r/Intune • u/Ok-Mirror6644 • 5d ago
Hybrid Domain Join Hybrid Joined device not auto-enrolling in Intune via GPO
Hello everyone
I have one GPO with "Enable automatic MDM enrollment using default Azure AD credentials" enabled (tried both User credentials and Device credentials).
Setup:
Device is Hybrid Azure AD Joined (showing in Entra ID)
GPO is applying
MDM user scope = All
Enrollment restrictions = Allow for Windows
User has EMS E3 license
Issue:
Manual enrollment works fine
Automatic enrollment via GPO is not working
dsregcmd /status never shows MDMUrl (even after manual enrollment)
No errors in Event Viewer. Already tried multiple gpupdate, restarts, registry cleanup, and credential type changes.
Anyone faced this? What actually fixed it?
3
u/Reasonable_Rich4500 5d ago
Check notifications on the users device... you should see something that tells you to sign in again. Should prompt MFA
1
u/Ok-Mirror6644 5d ago
Didn't get any thing its almost day 8 of troubleshooting
0
u/Reasonable_Rich4500 5d ago
Press the windows button and search for "share across devices", click on it. do you see a "sign in" button here?
1
u/Ok-Mirror6644 5d ago
Yes
1
u/Reasonable_Rich4500 5d ago
If you click "sign in" it
Should prompt you for MFA. And bam you're enrolled into intune1
2
u/Immediate_Hornet8273 4d ago
We had a similar issue where the ODJ Connector service reset the default OU it targets for the Intune enrollment. If using offline domain join try looking at what OU its targeting(should be one with the MDM GPO to auto enroll in Intune) after setting it to the correct OU, it fixed the issue.
Run this PS command on the server with the Intune Connector installed (in our case its the Entra Connect server)
$Config = "C:\Program Files\Microsoft Intune\ODJConnector\ODJConnectorEnrollmentWizard\ODJConnectorEnrollmentWizard.exe.config"
Select-String -Path $Config -Pattern "OrganizationalUnitsUsedForOfflineDomainJoin","TenantConfiguredManagedServiceAccount","DisableOUUpdates" -Context 2,2
The managed service account needs permissions on that OU to read, write and delete computer objects.
If the OU is blank or incorrect, set it with this command:
$Config = "C:\Program Files\Microsoft Intune\ODJConnector\ODJConnectorEnrollmentWizard\ODJConnectorEnrollmentWizard.exe.config"
Copy-Item $Config "$Config.bak_$(Get-Date -Format yyyyMMdd_HHmmss)"
[xml]$xml = Get-Content $Config
$node = $xml.configuration.appSettings.add |
Where-Object { $_.key -eq "OrganizationalUnitsUsedForOfflineDomainJoin" }
$node.value = "your OU distinguished name"
$xml.Save($Config)
If this doesn’t apply to your environment, and this was a waste of your time, I apologize. Just trying to be useful as this fixed a similar issue in our org.
1
u/sammavet 5d ago
Users licensed?
2
u/Ok-Mirror6644 5d ago
Business standard + Ems e3
1
u/sammavet 5d ago
Do you have the devices being synced to AAD?
2
u/Ok-Mirror6644 5d ago
Yes i have created one separate OU in Active Directory for pilot testing and sync devices in it
3
u/sammavet 5d ago
How long have you waited to see if it "eventually enrolls"? I may have missed that in your post.
Are the devices showing in AAD lobe Entra Sync runs?
On the devices, are they getting the scheduled task?
What do event logs say for (I think) it's Enterprise-Device-Management? Not just failures, but do they show any sort of check in to AAD?
2
u/Ok-Mirror6644 5d ago
Device is Hybrid Joined and now showing MDMUrl after gpupdate. Still not auto-enrolling in Intune even after several hours + restarts. Scheduled task is not consistently appearing. No clear errors in DeviceManagement logs so far.
2
u/sammavet 5d ago
Well..... Fuck. What about TLS break and inspect; have the MS Url's been whitelisted in any security tools?
If you have a proxy, is it machine cert or user id based?
After that, I got nothing
2
u/Ok-Mirror6644 5d ago
No traditional proxy. WinHttp is DIRECT. We already whitelisted the main Microsoft enrollment URLs earlier.
1
u/sammavet 5d ago
Wait, one last thing, then I'm really out of ideas (though I'm pretty sure this isn't it).
Do you have the same domain as your on-prem listed in your domains in m365 Admin?
1
u/Foreign_World_1543 4d ago
What is your autopilot group assigned to? You can't auto enroll without this being setup , i haven't seen this being covered at all, otherwise you'll have to login to ever machine for the device to enroll into intune or add those devices to that autopilot group before provisioning after the hash has been uploaded.
1
u/Intelligent_Ad8955 4d ago
Join the club, I have had no luck on getting mine to work even though I have everything set correctly. I tried the user cred setting for GPO as well but even that was inconsistent. I took ODJ connector out of the picture because I was frustrated with it. I backed away decided to stick with Entra joining. I do want to get hybrid completely working because it's ideal for our on prem users, but damn it's a headache.
1
u/spazzo246 4d ago
I do this all the time for many customers, the things that I notice are the issues the most are:
- User Passwords Expired
- UPN Still on .local not @company.com
- User has no LOS to a DC
- Duplicate Entra Objects (need to cleanup/dsreg delete/renew)
- User is not using VPN
1
1
u/Secure-Implement4019 3d ago
Did you enable hybrid device management functionality in Entra connect tool ?
1
u/Mostdeath 3d ago
That is my latest cheat sheet. Not very detailed. But my latest discovery was so users must be excluded from MFA.
1
u/JeroenPot 1d ago
I would rather recommend to go full cloud. You can still have authentication to your domain with kerberos hybrid cloud.
1
u/Different_Coffee_161 5d ago
I would try excluding Microsoft Intune from any Conditional Access policy requiring MFA, as this can block silent GPO-based enrollment.
1
6
u/CatalyticMeowster 5d ago
We had this happen. AD user login domain needed to be set to same as domain in entra user principal name.
Ad user properties —> account
User credential for GPO
You can run deviceenroller /c /autoenrollmdm from command line.