Mysterious DEP Device Wipe

Question

Hi All&nbsp;I am investigating the unexplained wipe of a DEP enrolled device. This is the 3rd case of this.&nbsp;From the logs, I can see nothing obvious except for an AD password change synced via AADC.&nbsp;So, if the password was changed in AD and synced to AA, surely the Intune Company Portal would recognize the password change and prompt for the new password?&nbsp;And what if the user entered the old / wrong password multiple times? Would the DEP device wipe?&nbsp;Info greatly appreciated.

stuartk73 · Answer

eglockling&nbsp;&nbsp;Hey buddy&nbsp;On further investigation of the iOS Device Compliance and Configuration policies, I have noticed the following setting:&nbsp;Password expiration (days): = 90&nbsp;As roll-out was approx mid-February, 90 days would take it to mid-May, when the reset occurred.&nbsp;Could this be the culprit?

eglockling · Answer

StuartK73&nbsp; Do you have the "Number of sign-in failures before wiping device" setting configured in the iOS restrictions profile? I suspect that the end-user entered&nbsp;the device passcode incorrectly too many times, especially if there's no log of it in Endpoint Manager. Failed authentication attempts against the AAD account would not cause the device to wipe.

stuartk73 · Answer

eglockling&nbsp;&nbsp;"Failed authentication attempts against the AAD account would not cause the device to wipe." - Even on the Intune Company Portal app? Do you have a reference to that info?&nbsp;I have loads of Sign-in failures against the&nbsp;Intune Company Portal app around the same time as the password change, then the device re-enrolling.&nbsp;Regards&nbsp;&nbsp;

eglockling · Answer

StuartK73&nbsp; Yes, the Microsoft Intune and Intune Company Portal apps do not define this, it is a configuration that can be deployed to managed devices that leverages the existing built-in OS feature. Once the config is deployed, it is the device itself that evaluates the failed device password (passcode) attempts, not the MDM agent. Failed sign-in attempts to the Company Portal would only affect the user account (eg. lock the account, block additional sign-ins from this device, whatever your organization has defined...). Do you have any compliance actions set that would be contributing to this behaviour?

stuartk73 · Answer

eglockling&nbsp;&nbsp;Hi There&nbsp;Many thanks for your reply.&nbsp;I can't see anything in Device Compliance that would cause this.&nbsp;There is&nbsp; Device Config setting, wipe after 6 incorrect PIN attempts.&nbsp;Apart from that, I can see no obvious reason why this DEP device, the 3rd separate one has suddenly wiped.&nbsp;Regards

Forum Discussion

Mysterious DEP Device Wipe