Been debugging like crazy the last day with this symptom:
When you run the gpupdate /force command on a hybrid Azure Active Directory (Azure AD)-joined Windows device that’s enrolled in Microsoft Intune, you receive the following warning message:
Updating policy…
Computer Policy update has completed successfully.
The following warnings were encountered during computer policy processing:
Windows failed to apply the MDM Policy settings. MDM Policy settings might have its own log file. Please click on the “More information” link.
User Policy update has completed successfully.For more detailed information, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy.
Should have Googled it though, because this is “Expected behavior” 🙂
Cause
This issue occurs if the Auto MDM Enrollment with AAD Token Group Policy Object (GPO) is applied to the Windows device. In this case, it tries to enroll the device in MDM when you run the gpupdate /force command. Because the device was already enrolled, you receive the warning message.
This behavior is expected. You can safely ignore the warning message.
Source: Windows failed to apply MDM Policy settings – Intune | Microsoft Docs
🙂
Related Posts
Active Directory: Loose the old home older setting- Active Directory: Changing default OU for new USERS and COMPUTERS
Sophos XG Firewall: Integrate XG Firewall with Azure AD
Azure MFA NPS extension: The request was discarded by a third-party extension DLL file- Windows server 2019: Troubleshoot missing SYSVOL and Netlogon shares
SOPHOS FIREWALL: Use Azure MFA for SSLVPN and Userportal
Hi Martin,
I have the same error on my client pc’s. I have set the GPO “Auto MDM Enrollment with AAD Token” back to “Not Configured”, but the message is stil lappearing, even for newly installed pc’s.
How can I get rid of this message?
Kind regards,
Radec
Hi, go to trouble shooting here:
https://docs.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy
Find “By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment.” and remove the reg keys shown above (They will have others numbers than you have so take caution 🙂
Regards Martin