Forum Discussion

josvds's avatar
josvds
Brass Contributor
Jan 18, 2023

Intune compliance issues Windows 11 22H2

We have unboxed several new "HP ProBook 450 G9" devices and connected them to MDM with AutoPilot. We installed these devices and they should be marked compliant based on the settings we have applied ...
Intune
mobile device management (mdm)
Rudy_Ooms_MVP's avatar
Rudy_Ooms_MVP
MVP
Jan 30, 2023

It contains some errors :)... (just started it looking at it) but the activityerrors are going to show me where to search

{2147942402; onecore\base\ngscb\tpmhli\lib\registry.cpp; 506; TpmCoreProvisioning.DLL; 1; ; 7072; \TpmCoreProvFunction\activityVerifyDeviceHealth\TpmCoreProvFunction\activityTpmRetrieveHealthCertificate; 2; TpmCoreProvFunction; TpmCore::VerifyDeviceHealth; 6; activityTpmRetrieveHealthCertificate; }, , , , ,

 

EDIT: Yep....ErrorMessage="The X509 certificate cannot be validated. Intermediate CA cannot be trusted as its not present in the TrustedTpm_IntermediateCA store

 

So it looks like the healthcertificate its intermediate cert isnt trusted (not found/file not found) in that store.... without that trust  I guess its hard to successfully transfer data to the service

 

Let me wake up and try to determine what it should look like so we can have a look at your certificate... (export it from the blob in the registry)

  • Rudy_Ooms_MVP's avatar
    Rudy_Ooms_MVP
    MVP
    Jan 31, 2023

    Could you try to run these commands.
    *Install the required module

    Install-Module LocalMDM

    *Open a new powershell session with the mta switch

    powershell -mta

    *Define the csp we want to fetch

    $test1 = @"
    <SyncBody>
    <Get>
    <CmdID>2</CmdID>
    <Item>
    <Target>
    <LocURI>./Device/Vendor/MSFT/HealthAttestation/Certificate</LocURI>
    </Target>
    </Item>
    </Get>
    </SyncBody>
    "@

    *send the request to the csp
    send-localmdmrequest -SyncML $test1

     

    Also wondering how the settings are defined here:

    \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TPM\WMI\TaskStates

  • Rudy_Ooms_MVP's avatar
    Rudy_Ooms_MVP
    MVP
    Jan 31, 2023
    ehhh i am missing the SignedHealthCert blob in it... there should be something in it... if that's missing...