Forum Discussion
Enforcing blank value in Settings Catalog, Local Security policies User Rights
When trying to enforce a blank value using settings catalog to set UserRights it will throw error in Event Viewer.
Example: Settings Catalog - User Rights - Lock Memory.
When trying to use any of the following values you will get an error back, in Event Viewer or in the Intune Policy report.
Example values below.
MDM PolicyManager: Merge of policy did not complete successfully, Policy: (LockMemory), Area: (UserRights), Result:(0x8000FFFF) Catastrophic failure.
Value: </>
(Fails in Event viewer and gives no change on the policy)
Value: <Data></Data>
(Fails in Event viewer and gives no change on the policy)
Value: *
(Fails in Event viewer and gives no change on the policy)
Value: ""
(Fails in Event viewer and gives no change on the policy)
Value: <![CDATA[]]>
(Works on Event viewer gives correct value on policy on the device, but Error on policy in Intune)
OMA-URI Working but not Settings Catalog for same values.
When using OMA-URI: ./Device/Vendor/MSFT/Policy/Config/UserRights/LockMemory
Value: <![CDATA[]]>
*UPDATE*
Still testing values but <![CDATA[]]> works, but an error is displayed on the Intune policy, not in the Event logs.
Using full XML file is currently the only way I can get this to work for both Event Logs and Intune policy, so no errors are displayed. This should not be the case.
<SyncML xmlns="SYNCML:SYNCML1.2">
<SyncBody>
<Replace>
<CmdID>2</CmdID>
<Item>
<Meta>
<Format>chr</Format>
<Type>text/plain</Type>
</Meta>
<Target>
<LocURI>./Device/Vendor/MSFT/Policy/Config/UserRights/LockMemory</LocURI>
</Target>
<![CDATA[]]>
</Item>
</Replace>
<Final/>
</SyncBody>
</SyncML>
- JimmyWorkIron Contributor
*UPDATE 2*
The full XML file will only work until the device have been rebooted.
Then the Event viewer will show the following errors.
Intune will not display any error and the policy is applied correctly.
Error in Event viewer.
MDM PolicyManager: Merge string, Area: (UserRights), Policy: (LockMemory), EnrollmentID requesting merge: (CBFF7B6D-8C51-4498-BB37-338EFCB9892E), Result:(0x8000FFFF) Catastrophic failure.
MDM PolicyManager: Merge of policy did not complete successfully, Policy: (LockMemory), Area: (UserRights), Result:(0x8000FFFF) Catastrophic failure.
If anyone know how to set a blank value without generating errors please let me know, the Microsoft documentation does not work.
- taikuliCopper Contributor
JimmyWork You can try to assign the Null SID (S-1-0-0). This way you can enter "nobody" as a value.
For reference see Well-known SIDs - Win32 apps | Microsoft Learn