Forum Discussion

Paulo Silva's avatar
Paulo Silva
Brass Contributor
Jul 26, 2018
Solved

MDM Compiant

Hello, i'm in my invironment and in the 1st device that I add the device was marked as "enrolled in Microsoft Intune and Compliant" but don't recognize my account as owner. on the other hand I was ab...
Intune
mobile device management (mdm)
  • Paulo Silva's avatar
    Paulo Silva
    Aug 02, 2018

    Hi Oliver, 

    Now it worked!

     

    I was pointing my windows hello GPO with MDM GPO for a group of users and not for a group of Machines as showed at the image.

     

    Thanks again for the help!

     

Paulo Silva's avatar
Paulo Silva
Brass Contributor
Jul 31, 2018

Hi Oliver,

 

Thanks for the help.

I followed all the steps in this links that you sent but I still have some windows 10 devices that doesn't enroll automatically.

I still do have to put the users as local admin and add the e-mail account to see the device in my azure as managed by Microsoft Intune:

 

And I also use Windows Hello in my invironment but the automatic register does not work.

What I'm doing wrong ?

Thanks again

Oliver Kieselbach's avatar
Oliver Kieselbach
MVP
Jul 31, 2018

Hi Paulo,

 

when you say some do not register, are the others then registering normally and are showing MDM -> Intune?

Did you follow the Windows Hello for Business implementation guide for Hybrid Azure AD, you have to have a supported Domain Controller in the environment to successfully allow the Hybrid Azure AD joined devices to register?

Planning a Windows Hello for Business Deployment

https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-planning-guide

 

If your majority of devices is registering successful did you try these troubleshooting tips for Hybrid Azure AD join devices?

Troubleshooting hybrid Azure Active Directory joined Windows 10 and Windows Server 2016 devices

https://docs.microsoft.com/en-us/azure/active-directory/device-management-troubleshoot-hybrid-join-windows-current

 

best,

Oliver

  • Paulo Silva's avatar
    Paulo Silva
    Brass Contributor
    Jul 31, 2018

    when you say some do not register, are the others then registering normally and are showing MDM -> Intune?
    Yes Oliver, but I comfirmed right now that any new or old device that I add in my hybrid domain does not appear as managed by Intune.

    Did you follow the Windows Hello for Business implementation guide for Hybrid Azure AD, you have to have a supported Domain Controller in the environment to successfully allow the Hybrid Azure AD joined devices to register?
    Yes, I followed and Windows Hello is working fine in my environment.

    If your majority of devices is registering successful did you try these troubleshooting tips for Hybrid Azure AD join devices?
    As I said, I see that there's no device registering automatically.
    I really need to know if I need to put my users as local administrator to Add an accout for the device appear as managed by Microsoft Intune and after this have access to wipe data in windwos 10 ?

     

    That case is the same situation that i am but i really don't understand the way to manage device via Intune without admin account:

    https://techcommunity.microsoft.com/t5/Windows-10/Windows-10-1709-mdm-enrollment-with-standard-user/td-p/133232

    • Oliver Kieselbach's avatar
      Oliver Kieselbach
      MVP
      Jul 31, 2018

      So for the MDM registering you should follow this to automate the MDM enrollment task:

       

      Enroll a Windows 10 device automatically using Group Policy

      https://docs.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy

       

      Regarding your Standard user problem I'm unsure. The GPO approach is using a scheduled task, so try it out. If this approach works with standard user permissions I don't know right now.

       

      • Paulo Silva's avatar
        Paulo Silva
        Brass Contributor
        Aug 02, 2018

        Hi Oliver, 

        Now it worked!

         

        I was pointing my windows hello GPO with MDM GPO for a group of users and not for a group of Machines as showed at the image.

         

        Thanks again for the help!