.
When Intune reports a device as "Not evaluated" or stuck in a compliance state that does not reflect reality, the issue is usually one of four things — and this checklist covers all of them.
BitLocker keys failing to escrow to Entra ID is a silent failure — no error on the device, no alert in Intune. Here is how to detect it, force escrow, and prevent it from recurring.
