Forum Discussion
Intune Enrollment via GPO User eXperience
StuartK73 Could you please share some more information about your setup?
- What GPO settings did you apply?
- Is this not working for any machines that's joined to local AD?
When you set the gpo for device enrollment, the end machine will need to reboot and login. Once logged in, if you go to windows settings, you should see an info button on the work or school account which confirms that your machine is joined to Hybrid Azure AD.
Another way to check is to run the command dsregcmd /status.
More troubleshooting steps: https://docs.microsoft.com/en-us/azure/active-directory/devices/troubleshoot-hybrid-join-windows-current
Yes, the machines are showing as Hybrid Azure AD Join but not as enrolled in Intune.
Stuart
StuartK73 I had similar issues with on my tenant where devices will show in Azure AD Devices as Hybrid Azure AD Join but not in All Devices and the MDM state is shown as none. The fix for my case was to set 2 GPO policy settings (As per MS Support, the first device registration policy adds the device to Azure AD and MDM part enrolls the device to intune, and we need to have both to get the devices fully managed via intune/MDM)
If you do not see the policy, it may be because you don’t have the ADMX installed for Windows 10, version 1803 or version 1809. To fix the issue, follow these steps:
- Download:
1803 -->https://www.microsoft.com/en-us/download/details.aspx?id=56880 or
1809 --> https://www.microsoft.com/en-us/download/details.aspx?id=57576. - Install the package on the Primary Domain Controller (PDC).
- Navigate, depending on the version to the folder: 1803 --> C:\Program Files (x86)\Microsoft Group Policy\Windows 10 April 2018 Update (1803) v2, or
1809 --> C:\Program Files (x86)\Microsoft Group Policy\Windows 10 October 2018 Update (1809) v2 - Copy policy definitions folder to C:\Windows\SYSVOL\domain\Policies.
- Restart the Primary Domain Controller for the policy to be available. This procedure will work for any future version as well.
My environment is as follows:-
On Premise AD
Hybrid Azure AD Joined devices using AD Connect
I was also facing the same situation where the status of the MDM was None rather than Microsoft Intune for my Windows 10 devices.
Ambarish I followed that extra step to Register domain joined computers as devices and now it seem to work. I would why this setting is needed given the device is already Hybrid Azure AD Joined?
Previously I did get this to work but only when the device was line of sight to my on premise AD. i.e. in the office. So I thought that was just the limitation of auto enrolment.
Because all my users are now WFH due for COVID I will need to try this with some other devices but it now looks more positive.
- Download:
