90%+ of Microsoft Entra hybrid joined devices not appearing in Intune

[kennysarmy]

I've successfully got our estate of 1000 ish windows devices Entra hybrid joined.

 

A GPO has been applied to the correct OU to do Intune Auto Enrollment, of the 1000 devices only around 90 are appearing after two weeks.

 

Any devices which have been re-imaged since the GPO was put in place are appearing OK, suggesting something up with the others.

 

I've discovered if I delete a key in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments the devices start to appear.

 

The key is different for each device.

 

The key to delete looks like this:

 

 

 

Questions.

 

1. What could be causing this "key" to break the auto enrollment.

 

2. How can I mass delete this key from all devices not auto enrolled correctly to Intune?

 

3. Is this "fix" likely to break anything down the line?

[NicholasEsping]

I've successfully got our estate of 1000 ish windows devices Entra hybrid joined.

 

A GPO has been applied to the correct OU to do Intune Auto Enrollment, of the 1000 devices only around 90 are appearing after two weeks.

 

Any devices which have been re-imaged since the GPO was put in place are appearing OK, suggesting something up with the others.

 

I've discovered if I delete a key in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments the devices start to appear.

 

The key is different for each device.

 

The key to delete looks like this:

 

[ATTACH=CONFIG]72324[/ATTACH]

 

 

Questions.

 

1. What could be causing this "key" to break the auto enrollment.

 

2. How can I mass delete this key from all devices not auto enrolled correctly to Intune?

 

3. Is this "fix" likely to break anything down the line?

You might be able to use dsregcmd to help figure out why they are not enrolling correctly.

Troubleshoot Microsoft Entra hybrid joined devices - Microsoft Entra ID | Microsoft Learn

[kennysarmy]

You might be able to use dsregcmd to help figure out why they are not enrolling correctly.

Troubleshoot Microsoft Entra hybrid joined devices - Microsoft Entra ID | Microsoft Learn

 

dsregcmd /status

 

Didn't really help.

 

The only difference between a working and non-working device was:

 

Non auto enrolled:

DisplayNameUpdated : YES

OsVersionUpdated : YES

 

 

Auto enrolled correctly:

DisplayNameUpdated : Managed by MDM

OsVersionUpdated : Managed by MDM

[kennysarmy]

dsregcmd /status

 

Didn't really help.

 

The only difference between a working and non-working device was:

 

Non auto enrolled:

DisplayNameUpdated : YES

OsVersionUpdated : YES

 

 

Auto enrolled correctly:

DisplayNameUpdated : Managed by MDM

OsVersionUpdated : Managed by MDM

 

 

I can work out what key to delete by checking the Task Scheduler and finding the key under Microsoft - Windows Enterprise Mgmt!

 

 

 

So if I could script it, it would be:

 

Check to see if device is already in Intune, if it's not, then lookup key above and use that to remove the correct key in the registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments

 

If anyone has any ideas of how to start creating this