Forum Discussion

josvds's avatar
josvds
Brass Contributor
Jan 18, 2023

Intune compliance issues Windows 11 22H2

We have unboxed several new "HP ProBook 450 G9" devices and connected them to MDM with AutoPilot. We installed these devices and they should be marked compliant based on the settings we have applied ...
Intune
Mobile Device Management (MDM)
Rudy_Ooms_MVP's avatar
Rudy_Ooms_MVP
MVP
Hi.... Could you check if the Tpm-HASCertRetr task in the microsoft\windows\tpm task has been run successfully lately?

I had the same issue and I stumbled upon this task somehow missing in action.. after manually restoring that service it worked
buckbaggen's avatar
buckbaggen
Brass Contributor
Jan 30, 2023
Hi, the tasks fails! How did you fixed the task?

Currently reinstalling the device with English Windows, so i can post screenshots /error codes.

The strange thing was, i allready added English US language pack, deleted the other languages, setted everything to English US... Everything except the error message in task scheduler is Enlgish... That's why i'n reinstalling it with an English ISO.
  • Rudy_Ooms_MVP's avatar
    Rudy_Ooms_MVP
    MVP
    Jan 30, 2023
    Ahhhh thats somehow nice to hear...I am looking with the IDA tool right now what exactly happens when launching that task .. as mentioned here... that task is indeed responsible;e for sending out the dha data to the dha service (that is forwarded to intune later on.. )

    https://call4cloud.nl/2021/10/device-health-attestation-age-of-compliance/#part5
    Inside that dha data... your bitlocker /secure boot/codeintegrity status exists...
    • buckbaggen's avatar
      buckbaggen
      Brass Contributor
      Jan 30, 2023

      This error is what i get.

      But how did you restore it, in your previous message you said: after manually restoring that service it worked Rudy_Ooms_MVP 

      • Rudy_Ooms_MVP's avatar
        Rudy_Ooms_MVP
        MVP
        Jan 30, 2023

        I exported that task from another device with powershell and imported it back on that device... but getting that message.. that scheduled task should use the verifydevicehealth function wich is pulled from the tpmcoreprovisioning.dll that the tpmtasks.dll (which that task uses) imports.

        Feel free to reach out to me on twitter....  as I am pretty curious about what a procmon trace should show you when you run that task... i guess it should show you something.. (would love to look at it)

         

        You could also call upon that function yourself...  this line below should trigger the same thing as that task should trigger...

         

        rundll32 tpmcoreprovisioning.dll,TpmVerifyDeviceHealth

Resources