Forum Discussion

JimmyWork's avatar
JimmyWork
Iron Contributor
Jun 10, 2023

Enforcing blank value in Settings Catalog, Local Security policies User Rights

When trying to enforce a blank value using settings catalog to set UserRights it will throw error in Event Viewer.

 

Example: Settings Catalog - User Rights - Lock Memory.

When trying to use any of the following values you will get an error back, in Event Viewer or in the Intune Policy report.

 

Example values below.

MDM PolicyManager: Merge of policy did not complete successfully, Policy: (LockMemory), Area: (UserRights), Result:(0x8000FFFF) Catastrophic failure.

 

Value: </>
(Fails in Event viewer and gives no change on the policy)

Value: <Data></Data>
(Fails in Event viewer and gives no change on the policy)

Value: *
(Fails in Event viewer and gives no change on the policy)

Value: ""
(Fails in Event viewer and gives no change on the policy)

Value: <![CDATA[]]>
(Works on Event viewer gives correct value on policy on the device, but Error on policy in Intune)

 

OMA-URI Working but not Settings Catalog for same values.

When using OMA-URI: ./Device/Vendor/MSFT/Policy/Config/UserRights/LockMemory

Value: <![CDATA[]]>

 

*UPDATE*

Still testing values but <![CDATA[]]> works, but an error is displayed on the Intune policy, not in the Event logs.

 

Using full XML file is currently the only way I can get this to work for both Event Logs and Intune policy, so no errors are displayed. This should not be the case.

 

<SyncML xmlns="SYNCML:SYNCML1.2">

<SyncBody>
    <Replace>
      <CmdID>2</CmdID>
      <Item>
        <Meta>
          <Format>chr</Format>
          <Type>text/plain</Type>
        </Meta>
        <Target>
          <LocURI>./Device/Vendor/MSFT/Policy/Config/UserRights/LockMemory</LocURI>
        </Target>
        <![CDATA[]]>
      </Item>
    </Replace>
  <Final/>
  </SyncBody>
</SyncML>

 

  • JimmyWork's avatar
    JimmyWork
    Iron Contributor

    *UPDATE 2*

     

    The full XML file will only work until the device have been rebooted.

    Then the Event viewer will show the following errors.

    Intune will not display any error and the policy is applied correctly.

     

    Error in Event viewer.

    MDM PolicyManager: Merge string, Area: (UserRights), Policy: (LockMemory), EnrollmentID requesting merge: (CBFF7B6D-8C51-4498-BB37-338EFCB9892E), Result:(0x8000FFFF) Catastrophic failure.

     

    MDM PolicyManager: Merge of policy did not complete successfully, Policy: (LockMemory), Area: (UserRights), Result:(0x8000FFFF) Catastrophic failure.

     

    If anyone know how to set a blank value without generating errors please let me know, the Microsoft documentation does not work.

  • Al_thaha's avatar
    Al_thaha
    Copper Contributor

    JimmyWork We are also facing this issue since we enabled the CIS benchmark policies. I cannot login into the machine. Either with local admin account which has LAPS password :(. Any suggestions would help.

Resources