This User Is Not Authorized to Enroll. You Can Try This Again
Windows Autopilot Hybrid Azure Advert Join troubleshooting is new to most of united states. I thought of sharing my experience troubleshooting bug related to Hybrid Domain Bring together scenarios with Windows Autopilot.
[ Related Mail service – Windows Autopilot Hybrid Domain Join Step by Step Implementation Guide]
Introduction -Windows Autopilot Hybrid Azure AD Join
In a previous postal service (Windows Autopilot Hybrid Domain Join Stride by Stride Implementation Guide), we discussed Windows Autopilot Hybrid Azure Advertisement Join Architecture and configured it.
Windows Autopilot Hybrid Azure Advertisement Join scenario includes many puzzles similar.
- Active Directory
- Connectors
- Intune
- Autopilot
- AAD Connect
It'due south essential to understand the workflow for troubleshooting Hybrid Windows Autopilot deployment. In this post, allow'due south hash out some common issues and critical troubleshooting areas of the Windows Autopilot Hybrid Azure Advertizement Join scenario.
Multiple Computer Records | Windows Autopilot Hybrid Azure Advert Join Troubleshooting Tips
Based on the Windows Autopilot deployment phase, you will see computer record changes in the Intune console. You will also observe multiple records created for the same computer. This information helps to correlate in which stage autopilot deployment is getting failed. Let's run into some of the events.
Initially, a temp record is created when a Windows autopilot computer starts communicating with Intune deject service. As shown below, the temp record volition be in format.
If y'all don't see this temp record created, perquisites are near probable not configured correctly. This issue should exist because of any of the following reasons.
- European monetary system license assignment not done.
- User doesn't accept permission for MDM Enrollment.
- Internet connectivity or proxy on your Windows ten client
After some time, the temp record gets updated to the current name of the computer. Please note the computer has not nevertheless applied the offline domain join hulk.
Afterward a few minutes, Windows 10 auto gets offline domain join blob from Intune. Afterward offline domain join (in Windows Autopilot Hybrid Azure AD Bring together scenario), the computer record in Intune console gets updated equally per the defined Estimator naming template. Yous may also notice multiple records for the aforementioned computer in the Intune console.
Beginning, computer records get created as role of Intune communication. The second record is created past AAD connect synced the new estimator object from Ad.
If y'all don't see the record with the proper computer naming template, information technology states some issues. The problem lies within the Offline domain bring together blob deployment workflow most of the time. You may also encounter the below error.
To confirm y'all are using the correct sign-in information and that your organization uses this feature. You can try to do this again or contact your organization administrator with the fault code 80070774.
Server Side Troubleshooting
Let's discuss common Offline domain join deployment (in Windows Autopilot Hybrid Azure Advertisement Join scenario) bug and troubleshoot. Troubleshooting tin can exist done from the server and client-side. Let'south talk about each i of them.
- Server side
- Client side
Intune AD connector connexion health
Navigate to the beneath path to confirm the Intune AD connector connection wellness. Check whether your connector condition is showing as Online and the latest sync time updated.
If y'all see whatever error shown below, it indicates that your connector is non communicating with Intune.
Intune AD Connector Not Appearing
You accept installed the console, and it got installed successfully. Information technology gave the option to log in with 'Global Admin' credentials. Y'all tried to log in with the credentials, and information technology just does aught. Information technology merely shows the page of Microsoft, and the account status shows 'Signed In.'
When you tin can't see Intune Active Directory (AD) connector in the panel, information technology might be due to IE Enhanced Security. IE Enhanced Security Configuration is enabled by default on Windows Server 2016 or later. This security setting may block the website displayed correctly during the Intune Advertizement connector sign-in.
Chetan Sharma (in Intune professional Facebook Group) discusses a similar issue. You might have to temporarily turn off IE Enhanced Security mode to set this issue. You lot can turn it on subsequently successful Intune AD connector enrollment.
Intune ODJ connector service
If Intune ODJ Connector condition shows offline, then verify connector service. As shown below, you lot need to make certain Intune ODJ connector service is "running" on your server.
Association status | Windows Autopilot Hybrid Azure AD Join Troubleshooting Tips
For each imported autopilot serial number, there will be a corresponding Intune record created when autopilot deployment start, a new record for that estimator appears in Intune console.
You can navigate the path below to find an association between hardware serial numbers and respective computer records. I usually use this in troubleshooting to check the associated Azure device id, Intune device name, Autopilot profile assignment, and enrollment status.
Consequence Viewer – Hybrid Azure Advertizing Join Troubleshooting Tips
Allow'southward go through some of the events to track Intune, connector, and Domain controller communication. Activities related to Intune ODJ connector service logged in the Event Viewer. Launch the event viewer.
Navigate to event log at "Awarding and Services Logs –> ODJ Connector Service."
Below Event ID 30120 state Intune AD connector tin download policy to generate Offline domain join blob.
{ "Metric":{ "Dimensions":{ "NumRequests":"i", "ActivityId":"c12037fe-52ed-4924-9898-08cdea7c48c8", "RequestIds":"[ d302cfe6-b60f-4d56-9f3a-2abbd89c6882 ]", "DeviceIds":"[ 59c1b762-1852-46e0-9ebe-439aab2d17f0 ]", "DomainNames":"[ XXXXXXXX.com ]", "ComputerNameStaticPrefixes":"[ HYBD ]", "ComputerNameSuffixCounts":"[ 11 ]", "InstanceId":"3B530FA1-F32B-4D61-BAD4-D7211D8603B3", "DiagnosticCode":"0x00000000", "DiagnosticText":"Successful" }, "Name":"RequestHandlingPipeline_DownloadSuccess", "Value":0 } Below Event ID 30130 land Intune connector service tin successfully create an offline domain join hulk. You tin also see the calculator name generated.
{
"Metric":{
"Dimensions":{
"RequestId":"d302cfe6-b60f-4d56-9f3a-2abbd89c6882",
"DeviceId":"59c1b762-1852-46e0-9ebe-439aab2d17f0",
"DomainName":"XXXXXX",
"MachineName":"HYBDcggLnwOWnRC",
"BlobDataLength":"1312",
"InstanceId":"3B530FA1-F32B-4D61-BAD4-D7211D8603B3",
"DiagnosticCode":"0x00000000",
"DiagnosticText":"Successful"
},
"Name":"RequestOfflineDomainJoinBlob_Success",
"Value":0
} If auditing is enabled, you can meet the below outcome in the domain controller. A new reckoner object got created using the connector server (SERVER$) permission. So make sure Intune Connector Server has enough rights, equally explained in the get-go post.
4741 viewer Windows Autopilot – Windows Autopilot Hybrid Azure AD
A computer account was created.
Discipline:
Security ID: Domain\XXXX$
Account Name: SERVER$
Account Domain: Domain
Logon ID: 0x11ADCC4
New Computer Account:
Security ID: Domain\HYBDCGGLNWOWNRC$
Business relationship Name: HYBDCGGLNWOWNRC$
Account Domain: Domain
Attributes:
SAM Account Name: HYBDCGGLNWOWNRC$
Brandish Name: -
User Chief Name: -
Home Directory: -
Home Drive: -
Script Path: -
Profile Path: -
User Workstations: -
Password Last Set: 4/twenty/2019 12:57:35 PM
Account Expires:
Main Group ID: 515
AllowedToDelegateTo: -
Old UAC Value: 0x0
New UAC Value: 0x80
User Account Control:
'Workstation Trust Account' - Enabled
User Parameters: -
SID History: -
Logon Hours:
DNS Host Name: HYBDcggLnwOWnRC.XXXXXX.com
Service Principal Names:
HOST/HYBDcggLnwOWnRC.XXXXX.com
RestrictedKrbHost/HYBDcggLnwOWnRC.XXXX.com
HOST/HYBDCGGLNWOWNRC
RestrictedKrbHost/HYBDCGGLNWOWNRC
After successful offline Domain Bring together hulk cosmos, Intune Active Directory connector uploads the blob to Intune. Below Outcome ID 30140, the country connector service can upload the Offline hulk to Intune. Intune connector acts as a mediator between Intune and Domain controller.
Source: ODJ Connector Service Source
Appointment: four/xx/2019 12:57:41 PM
Event ID: 30140
Keywords: Classic
User: Due north/A
Computer: XXXXXXXX.com
Clarification:
{
"Metric":{
"Dimensions":{
"NumRequestsUploaded":"i",
"ActivityId":"69d8506b-e352-42d1-a457-76e43e2a2d21",
"ElapsedMilliseconds":"1706",
"RequestIds":"[ d302cfe6-b60f-4d56-9f3a-2abbd89c6882 ]",
"DeviceIds":"[ 59c1b762-1852-46e0-9ebe-439aab2d17f0 ]",
"DeviceNames":"[ HYBDcggLnwOWnRC ]",
"BlobDataLengths":"[ 2807 ]",
"BlobEncrypted":"[ True ]",
"InstanceId":"3B530FA1-F32B-4D61-BAD4-D7211D8603B3",
"DiagnosticCode":"0x00000000",
"DiagnosticText":"Successful"
},
"Name":"RequestHandlingPipeline_UploadSuccess",
"Value":0
}
If you run into whatsoever errors during offline blob upload, make sure there is no firewall or proxy blocking communication between the connector and Intune service. If yous have a proxy in your surround, you need to ensure it's configured equally mentioned in the pre-requisites.
Customer side Troubleshooting
I take explained the basics of Autopilot troubleshooting in one of my previous posts. For more details, refer here.
Event Viewer
Launch the outcome viewer and navigate to the beneath path. You volition find some useful information logged in Diagnostics provider logs for troubleshooting.
Error ane – 80070774 –Something Went Wrong
"Confirm you are using the correct sign-in information and that your organisation uses this characteristic.you can try to practice this over again or contact organization administrator with fault code 80070774."
The above mistake results from time out during offline domain bring together hulk deployment workflow. As bones troubleshooting, you need to verify whether the connector server is good for you and active, as explained earlier.
Too, it would help if you verified whether you lot could ping your domain controller and connector server from the customer. Subsequently offline domain bring together calculator requires a reboot. But the auto will non reboot until information technology can establish communication with the Domain controller.
Notation! – Some other possibility for this fault is when the computer proper noun "prefix" is not configured correctly.
Error 2 – 80180005
"In that location was an error communicating with server.you can try to do this again or contact your organisation ambassador with the error code 80180005."
There can be many reasons for the above error. In most cases, this occurs if the computer proper name prefix is not configured correctly. In previews Post 1, we configured the calculator naming template.
Make sure you don't use whatsoever variables in the computer naming template. Unsupported figurer name will result in error code "80180005" or"80070774". In the computer, naming templates apply uncomplicated prefixes such equally HYBD and ABC.
Windows Autopilot Error three – Please wait while we setup your device
During Windows Autopilot Azure AD Bring together profile deployment, it's reasonable that the reckoner takes a bit more than time on the below screen. But if there are any issues, the reckoner will get stuck at the below screen and finally timeout with an fault.
In this scenario, press Shift + F10 to get control prompt support. Then try to ping the DC and internet URLs from the machine.
The other timeout error is when the OU path is not fix correctly. Please make sure you configure the Domain Join contour correctly, as explained in the previous post.
Note: You should set the organisation unit in the correct format, every bit shown below.
Domain Join Logs
Check the netsetup.log to cheque whether the computer received an offline domain join blob from Intune or not. You can navigate to the below location and analyze the log while troubleshooting.
Netsetup.log records Domain join events before and afterward applying offline domain join blob
After a few minutes, the offline domain join blob gets practical successfully.
03/19/2019 02:34:15:003 – ---------------------------------------------------------------
03/19/2019 02:34:15:003 NetpDoDomainJoin
03/19/2019 02:34:xv:018 NetpDoDomainJoin: using new figurer names
03/nineteen/2019 02:34:15:018 NetpDoDomainJoin: NetpGetNewMachineName returned 0x0
03/19/2019 02:34:xv:018 NetpMachineValidToJoin: 'WIN-JHKTEC2GLIL'
03/19/2019 02:34:15:018 NetpMachineValidToJoin: status: 0x0
03/19/2019 02:34:15:018 NetpJoinWorkgroup: joining computer 'WIN-JHKTEC2GLIL' to workgroup 'WORKGROUP'
03/nineteen/2019 02:34:15:018 NetpValidateName: checking to run across if 'WORKGROUP' is valid equally type 2 proper name
03/19/2019 02:34:17:174 NetpCheckNetBiosNameNotInUse for 'WORKGROUP' [ Workgroup every bit Auto] returned 0x0
03/19/2019 02:34:17:174 NetpValidateName: name 'WORKGROUP' is valid for type two
03/19/2019 02:34:19:643 NetpJoinWorkgroup: status: 0x0
03/19/2019 02:34:xix:643 NetpDoDomainJoin: status: 0x0
04/21/2019 08:50:40:808 – ---------------------------------------------------------------
04/21/2019 08:50:40:808 NetpRequestProvisioningPackageInstall:
04/21/2019 08:50:twoscore:808 cbPackageBinData: 983
04/21/2019 08:50:40:808 JoinOptions: 0x0
04/21/2019 08:50:xl:808 ProvisionOptions: 0x40000000
04/21/2019 08:50:forty:808 lpWindowsPath: C:\Windows
04/21/2019 08:50:forty:808 NetpRequestProvisioningPackageInstall: Found ODJ blob format: 1.
04/21/2019 08:50:40:808 NetpSetPrivileges: Setting backup/restore privileges.
04/21/2019 08:l:xl:982 NetpProvGetWindowsImageState: IMAGE_STATE_COMPLETE.
04/21/2019 08:l:40:982 NetpAddPartCollectionToRegistry.
04/21/2019 08:l:40:982 NetpProvGetTargetProductVersion: Target product version: 10.0.18343.one
04/21/2019 08:fifty:41:152 NetpAddPartCollectionToRegistry: delete OP land key status: 0x2.
04/21/2019 08:50:41:152 NetpConvertBlobToJoinState: Translating provisioning data to internal format
04/21/2019 08:fifty:41:152 NetpConvertBlobToJoinState: Selecting version one
04/21/2019 08:50:41:152 NetpConvertBlobToJoinState: exiting: 0x0
04/21/2019 08:50:41:168 NetpAddPartCollectionToRegistry: Successfully initiated provisioning parcel installation: 1/1 part(s) installed.
04/21/2019 08:50:41:168 NetpAddPartCollectionToRegistry: condition: 0x0.
04/21/2019 08:l:41:168 NetpOpenRegistry: condition: 0x0.
04/21/2019 08:50:41:168 NetpSetPrivileges: status: 0x0.
04/21/2019 08:l:41:168 NetpRequestProvisioningPackageInstall: condition: 0x0.
04/21/2019 08:54:12:726 – ---------------------------------------------------------------
04/21/2019 08:54:12:726 NetpProvCheckOfflineLsaPolicyUpdate
04/21/2019 08:54:12:726 NetpMachineValidToJoinPhase3: 'HYBD6T03Oyzzs8P'
04/21/2019 08:54:12:741 NetpMachineValidToJoinPhase3: status: 0x0
04/21/2019 08:54:12:741 NetpProvCheckOfflineLsaPolicyUpdate: status: 0x0
04/21/2019 08:54:20:164 – ---------------------------------------------------------------
04/21/2019 08:54:20:164 NetpProvContinueProvisioningPackageInstall:
04/21/2019 08:54:20:164 Context: 1
04/21/2019 08:54:20:164 NetpProvGetWindowsImageState: IMAGE_STATE_COMPLETE.
04/21/2019 08:54:21:227 NetpCreatePartListFromRegistry: status: 0x0.
04/21/2019 08:54:21:227 NetpCompleteOfflineDomainJoin
04/21/2019 08:54:21:227 fBootTimeCaller: TRUE
04/21/2019 08:54:21:227 fSetLocalGroups: FALSE
04/21/2019 08:54:21:321 NetpJoinDomainLocal: NetpHandleJoinedStateInfo returned: 0x0
04/21/2019 08:54:21:652 NetpJoinDomainLocal: NetpManageMachineSecret returned: 0x0.
04/21/2019 08:54:22:074 NetpJoinDomainLocal: condition of setting LSA pri. domain: 0x0
04/21/2019 08:54:22:074 NetpJoinDomainLocal: Updating W32TimeConfig
04/21/2019 08:54:22:324 NetpCompleteOfflineDomainJoin: condition: 0x0
04/21/2019 08:54:22:324 NetpProvContinueProvisioningPackageInstall: status: 0x0.
04/21/2019 08:54:22:921 – ---------------------------------------------------------------
04/21/2019 08:54:22:921 NetpProvContinueProvisioningPackageInstall:
04/21/2019 08:54:22:921 Context: ii
04/21/2019 08:54:22:921 NetpProvGetWindowsImageState: IMAGE_STATE_COMPLETE.
04/21/2019 08:54:22:921 NetpCreatePartListFromRegistry: status: 0x0.
04/21/2019 08:54:22:921 NetpCompleteOfflineDomainJoin
04/21/2019 08:54:22:921 fBootTimeCaller: Truthful
04/21/2019 08:54:22:921 fSetLocalGroups: TRUE
04/21/2019 08:54:22:937 NetpManageLocalGroupsForJoin: Calculation groups for new domain, removing groups from old domain, if any.
04/21/2019 08:54:24:234 NetpManageLocalGroupsForJoin: status of modifying groups related to domain 'XXX' to local groups: 0x0
04/21/2019 08:54:24:234 NetpManageLocalGroupsForJoin: INFO: No sometime domain groups to process.
04/21/2019 08:54:24:234 NetpCompleteOfflineDomainJoin: NetpManageLocalGroupsForJoin returned lawmaking: 0x0.
04/21/2019 08:54:24:234 NetpCompleteOfflineDomainJoin: status: 0x0
04/21/2019 08:54:24:234 NetpProvContinueProvisioningPackageInstall: Provisioning package installation completed successfully.
04/21/2019 08:54:24:234 NetpProvContinueProvisioningPackageInstall: delete OP country key status: 0x0.
04/21/2019 08:54:24:234 NetpProvContinueProvisioningPackageInstall: status: 0x0.
After applying the offline domain join blob, the estimator volition restart. At this point, Windows ten figurer should have Advertising connectivity; after computer, restart user can log in with Domain credentials.
Enrollment Condition Page (ESP)
After the user signs in, there will be an enrollment condition screen whenever your tenant's Intune enrollment condition page (ESP) is configured.
Ensure you configured beneath CSP to skip the user policy during the ESP screen.
- OMA-URI: ./Vendor/MSFT/DMClient/Provider/MS DM Server/FirstSyncStatus/SkipUserStatusPage
- Data type: Boolean
- Value: Truthful
If the CSP policy is not configured, you may get an error, as shown below.
Note! – Why CSP configuration is required to skip the user policy during the ESP screen?
As nosotros know, during Autopilot deployment computer is start joined to Advertizing Domain. The machine is withal not however marked as Hybrid Azure Advertisement joined. AAD Connect is responsible for the reckoner object in Advertisement to sync to Azure Advert.
The AAD connect ordinarily takes at least 30 minutes to process the computer object and sync to Azure Advertizing. Because of this delay, you may meet a timeout error on the Enrollment Condition page. Intune will not deploy any user-targeted policies until the computer object is synced to Azure and authenticated.
At this point, the workaround is to skip user-targeted policies during the Enrollment status folio. Still, Intune will starting time deploying User policies once the estimator receives the user token(typically xxx min). It is recommended to go through Michael Niehaus's blog for more details.
Additional Tips
All credits to Michael Niehaus and Sandys (presented during MMS). Also, cheers, Daniel Ratliff, for sharing this data on Twitter.
8007 Window Autopilot Errors are Win32 Errors (Network or related errors).
0x800705B4 = timeout
0x80070774 = domain controller not plant
801C Windows Autopilot Errors are Azure Advert Join / Device Registration related issues.
0x801C0003 = Device Authorization fault (not authorized to join Azure AD, exceeded device limit).
8018 Windows Autopilot errors are MDM Enrollment related issues.
0x80180003 = authority (user not authorized to enroll).
0x80180005 = Server mistake (enrollment rejected, scenario non enabled, etc.).
0x80180014 = Device not supported (enrollment restrictions rules).
0x80180018 = No user license (Azure AD premium or Intune licenses are NOT assigned).
8000 Windows Autopilot errors are generally due to Windows-related Errors.
0x80004005 = Generic error (fail).
Resources
- 1. Beginners Guide Setup Windows Autopilot Deployment
- 2. Dynamically Deploy Security Policies and Apps to Windows Autopilot Devices
- iii. Where is Autopilot Assign Contour Button in Intune Portal
- iv. Windows Autopilot End to End Process Guide
- 5. Repurpose/Reprovision Existing Devices to Windows Autopilot
- 6. Windows AutoPilot Profile AAD Dynamic Device Groups.
- 7. Windows Autopilot License Requirements
Author
Vimal has more than 10 years of feel in SCCM device management solutions. His master focus is on Device Management technologies similar Microsoft Intune, ConfigMgr (SCCM), Bone Deployment, Patch Management. He writes about the technologies like SCCM, Windows ten, Microsoft Intune, and MDT.
Source: https://www.anoopcnair.com/windows-autopilot-hybrid-azure-ad-join-trouble/
0 Response to "This User Is Not Authorized to Enroll. You Can Try This Again"
ارسال یک نظر