{ "version": "1.0", "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). You may use, share and adapt this file, including in your own tools, as long as you credit IntelliReport LLC (intellireportsoftware.com).", "copyright": "Copyright (c) IntelliReport LLC", "notes": "Rules are checked in order; the first match wins. 'pattern' is a .NET regex (case-insensitive). 'logs' limits a rule to specific log files (wildcards allowed). 'source' is SCCM, Intune, MDM or Any. 'severity' raises (never lowers) the entry severity. 'ignore': true hides known-benign noise from Action Items. Rules with ids starting NOISE- hide known-harmless messages; they are listed first so they win.", "rules": [ { "id": "NOISE-SCCM-001", "source": "SCCM", "logs": [ "mtrmgr*.log" ], "pattern": "No active process found with ID|OpenProcess failed for process|ProcessIdToSessionId failed for process|Failed to (get|open) process", "ignore": true, "title": "Software metering process tracking (harmless)", "cause": "The software metering agent tries to inspect processes that already exited or are protected. Expected and harmless.", "steps": [], "links": [] }, { "id": "NOISE-SCCM-002", "source": "SCCM", "logs": [ "StateMessage*.log" ], "pattern": "Failed to find State message with TopicType", "ignore": true, "title": "State message lookup miss (harmless)", "cause": "The client looks up a cached state message that doesn't exist yet, then creates it. Routine.", "steps": [], "links": [] }, { "id": "NOISE-SCCM-003", "source": "SCCM", "logs": [], "pattern": "0x8007045B|\\b8007045b\\b|shutdown is in progress", "ignore": true, "title": "Errors during Windows shutdown (harmless)", "cause": "Components fail while Windows is shutting down (ERROR_SHUTDOWN_IN_PROGRESS). Expected.", "steps": [], "links": [] }, { "id": "NOISE-SCCM-004", "source": "SCCM", "logs": [ "InventoryAgent*.log" ], "pattern": "root\\\\(Microsoft\\\\appvirt|vm\\\\virtualization|Microsoft\\\\Windows\\\\DeviceGuard).*(0x8004100e|0x80041010|8004100e|80041010)|(0x8004100e|0x80041010).*(appvirt|virtualization|DeviceGuard)", "ignore": true, "title": "Inventory class/namespace not present on this device (harmless)", "cause": "Hardware inventory queries optional namespaces (App-V, Hyper-V, Device Guard) that don't exist on every device.", "steps": [], "links": [] }, { "id": "NOISE-INT-001", "source": "Intune", "logs": [ "IntuneManagementExtension*.log" ], "pattern": "\\[Flighting\\d*\\] CheckEnabledFlights", "ignore": true, "title": "Intune feature flag list (harmless)", "cause": "The Intune Management Extension logs which service-side feature flags are switched on. Informational only.", "steps": [], "links": [] }, { "id": "NOISE-INT-002", "source": "Intune", "logs": [ "IntuneManagementExtension*.log" ], "pattern": "Failed to open registry key '[^']*IntuneManagementExtension\\\\Settings'.*AzureScaleUnit", "ignore": true, "title": "IME settings value not written yet (harmless)", "cause": "A newly installed Intune Management Extension looks for a setting value the service hasn't written yet, then carries on. Common on a freshly enrolled device.", "steps": [], "links": [] }, { "id": "INT-ENROLL-001", "source": "MDM", "logs": [], "pattern": "0x8018002b|-2145910741", "severity": "Error", "title": "Automatic MDM enrollment failed (0x8018002b)", "cause": "Commonly: the user's UPN suffix isn't a verified/routable domain, the user isn't in the MDM user scope, or the user lacks an Intune license.", "steps": [ "In Entra > Mobility (MDM and WIP) > Microsoft Intune, confirm the MDM user scope includes the user.", "Confirm the user has an Intune license and a UPN with a verified domain suffix.", "Run dsregcmd /status and verify the device is Entra (hybrid) joined with a PRT.", "Re-run enrollment via the 'Schedule created by enrollment client for automatically enrolling in MDM from AAD' scheduled task." ], "links": [ "https://learn.microsoft.com/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-auto-enrollment" ] }, { "id": "INT-ENROLL-003", "source": "MDM", "logs": [], "pattern": "0x8007064c|-2147023284", "severity": "Error", "title": "Device is already enrolled (0x8007064C)", "cause": "The device was enrolled before, was cloned from an enrolled image, or still has an old enrollment certificate.", "steps": [ "In Local Computer > Personal > Certificates, delete the Intune certificate issued by Sc_Online_Issuing.", "Back up the registry, then delete HKLM\\SOFTWARE\\Microsoft\\OnlineManagement and its sub-keys.", "Re-enroll the device. The linked article lists one more registry key to check if it still fails." ], "links": [ "https://learn.microsoft.com/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors" ] }, { "id": "INT-ENROLL-004", "source": "MDM", "logs": [], "pattern": "0x8018000a|-2145910774", "severity": "Error", "title": "Device is already enrolled by another user (0x8018000A)", "cause": "A different user already enrolled the device or joined it to Microsoft Entra ID.", "steps": [ "Open Settings > Accounts > Access work or school and look for \"Another user on the system is already connected\".", "Remove that work or school account, sign out, sign in as the intended user, and retry." ], "links": [ "https://learn.microsoft.com/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors" ] }, { "id": "INT-ENROLL-005", "source": "MDM", "logs": [], "pattern": "0x80180001|-2145910783|0x80180002|-2145910782|0x80180003|-2145910781|0x80180004|-2145910780|0x80180005|-2145910779|0x80180006|-2145910778|0x80180007|-2145910777|0x80180008|-2145910776", "severity": "Error", "title": "MDM enrollment failed (0x80180001 to 0x80180008)", "cause": "Microsoft maps these codes to categories: 1, 5, 6 and 8 are server connectivity, 2 and 7 are authentication, 3 means the user is not authorized to enroll, 4 is a certificate error. 0x80180005 also appears when pre-provisioning is started without a user sign-in.", "steps": [ "Use the category to pick the right check: connectivity (proxy, firewall, DNS), sign-in (UPN, MFA, Conditional Access), user not allowed (MDM user scope, enrollment restrictions), or certificate (date and trust).", "For 0x80180005 during Autopilot pre-provisioning, complete the user sign-in step, or use a self-deploying profile for shared devices.", "Open the linked article for the matching section." ], "links": [ "https://learn.microsoft.com/windows/client-management/mdm-diagnose-enrollment", "https://learn.microsoft.com/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors" ] }, { "id": "INT-ENROLL-002", "source": "MDM", "logs": [], "pattern": "0x80180014|-2145910764|0x80180018|-2145910760|Auto MDM Enroll: Failed", "severity": "Error", "title": "MDM enrollment blocked or failed", "cause": "0x80180014 typically means an enrollment restriction blocks this platform/device (or the device record was deleted and needs cleanup); 0x80180018 typically indicates a licensing problem for the user.", "steps": [ "Check Intune > Devices > Enrollment restrictions (platform / personal device restrictions).", "Check the user's Intune license assignment.", "If the device was deleted from Intune, clean up stale enrollment entries (HKLM\\SOFTWARE\\Microsoft\\Enrollments) and re-enroll.", "Review Event Viewer: Applications and Services > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin." ], "links": [ "https://learn.microsoft.com/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors" ] }, { "id": "INT-MDM-001", "source": "MDM", "logs": [], "pattern": "Command failure status|CSP URI|PolicyManager.*(fail|result: \\(0x8)", "severity": "Error", "title": "MDM policy (CSP) failed to apply", "cause": "A configuration profile setting failed on the device. The CSP URI in the event identifies the setting; common causes are a setting not supported by this Windows edition/version, or a conflict.", "steps": [ "Read the CSP URI and result code in the event details below.", "Match it to the profile in Intune (Devices > the device > Device configuration shows the failing profile/setting).", "Check the setting's supported editions in the Policy CSP documentation (e.g. some settings need Enterprise/Education).", "Look for conflicts with another profile or a GPO setting the same thing." ], "links": [ "https://learn.microsoft.com/windows/client-management/mdm/policy-configuration-service-provider" ] }, { "id": "SCCM-APP-001", "source": "SCCM", "logs": [ "AppEnforce*.log", "AppDiscovery*.log", "AppIntentEval*.log" ], "pattern": "0x87D00324|-2016410844|not detected after installation", "severity": "Error", "title": "App installed but detection method did not find it (0x87D00324)", "cause": "The installer finished with a success exit code, but the deployment type's detection method still evaluates to 'not installed'. Almost always a detection rule mismatch (wrong product code, version, file path, registry value or 32/64-bit redirection), or the installer silently did nothing.", "steps": [ "Open AppEnforce.log and confirm the install command line and the exit code that was returned.", "Open AppDiscovery.log for the same time and see which detection clause failed.", "Verify the detection rule on the device by hand (MSI product code in HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall, file version, registry value).", "Check 32-bit vs 64-bit: if the app writes to WOW6432Node or Program Files (x86), enable 'Associate with a 32-bit application on 64-bit clients' in the detection rule.", "If the installer returned 0 but did nothing, run the install command manually as SYSTEM (psexec -s -i) and review the installer's own log.", "After fixing the detection method, update content/revision and re-run 'Application Deployment Evaluation Cycle'." ], "links": [ "https://learn.microsoft.com/mem/configmgr/apps/deploy-use/create-applications#bkmk_detect" ] }, { "id": "SCCM-APP-002", "source": "SCCM", "logs": [ "AppEnforce*.log" ], "pattern": "0x87D01106|-2016407290|Failed to verify the executable file is valid", "severity": "Error", "title": "Install command line or executable is invalid (0x87D01106)", "cause": "The client could not find or validate the executable in the deployment type command line. The file name is wrong, the content folder doesn't contain it, or the path uses quotes/relative paths incorrectly.", "steps": [ "In AppEnforce.log, look at the 'Prepared command line' and 'Executing Command line' entries.", "Browse to C:\\Windows\\ccmcache\\ for the content and confirm the executable exists with exactly that name.", "Wrap paths with spaces in quotes; for scripts use 'powershell.exe -ExecutionPolicy Bypass -File .\\script.ps1'.", "If content is missing or partial, delete the ccmcache folder for that content and redistribute / update content on the DPs." ], "links": [] }, { "id": "SCCM-APP-003", "source": "SCCM", "logs": [ "AppEnforce*.log", "execmgr*.log" ], "pattern": "0x87D00213|-2016411117|exceeded the maximum run ?time|timeout occurred", "severity": "Error", "title": "Install exceeded the maximum allowed run time (0x87D00213)", "cause": "The installer did not exit within the deployment type's 'Maximum allowed run time'. Usually the installer is waiting on a prompt (not truly silent), a reboot, or a running process.", "steps": [ "Check Task Manager / 'Get-Process' on the device for the installer still running (msiexec, setup.exe).", "Run the command line as SYSTEM (psexec -s -i) to see if any UI or prompt appears.", "Confirm silent switches (/qn, /S, /silent) are correct for the installer type.", "Increase the maximum run time on the deployment type if the install is legitimately long." ], "links": [] }, { "id": "INT-APP-002", "source": "Intune", "logs": [], "pattern": "Admin did NOT set mapping for lpExitCode", "severity": "Error", "title": "Installer returned an exit code that isn't mapped on the Win32 app", "cause": "The installer exited with a code that is not defined in the Win32 app's 'Return codes' list, so Intune treats the install as failed.", "steps": [ "Look for the 'lpExitCode' value in the log lines around this entry.", "Look up the exit code (Tools > Error code lookup). If it's a success/reboot code for that installer, add it to the app's Return codes as Success / Soft reboot / Hard reboot.", "If it's a real failure, run the install command as SYSTEM (psexec -s -i) to reproduce and read the installer's own log." ], "links": [ "https://learn.microsoft.com/mem/intune/apps/apps-win32-add#step-3-program" ] }, { "id": "SCCM-APP-004", "source": "Any", "logs": [], "pattern": "0x80070643|-2147023293|exit ?code:? ?\\[?1603\\b|lpExitCode:? ?\\[?1603\\b|return(ed)? code \\[?1603\\b", "severity": "Error", "title": "MSI fatal error during installation (1603 / 0x80070643)", "cause": "Generic Windows Installer failure. The real cause is inside the MSI's own verbose log (permissions, a prerequisite, a custom action, a newer version already installed, pending reboot).", "steps": [ "Find the installer log (add /l*v \"C:\\Windows\\Temp\\.log\" to the msiexec command line if none exists).", "In the MSI log, search for 'Return value 3' — the lines just above it show the failing action.", "Check for a pending reboot and for another version of the product already installed.", "Confirm SYSTEM has access to the install location and any network paths used by custom actions." ], "links": [ "https://learn.microsoft.com/troubleshoot/windows-client/application-management/msi-installation-error-1603" ] }, { "id": "SCCM-APP-005", "source": "Any", "logs": [], "pattern": "0x80070652|-2147023278|exit ?code:? ?\\[?1618\\b|lpExitCode:? ?\\[?1618\\b|return(ed)? code \\[?1618\\b", "severity": "Warning", "title": "Another installation is already in progress (1618)", "cause": "Windows Installer is busy with another install (another deployment, Windows Update, or a user-started install).", "steps": [ "Wait for the other install to finish; the client normally retries automatically.", "Check for stuck msiexec.exe processes; a reboot clears a hung installer.", "In SCCM, 1618 is a 'Retry' code by default; in Intune add 1618 as a 'Retry' return code on the Win32 app." ], "links": [] }, { "id": "SCCM-CONTENT-001", "source": "SCCM", "logs": [ "CAS*.log", "ContentTransferManager*.log", "LocationServices*.log", "AppEnforce*.log", "DataTransferService*.log" ], "pattern": "0x87D00607|-2016410105|content (was )?not found|no (DP|distribution point) locations?|0 DP locations|Failed to get DP locations", "severity": "Error", "title": "Content not available on any reachable Distribution Point (0x87D00607)", "cause": "The Management Point returned no Distribution Point for this content, so the client cannot download it. Content not distributed, DP not in the client's boundary group, or no fallback configured.", "steps": [ "In the console, check the content status for the package/application: is it 'Success' on the DPs?", "Check LocationServices.log for the client's current AD site / IP and which boundary group it resolves to.", "Confirm that boundary group has the DP assigned (or fallback to site default / cloud DP is allowed).", "Redistribute content if it shows failed/in-progress; then run 'Application Deployment Evaluation Cycle'." ], "links": [ "https://learn.microsoft.com/mem/configmgr/core/servers/deploy/configure/boundary-groups" ] }, { "id": "SCCM-CONTENT-005", "source": "SCCM", "logs": [ "DistMgr*.log", "PkgXferMgr*.log" ], "pattern": "0x80070070|-2147024784", "severity": "Error", "title": "Content distribution failed with 0x80070070", "cause": "0x80070070 means the disk is full. On a distribution point or content library drive, free up space or move the library. Microsoft also documents this error for distribution to a cloud management gateway or cloud DP when BranchCache is enabled.", "steps": [ "Check free space on the distribution point drive that holds the content library and the package source, and free up or add space.", "For a CMG or cloud DP with BranchCache enabled, open the linked Microsoft article for the resolution.", "Review DistMgr.log and PkgXferMgr.log around this entry for the failing package." ], "links": [ "https://learn.microsoft.com/troubleshoot/mem/configmgr/content-management/content-distribution-error-80070070" ] }, { "id": "SCCM-CONTENT-002", "source": "Any", "logs": [], "pattern": "0x87D01201|-2016407039|not enough (available )?space in (the )?cache|cache is full|0x80070070|disk is full|not enough space on the disk", "severity": "Error", "title": "Not enough disk or client cache space for download", "cause": "The ccmcache (or the disk) doesn't have room for the content being downloaded.", "steps": [ "Check free space on C: (Get-PSDrive C).", "Clear old cached content: Control Panel > Configuration Manager > Cache > Delete Files, or remove unused folders under C:\\Windows\\ccmcache.", "Increase the client cache size via Client Settings > Client Cache Settings if large apps are common.", "Run Disk Cleanup / remove old Windows update files if the OS drive itself is full." ], "links": [] }, { "id": "SCCM-CONTENT-003", "source": "Any", "logs": [], "pattern": "0x80190194|HTTP (status|code):? ?404\\b|BITS error.*404", "severity": "Error", "title": "Download returned HTTP 404 (file not found on DP/source)", "cause": "The Distribution Point (IIS) returned 404. The content is missing/corrupt on the DP, or IIS request filtering blocks the file extension or path (e.g. files with double-escaped characters or blocked extensions like .mdb/.config).", "steps": [ "Validate the content on the DP from the console (Content Status > Validate).", "Check the IIS log on the DP (C:\\inetpub\\logs\\LogFiles) for the 404 and its substatus (404.7 = extension blocked, 404.11 = double escaping).", "Adjust IIS Request Filtering on the DP if needed, then redistribute the content." ], "links": [] }, { "id": "SCCM-CONTENT-004", "source": "Any", "logs": [], "pattern": "0x80190193|0x80190191|HTTP (status|code):? ?40[13]\\b", "severity": "Error", "title": "Download denied by server (HTTP 401/403)", "cause": "The DP / proxy refused the request: authentication, client certificate (HTTPS), or proxy authorization problem.", "steps": [ "If the site uses HTTPS/Enhanced HTTP, confirm the client has a valid certificate (see ClientIDManagerStartup.log, CcmMessaging.log).", "Check whether a proxy is in the path and requires authentication; the SYSTEM account can't pass user credentials.", "Review the DP's IIS logs for the 401/403 substatus." ], "links": [] }, { "id": "SCCM-COMM-001", "source": "Any", "logs": [], "pattern": "0x80072EE2|-2147012894|operation timed out", "severity": "Error", "title": "Network timeout reaching server (0x80072EE2)", "cause": "The client could not complete an HTTP(S) request in time (MP, DP, WSUS or Intune service). Firewall, proxy, VPN or an overloaded server.", "steps": [ "From the device, test the server: Test-NetConnection -Port 80/443 (or 8530/8531 for WSUS).", "Check proxy settings for SYSTEM: 'netsh winhttp show proxy'.", "If on VPN, confirm split tunnel / CMG / cloud DP configuration.", "Check server health (IIS app pools on MP/WSUS)." ], "links": [] }, { "id": "SCCM-COMM-002", "source": "Any", "logs": [], "pattern": "0x80072EFD|-2147012867|0x80072EE7|-2147012889|0x8024402C|cannot connect to (the )?server|name (could not be|not) resolved", "severity": "Error", "title": "Cannot connect / name not resolved (0x80072EFD / 0x80072EE7)", "cause": "The server name doesn't resolve in DNS or the port is blocked. Common off-network, on VPN without internal DNS, or after a server rename.", "steps": [ "Resolve-DnsName on the device.", "Test-NetConnection -Port 443 (or 80 / 8530 / 10123 as applicable).", "Check 'netsh winhttp show proxy' and any PAC/proxy settings.", "For internet-based clients, confirm CMG is healthy and the client has the CMG in its MP list (LocationServices.log)." ], "links": [] }, { "id": "SCCM-COMM-003", "source": "Any", "logs": [], "pattern": "0x80072F8F|-2147012721|0x800B0109|0x800B0101|certificate (has )?expired|certificate chain|untrusted root|secure (channel|connection).*fail", "severity": "Error", "title": "TLS / certificate trust failure", "cause": "The HTTPS connection failed validation: expired or untrusted certificate, missing root/intermediate CA, wrong system clock, or TLS protocol mismatch. 0x80072F8F is often a clock skew or TLS 1.2 issue.", "steps": [ "Check the device date/time and time zone (w32tm /query /status).", "Open certlm.msc and confirm the client auth certificate (if PKI) is valid and the issuing/root CAs are trusted.", "Browse to the server's HTTPS URL from the device to inspect the certificate chain.", "Confirm TLS 1.2 is enabled on the client and server (SchUseStrongCrypto for .NET)." ], "links": [ "https://learn.microsoft.com/mem/configmgr/core/plan-design/security/enable-tls-1-2-client" ] }, { "id": "SCCM-COMM-004", "source": "SCCM", "logs": [ "CcmMessaging*.log", "LocationServices*.log", "ClientLocation*.log", "PolicyAgent*.log" ], "pattern": "0x87D00231|-2016411087|(unable to|failed to|could not) (find|locate|retrieve|get) (any |a )?(management point|MP)|Failed to send (http )?request|Post to .* failed", "severity": "Error", "title": "Client cannot communicate with a Management Point", "cause": "The client can't locate or talk to its MP (boundary/site assignment, DNS, firewall, MP role unhealthy, or client certificate problem).", "steps": [ "LocationServices.log: confirm assigned site code and the MP list the client received.", "Test the MP from the device: browse http(s):///sms_mp/.sms_aut?mplist and ?mpcert.", "Check the MP's MP_*.log files and IIS app pool (CCM Server Framework Pool) on the server.", "Check that the device's IP/AD site falls inside a boundary that belongs to a boundary group used for site assignment." ], "links": [ "https://learn.microsoft.com/mem/configmgr/core/clients/deploy/about-client-installation-properties" ] }, { "id": "SCCM-REG-001", "source": "SCCM", "logs": [ "ClientIDManagerStartup*.log" ], "pattern": "registration is pending|client is not (yet )?registered|RegTask.*fail|Failed to (register|refresh site code)", "severity": "Warning", "title": "Client registration pending or failing", "cause": "The client hasn't completed registration with the site. It may need approval (Hierarchy Settings > Client Approval), may be a duplicate/conflicting record, or can't reach the MP.", "steps": [ "In the console, find the device and check 'Approved' / 'Client' columns; approve it if required.", "Check for conflicting records (Monitoring > Conflicting Records) and duplicate GUIDs after imaging.", "If the machine was cloned without running sysprep, reset the client identity: stop ccmexec, delete C:\\Windows\\SMSCFG.ini, remove SMS certificates from the local SMS store, start ccmexec.", "Verify MP communication (see CcmMessaging.log / LocationServices.log)." ], "links": [] }, { "id": "SCCM-SETUP-002", "source": "SCCM", "logs": [ "ccmsetup*.log" ], "pattern": "(failed with error code|exiting with return code):? ?(0x80004005|-2147467259)\\b", "severity": "Error", "title": "Client install failed with 0x80004005 (generic error)", "cause": "CcmSetup reports a generic \"unspecified error\". A Microsoft Learn Q&A answer points to a misconfigured IIS role on the management point, including BITS, as one common cause. This is a community-level fix, so verify it in your environment.", "steps": [ "Read ccmsetup.log just above this line for the real failure (download, prerequisite or MSI step).", "On the management point, confirm the required IIS roles and features are installed, including BITS, and review MPSetup.log on the site server.", "Confirm BITS is healthy on the client, then retry the install." ], "links": [ "https://learn.microsoft.com/answers/questions/550995/ccmsetup-failed-with-error-code-0x80004005" ] }, { "id": "SCCM-SETUP-001", "source": "SCCM", "logs": [ "ccmsetup*.log", "client.msi*.log" ], "pattern": "CcmSetup failed with error code|CcmSetup is exiting with return code [1-9]|Failed to (download|install|verify).*(client|ccmsetup|prerequisite)|MSI: .*(failed|error)", "severity": "Error", "title": "Configuration Manager client install/upgrade failed", "cause": "ccmsetup could not download or install the client or one of its prerequisites.", "steps": [ "Open C:\\Windows\\ccmsetup\\Logs\\ccmsetup.log and find the first error before the exit line.", "If the MSI failed, open client.msi.log and search for 'Return value 3'.", "Common fixes: repair WMI, remove a stuck previous client ('ccmsetup.exe /uninstall'), free disk space, or fix the download source (MP/DP reachable).", "Reinstall: ccmsetup.exe /mp: SMSSITECODE= (add /forceinstall if needed)." ], "links": [ "https://learn.microsoft.com/mem/configmgr/core/clients/deploy/about-client-installation-properties" ] }, { "id": "SCCM-WMI-001", "source": "Any", "logs": [], "pattern": "0x8004100E|0x80041010|0x80041013|0x80041001|0x80041006|WMI (is )?(corrupt|repository)|Failed to connect to (the )?(WMI|namespace)", "severity": "Error", "title": "WMI error / possible WMI repository corruption", "cause": "The client relies on WMI (root\\ccm). Invalid namespace/class errors usually mean a broken client install or corrupt WMI repository; 0x80041006 is out of memory in WMI.", "steps": [ "Check the repository: 'winmgmt /verifyrepository' (from an elevated prompt).", "If inconsistent: 'winmgmt /salvagerepository', then reboot.", "Repair the client afterwards: C:\\Windows\\CCM\\ccmrepair.exe (or reinstall ccmsetup).", "Avoid 'winmgmt /resetrepository' unless you're ready to reinstall every WMI provider (including the ConfigMgr client)." ], "links": [] }, { "id": "SCCM-HEALTH-001", "source": "SCCM", "logs": [ "CcmEval*.log", "CcmEvalTask*.log" ], "pattern": "\\b(fail(ed)?|remediation failed|not healthy)\\b", "severity": "Warning", "title": "Client health evaluation (CcmEval) found a problem", "cause": "The built-in client health check (CcmEval, runs daily) detected a failed check and may or may not have remediated it.", "steps": [ "Review C:\\Windows\\CCM\\CcmEvalReport.xml for which check failed and whether remediation succeeded.", "Run it on demand: C:\\Windows\\CCM\\CcmEval.exe, then re-check this log.", "If WMI or the ccmexec service keeps failing, repair the client (ccmrepair.exe) or reinstall." ], "links": [] }, { "id": "SCCM-POLICY-001", "source": "SCCM", "logs": [ "PolicyAgent*.log", "PolicyEvaluator*.log", "PolicyAgentProvider*.log" ], "pattern": "(failed to|could not|unable to) (download|compile|apply|evaluate|retrieve|process).*polic|polic(y|ies).*(download|compilation|evaluation) failed", "severity": "Error", "title": "Policy download / evaluation failure", "cause": "The client couldn't download or apply machine/user policy from the MP, so new deployments and settings won't appear.", "steps": [ "Trigger 'Machine Policy Retrieval & Evaluation' from the Tools menu and watch PolicyAgent.log.", "Confirm MP communication (CcmMessaging.log).", "If PolicyEvaluator reports WMI compile errors, repair WMI / the client.", "As a last resort, reset policy: WMIC /namespace:\\\\root\\ccm path sms_client CALL ResetPolicy 1, then retrieve policy again." ], "links": [] }, { "id": "SCCM-SUP-001", "source": "SCCM", "logs": [ "WUAHandler*.log" ], "pattern": "0x87D00692|-2016410990|Group policy settings were overwritten by a higher authority", "severity": "Error", "title": "WSUS group policy conflicts with Configuration Manager (0x87D00692)", "cause": "A domain GPO sets a WSUS server (or disables Automatic Updates) that differs from what the ConfigMgr client configured, so the software update scan is blocked.", "steps": [ "Run 'gpresult /h C:\\Temp\\gp.html' and find the GPO under Windows Components > Windows Update that sets 'Specify intranet Microsoft update service location'.", "Remove/adjust that GPO for ConfigMgr-managed devices (ConfigMgr sets the local policy itself).", "Run 'gpupdate /force', then trigger 'Software Updates Scan Cycle' and re-check WUAHandler.log." ], "links": [] }, { "id": "SCCM-SUP-005", "source": "SCCM", "logs": [ "WUAHandler*.log", "WindowsUpdate*.log", "UpdatesDeployment*.log" ], "pattern": "0x80245003|-2145103869|0x80070514|-2147023596|0x8DDD0018|-1914896360|0x80246008|-2145099768|0x80200013|-2145386477|0x80004015|-2147467243|0x800A0046|-2146828218|0x800A01AD|-2146827859|0x80070424|-2147023836|0x800B0100|-2146762496|0x80248011|-2145091567", "severity": "Error", "title": "Update scan failed: Windows Update components are missing or corrupt", "cause": "Microsoft lists these codes as scan failures caused by missing or corrupted Windows Update files, registry keys or registrations on the client.", "steps": [ "Run the Windows Update troubleshooter and make sure the Windows Update Agent is current.", "net stop wuauserv (and bits)", "Rename C:\\Windows\\SoftwareDistribution to SoftwareDistribution.old", "net start wuauserv, then run a Software Updates Scan Cycle from the Configuration Manager control panel applet", "If it keeps failing, review WUAHandler.log and WindowsUpdate.log for the first error in the scan." ], "links": [ "https://learn.microsoft.com/troubleshoot/mem/configmgr/update-management/troubleshoot-software-update-scan-failures" ] }, { "id": "SCCM-SUP-006", "source": "Any", "logs": [], "pattern": "0x80072EFE|-2147012866|0x80D02002|-2133843966", "severity": "Error", "title": "Windows Update operation timed out", "cause": "Microsoft documents these codes as time-out errors: the client could not complete a request to the update or download source.", "steps": [ "Make sure no firewall rule or proxy blocks the Microsoft or WSUS download URLs.", "Test the same URL from the client. If it still stalls, take a network trace to see where the request stops." ], "links": [ "https://learn.microsoft.com/troubleshoot/windows-client/installing-updates-features-roles/common-windows-update-errors" ] }, { "id": "SCCM-SUP-007", "source": "SCCM", "logs": [ "WUAHandler*.log", "WindowsUpdate*.log" ], "pattern": "0x80240438|-2145123272", "severity": "Error", "title": "Update source not found (0x80240438)", "cause": "The client could not reach the update source. A Microsoft Learn Q&A answer points to WSUS misconfiguration or a firewall. This is a community-level answer, so verify it.", "steps": [ "Check the WSUS URL in HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate and browse to it from the client.", "Check firewall settings on the client and the WSUS server.", "net stop wuauserv (and bits)", "Rename C:\\Windows\\SoftwareDistribution to SoftwareDistribution.old", "net start wuauserv, then run a Software Updates Scan Cycle from the Configuration Manager control panel applet" ], "links": [ "https://learn.microsoft.com/answers/questions/1479306/in-our-sccm-environment-some-machines-are-not-gett" ] }, { "id": "SCCM-SUP-008", "source": "Any", "logs": [], "pattern": "0x8024402F|-2145107921", "severity": "Error", "title": "Update processing finished with errors (0x8024402F)", "cause": "WU_E_PT_ECP_SUCCEEDED_WITH_ERRORS: external .cab processing completed with some errors. Microsoft notes web filtering such as Lightspeed Rocket can cause it.", "steps": [ "If you use a web filter, add the device IP addresses to its exceptions list and retry.", "Otherwise check that no proxy or firewall rewrites the update downloads." ], "links": [ "https://learn.microsoft.com/troubleshoot/windows-client/installing-updates-features-roles/common-windows-update-errors" ] }, { "id": "SCCM-SUP-009", "source": "Any", "logs": [], "pattern": "0x80242006|-2145116154", "severity": "Error", "title": "Update has invalid metadata (0x80242006)", "cause": "WU_E_UH_INVALIDMETADATA: the update handler failed because the update metadata is invalid or corrupt in the local data store.", "steps": [ "Stop the Windows Update service.", "Rename SoftwareDistribution\\DataStore to DataStore.bak, SoftwareDistribution\\Download to Download.bak and system32\\catroot2 to catroot2.bak.", "Start the service and retry the update." ], "links": [ "https://learn.microsoft.com/troubleshoot/windows-client/installing-updates-features-roles/common-windows-update-errors" ] }, { "id": "SCCM-SUP-010", "source": "Any", "logs": [], "pattern": "0x80200053|-2145386413", "severity": "Error", "title": "Update download failed validation (0x80200053)", "cause": "BG_E_VALIDATION_FAILED: the downloaded content failed validation. Microsoft points to a firewall or filter that alters the download responses.", "steps": [ "Make sure no firewall, proxy or content filter inspects or modifies the update downloads.", "Retry the download after excluding the Microsoft and WSUS URLs from inspection." ], "links": [ "https://learn.microsoft.com/troubleshoot/windows-client/installing-updates-features-roles/common-windows-update-errors" ] }, { "id": "SCCM-SUP-002", "source": "Any", "logs": [], "pattern": "0x80244022|0x8024401C|0x80244010|0x80244017|0x80244019|0x8024401F|OnSearchComplete.*fail|Scan failed with error", "severity": "Error", "title": "Software update scan against WSUS/SUP failed", "cause": "The Windows Update Agent couldn't complete its scan. 0x80244022 = HTTP 503 (WSUS app pool stopped/overloaded), 0x8024401C = request timeout, 0x80244010 = too many round trips, 0x80244017 = 401 (proxy/auth), 0x8024401F = HTTP 500.", "steps": [ "Check WUAHandler.log and ScanAgent.log for the scan source (WSUS URL) and error.", "On the SUP/WSUS server, check the 'WsusPool' app pool is started; raise its private memory limit and queue length if it keeps stopping.", "Test from the device: browse http(s)://:8530/ClientWebService/client.asmx.", "Run WSUS maintenance (decline superseded updates, reindex SUSDB) if scans are slow/timing out." ], "links": [ "https://learn.microsoft.com/troubleshoot/mem/configmgr/update-management/troubleshoot-software-update-scan-failures" ] }, { "id": "SCCM-SUP-003", "source": "Any", "logs": [], "pattern": "0x80070BC9|-2147021879|reboot is (required|pending) before", "severity": "Warning", "title": "A pending reboot is blocking installs (0x80070BC9)", "cause": "A previous install or update requires a restart before anything else can be installed.", "steps": [ "Restart the device (check Software Center for the restart countdown / maintenance window).", "Check reboot flags: HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing\\RebootPending and WindowsUpdate\\Auto Update\\RebootRequired.", "After restart, run 'Software Updates Deployment Evaluation Cycle'.", "Make sure no policy changes the startup behavior of the Windows Installer service (the default startup type is Manual)." ], "links": [ "https://learn.microsoft.com/troubleshoot/windows-client/installing-updates-features-roles/common-windows-update-errors" ] }, { "id": "SCCM-SUP-004", "source": "Any", "logs": [], "pattern": "0x80240022|-2145124318|0x8024200D|0x80246007|update.*(failed to install|installation failed)", "severity": "Error", "title": "Windows update failed to install", "cause": "One or more updates failed to download or install. 0x80240022 = all updates in the batch failed, 0x8024200D = update needs another download, 0x80246007 = update not downloaded.", "steps": [ "Check UpdatesHandler.log and WUAHandler.log for which KB failed and its specific error.", "Check C:\\Windows\\Logs\\CBS\\CBS.log for servicing errors; run 'DISM /Online /Cleanup-Image /RestoreHealth' then 'sfc /scannow'.", "Confirm free disk space and that no reboot is pending.", "Retry via 'Software Updates Deployment Evaluation Cycle'." ], "links": [] }, { "id": "SCCM-TS-001", "source": "SCCM", "logs": [ "smsts*.log" ], "pattern": "could not initialize Task Sequence Environment|files needed to resume the task sequence are missing", "severity": "Error", "title": "Task sequence could not resume after a restart", "cause": "The task sequence environment was not found after a reboot, so the sequence could not resume. A Microsoft Learn Q&A answer tied this to the Install Software Updates step restarting unexpectedly.", "steps": [ "On the Install Software Updates step, set \"Retry this step if computer unexpectedly restarts\" to 4 (the fix confirmed in the thread).", "Review smsts.log before this entry to see what restarted the computer." ], "links": [ "https://learn.microsoft.com/answers/questions/933034/task-sequence-manager-could-not-initialize-task-se" ] }, { "id": "ANY-ACCESS-001", "source": "Any", "logs": [], "pattern": "0x80070005|-2147024891|access (is )?denied", "severity": "Error", "title": "Access denied (0x80070005)", "cause": "The process (usually SYSTEM, or the user for user-context installs) lacks rights to a file, registry key, share or service. Also caused by AV/EDR blocking or UAC for user-context installs.", "steps": [ "Identify the resource in the surrounding log lines (file path, registry key, share).", "For user-context deployments, confirm the user has rights (or switch the deployment to 'Install for system').", "Check AV/EDR/Application Control (WDAC/AppLocker) event logs for blocks.", "For network paths, remember SYSTEM authenticates as the computer account (DOMAIN\\PCNAME$)." ], "links": [] }, { "id": "ANY-FILE-001", "source": "Any", "logs": [], "pattern": "0x80070002|-2147024894|0x80070003|-2147024893|system cannot find the (file|path)", "severity": "Error", "title": "File or path not found (0x80070002 / 0x80070003)", "cause": "A file referenced by a command line, script, or detection rule doesn't exist. Often a typo, wrong working directory, or content that wasn't fully downloaded.", "steps": [ "Check the command line in the log and confirm the file exists in the cached content folder.", "For scripts, use paths relative to the content folder (e.g. .\\install.ps1) and avoid mapped drives.", "Redownload content: clear the cached folder (ccmcache or IME Content/Staging) and retry." ], "links": [] }, { "id": "ANY-RPC-001", "source": "Any", "logs": [], "pattern": "0x800706BA|-2147023174|RPC server is unavailable|0x80070422|service (cannot be started|is disabled)", "severity": "Error", "title": "Required service unavailable or disabled (RPC 0x800706BA / 0x80070422)", "cause": "A dependent Windows service (e.g. BITS, Windows Update, WMI, Delivery Optimization) is stopped or disabled, or a remote host can't be reached over RPC.", "steps": [ "Check services: Get-Service BITS, wuauserv, Winmgmt, DoSvc, CcmExec, IntuneManagementExtension.", "Set disabled services back to their default start type and start them.", "Check if a hardening GPO or security tool is disabling services." ], "links": [] }, { "id": "INT-APP-001", "source": "Intune", "logs": [], "pattern": "0x87D1041C|-2016345060|not detected after installation", "severity": "Error", "title": "Win32 app installed but not detected (0x87D1041C)", "cause": "The installer exited successfully, but the Win32 app's detection rule still says 'not installed'. Wrong detection rule, 32/64-bit registry redirection, or the installer did nothing.", "steps": [ "In IntuneManagementExtension.log / AppWorkload.log, find '[Win32App]' lines for the app and the detection result after install.", "Verify the detection rule manually on the device (MSI product code, file/folder, registry, or run the custom detection script as SYSTEM).", "For registry/file rules on 64-bit Windows, check the 'Associated with a 32-bit app on 64-bit clients' setting.", "A custom detection script must write something to STDOUT and exit 0 when installed.", "After fixing, the app retries per the retry schedule (see GRS item), or force it: restart the IntuneManagementExtension service." ], "links": [ "https://learn.microsoft.com/mem/intune/apps/apps-win32-troubleshoot" ] }, { "id": "INT-APP-003", "source": "Intune", "logs": [], "pattern": "\\[GRSManager\\].*(not expired|will be skipped|skip)|GRS.*not expired", "severity": "Warning", "title": "App retry is being held by the 24-hour GRS (Global Re-evaluation Schedule)", "cause": "After a failed install, the IME won't retry a required Win32 app until the GRS window (about 24 hours) has passed. This explains 'nothing is happening' after you fix an app.", "steps": [ "Fix the underlying failure first (see other action items).", "To retry immediately: find the app GUID in the log, then under HKLM\\SOFTWARE\\Microsoft\\IntuneManagementExtension\\Win32Apps\\\\ delete the key and the matching entry under the GRS subkey.", "Restart the 'Microsoft Intune Management Extension' service to trigger a new check-in." ], "links": [] }, { "id": "INT-APP-004", "source": "Intune", "logs": [], "pattern": "hash (validation|verification|check)(\\s+\\w+){0,3}\\s+fail|hash mismatch|failed to (decrypt|unzip)|decryption fail", "severity": "Error", "title": "Win32 app content failed hash check / decrypt / unzip", "cause": "The downloaded .intunewin content is corrupt or incomplete (network/proxy interference, TLS inspection, or disk space).", "steps": [ "Check free disk space.", "Clear C:\\Program Files (x86)\\Microsoft Intune Management Extension\\Content\\Incoming and \\Staging, then restart the IME service.", "Exclude Intune/Delivery Optimization endpoints from proxy SSL inspection.", "If it fails on every device, re-package the .intunewin and re-upload it." ], "links": [ "https://learn.microsoft.com/mem/intune/fundamentals/intune-endpoints" ] }, { "id": "INT-APP-005", "source": "Intune", "logs": [], "pattern": "\\b(download(ing)?|downloader)\\b[^.]{0,80}\\b(failed|timed out)\\b|\\bfailed to download\\b|\\bdownload failed\\b", "severity": "Error", "title": "Intune app/content download failed", "cause": "The IME couldn't download app content from the Intune CDN / Delivery Optimization. Network, proxy, firewall, or DO configuration.", "steps": [ "Check Delivery Optimization: Get-DeliveryOptimizationStatus and Get-DeliveryOptimizationLog | Select -Last 50.", "Confirm the Intune/Win32 content endpoints are reachable and not SSL-inspected.", "Check 'netsh winhttp show proxy' (the IME runs as SYSTEM).", "Restart the IME service to retry." ], "links": [ "https://learn.microsoft.com/mem/intune/fundamentals/intune-endpoints" ] }, { "id": "INT-APP-006", "source": "Intune", "logs": [], "pattern": "requirement(s)?( rule)?( is| are)? not (met|satisfied)|does not meet (the )?requirement", "severity": "Warning", "title": "Device doesn't meet the Win32 app's requirement rules", "cause": "The app's requirements (OS version, architecture, disk space, RAM, or custom requirement script/registry/file) evaluated as not applicable. The app shows 'Not applicable' in Intune.", "steps": [ "Review the app's Requirements tab in Intune and compare against this device.", "If a requirement script is used, run it as SYSTEM and check its output/exit code.", "Confirm the architecture setting (x64 / x86 / ARM64) matches the device." ], "links": [] }, { "id": "INT-APP-007", "source": "Intune", "logs": [], "pattern": "dependen(t|cy|cies)\\b.*\\b(failed|install(ation)? failed)\\b", "severity": "Error", "title": "Win32 app dependency failed", "cause": "A dependency app must install first and it failed or was not detected, so the parent app is not installed.", "steps": [ "Find the dependency app GUID in the log and look for its own install/detection errors.", "Fix the dependency app first; parent apps retry afterwards.", "Check for circular or overly deep dependency chains." ], "links": [] }, { "id": "INT-SCRIPT-001", "source": "Intune", "logs": [], "pattern": "running scripts is disabled|is not digitally signed|cannot be loaded because running scripts", "severity": "Error", "title": "PowerShell script blocked by execution policy / signing", "cause": "The Intune PowerShell script, remediation, or custom detection script can't run because of execution policy or the 'Enforce script signature check' setting.", "steps": [ "Check the script's 'Enforce script signature check' setting in Intune; if Yes, the script must be signed by a trusted publisher.", "Check for a GPO setting 'Turn on Script Execution' that overrides execution policy (Get-ExecutionPolicy -List).", "Run the script manually as SYSTEM to confirm it works." ], "links": [] }, { "id": "INT-SCRIPT-002", "source": "Intune", "logs": [ "HealthScripts*.log", "AgentExecutor*.log", "IntuneManagementExtension*.log" ], "pattern": "script.*timed out|(detection|remediation) script.*\\b(failed|error)\\b|Powershell exit code is [1-9]", "severity": "Warning", "title": "Intune script / Remediation failed or timed out", "cause": "An Intune platform script or Remediation returned an error, a non-zero exit code, or exceeded the time limit. Note: a Remediation DETECTION script exiting with 1 is expected (it means 'issue found, run remediation') - only act if the remediation itself fails or the issue keeps coming back.", "steps": [ "In AgentExecutor.log, find the script's stdout/stderr and exit code.", "Run the script manually as SYSTEM (or the user if 'Run using logged-on credentials') to reproduce.", "For remediations, the detection script must exit 1 to trigger remediation and 0 when compliant; the remediation script should exit 0 on success.", "Check 64-bit vs 32-bit PowerShell setting ('Run script in 64-bit PowerShell')." ], "links": [ "https://learn.microsoft.com/mem/intune/fundamentals/remediations" ] }, { "id": "INT-AUTH-002", "source": "Any", "logs": [], "pattern": "0xCAA2000C|-895352820|AADSTS50076|Failed to get Microsoft Entra Token for sync session|Failed to get AAD Token for sync session", "severity": "Error", "title": "MFA is blocking the device sync token", "cause": "A co-managed or auto-enrolled device cannot get its sync token because multi-factor authentication is required for the account or by Conditional Access.", "steps": [ "If per-user MFA is Enabled or Enforced, set it to Disabled for the enrollment account.", "Or exclude trusted IPs or the device registration service from the MFA requirement.", "For the Conditional Access case, open the linked article. Also check CoManagementHandler.log." ], "links": [ "https://learn.microsoft.com/troubleshoot/mem/intune/comanage-configmgr/troubleshoot-co-management-auto-enrolling" ] }, { "id": "INT-AUTH-001", "source": "Any", "logs": [], "pattern": "AADSTS\\d+|failed to (get|acquire|retrieve) (the )?(aad |access |user |device )?token|token (acquisition|request) failed", "severity": "Error", "title": "Entra ID (Azure AD) token acquisition failed", "cause": "The IME/MDM client couldn't get a token from Entra ID. Device not properly Entra joined / hybrid joined, no Primary Refresh Token, Conditional Access, or network block to login.microsoftonline.com.", "steps": [ "Run Tools > dsregcmd /status and check AzureAdJoined / DomainJoined, AzureAdPrt = YES, and the MDM URL.", "If an AADSTS code is shown, look it up: https://login.microsoftonline.com/error?code=.", "Check Entra sign-in logs for the device/user around this time.", "Confirm login.microsoftonline.com and enterpriseregistration.windows.net are reachable (no SSL inspection)." ], "links": [ "https://learn.microsoft.com/entra/identity-platform/reference-error-codes" ] }, { "id": "INT-CERT-001", "source": "Intune", "logs": [], "pattern": "(MDM|Intune|device) certificate.*(not found|expired|invalid|missing)|(could not find|failed to (get|find|load|retrieve)) (the )?(MDM |device |client )?certificate", "severity": "Error", "title": "Intune/MDM device certificate missing or invalid", "cause": "The IME authenticates with the MDM device certificate. If it's missing or expired, the device can't check in (often after re-imaging or a broken enrollment).", "steps": [ "Open certlm.msc > Personal > Certificates and look for a certificate issued by 'Microsoft Intune MDM Device CA' with a valid date.", "Run dsregcmd /status and confirm the device is Entra joined and MDM enrolled.", "If the cert is missing, the device usually needs to be re-enrolled (Settings > Accounts > Access work or school)." ], "links": [] }, { "id": "INT-AP-001", "source": "MDM", "logs": [], "pattern": "0x800705B4|-2147023436", "severity": "Error", "title": "Autopilot or ESP phase timed out (0x800705B4)", "cause": "A timeout during device preparation on the Enrollment Status Page. This guidance comes from a Microsoft Learn Q&A answer, so treat it as community-level.", "steps": [ "Raise \"Show an error when installation takes longer than specified number of minutes\" in the ESP profile.", "Remove the device from Intune and Autopilot completely, restart it, and retry.", "If it persists, collect the Autopilot diagnostics and event logs." ], "links": [ "https://learn.microsoft.com/answers/questions/2122418/error-code-0x800705b4-during-device-enrollment-in", "https://learn.microsoft.com/troubleshoot/mem/intune/device-enrollment/troubleshoot-windows-enrollment-errors" ] }, { "id": "INT-AP-002", "source": "MDM", "logs": [], "pattern": "\\b0x80070774\\b|\\b80070774\\b|-2147023756", "severity": "Error", "title": "Hybrid Autopilot could not complete the domain join (80070774)", "cause": "The hybrid join could not finish. A Microsoft Learn Q&A thread points to the Intune Connector for Active Directory and its rights to create computer objects. Community-level answer, so verify.", "steps": [ "Confirm the Intune Connector for Active Directory is installed and healthy.", "Grant the connector computer rights to create computer objects in the OU named in the domain join profile.", "Confirm the device can reach a domain controller." ], "links": [ "https://learn.microsoft.com/answers/questions/1099715/autopilot-error-80070774", "https://learn.microsoft.com/autopilot/tutorial/user-driven/hybrid-azure-ad-join-computer-account-limit" ] }, { "id": "INT-AP-003", "source": "MDM", "logs": [], "pattern": "0x801C03ED|-2145647635", "severity": "Error", "title": "Entra join blocked by policy (0x801C03ED)", "cause": "The Microsoft Entra join step was refused. Commonly this is the tenant setting for who may join devices, or a disabled or deleted device object. Microsoft Learn confirms the topic but this fix is from community sources, so verify it.", "steps": [ "In the Entra admin center, Devices > Device settings, set \"Users may join devices to Microsoft Entra\" to All or a group that includes the provisioning users.", "If the Entra device object was disabled or deleted, re-enable it, or delete it and re-import the hardware hash." ], "links": [ "https://learn.microsoft.com/autopilot/troubleshooting-faq" ] } ], "errorCodes": { "0x87D00324": "ConfigMgr: The application was not detected after installation completed.", "0x87D00325": "ConfigMgr: The application was still detected after uninstall completed.", "0x87D00607": "ConfigMgr: Content not found / unable to locate content on a distribution point.", "0x87D01106": "ConfigMgr: Failed to verify the executable file is valid or to construct the command line.", "0x87D00213": "ConfigMgr: Timeout occurred during enforcement (max run time exceeded).", "0x87D01201": "ConfigMgr: Not enough space in the client cache or disk to download content.", "0x87D00692": "ConfigMgr: Group policy conflict - WSUS settings overwritten by a higher authority.", "0x87D00231": "ConfigMgr: Transient error / failed to communicate with the management point.", "0x87D1041C": "Intune: The application was not detected after installation completed successfully.", "0x80070643": "Fatal error during installation (MSI 1603).", "0x80070652": "Another installation is already in progress (MSI 1618).", "0x80070BC9": "The requested operation failed. A system reboot is required to roll back changes made.", "0x80070BC2": "The requested operation is successful. Changes will not be effective until the system is rebooted (3010).", "0x80070005": "Access is denied.", "0x80070002": "The system cannot find the file specified.", "0x80070003": "The system cannot find the path specified.", "0x80070070": "There is not enough space on the disk.", "0x800706BA": "The RPC server is unavailable.", "0x80070422": "The service cannot be started because it is disabled.", "0x80072EE2": "WinINet: The operation timed out.", "0x80072EE7": "WinINet: The server name or address could not be resolved.", "0x80072EFD": "WinINet: A connection with the server could not be established.", "0x80072F8F": "WinINet: A security error occurred (TLS / certificate / clock).", "0x800B0101": "A required certificate is not within its validity period (expired).", "0x800B0109": "A certificate chain processed but terminated in an untrusted root.", "0x80190191": "BITS/HTTP 401: Unauthorized.", "0x80190193": "BITS/HTTP 403: Forbidden.", "0x80190194": "BITS/HTTP 404: Not found.", "0x80244010": "Windows Update: Exceeded max server round trips (WU_E_PT_EXCEEDED_MAX_SERVER_TRIPS).", "0x80244017": "Windows Update: HTTP 401 - access denied (WU_E_PT_HTTP_STATUS_DENIED).", "0x80244019": "Windows Update: HTTP 404 - not found (WU_E_PT_HTTP_STATUS_NOT_FOUND).", "0x8024401C": "Windows Update: HTTP request timeout (WU_E_PT_HTTP_STATUS_REQUEST_TIMEOUT).", "0x8024401F": "Windows Update: HTTP 500 - server error (WU_E_PT_HTTP_STATUS_SERVER_ERROR).", "0x80244022": "Windows Update: HTTP 503 - service unavailable (WU_E_PT_HTTP_STATUS_SERVICE_UNAVAIL). WSUS app pool likely stopped.", "0x8024402C": "Windows Update: Proxy or server name could not be resolved (WU_E_PT_WINHTTP_NAME_NOT_RESOLVED).", "0x80240022": "Windows Update: Operation failed for all the updates (WU_E_ALL_UPDATES_FAILED).", "0x8024200D": "Windows Update: Update needs to be downloaded again (WU_E_UH_NEEDANOTHERDOWNLOAD).", "0x80246007": "Windows Update: The update has not been downloaded (WU_E_DM_NOTDOWNLOADED).", "0x8004100E": "WMI: Invalid namespace.", "0x80041010": "WMI: Invalid class.", "0x80041002": "WMI: Object not found.", "0x80041001": "WMI: Generic failure.", "0x80041006": "WMI: Out of memory.", "0x80041013": "WMI: Provider load failure.", "0x8018002B": "MDM enrollment: commonly UPN suffix not verified or user not in MDM scope.", "0x80180014": "MDM enrollment: device/platform blocked by enrollment restrictions (or device record removed).", "0x80180018": "MDM enrollment: user license issue.", "1603": "MSI: Fatal error during installation.", "1618": "MSI: Another installation is already in progress.", "1619": "MSI: Installation package could not be opened (bad path / missing file).", "1638": "MSI: Another version of this product is already installed.", "1641": "Success - the installer initiated a restart.", "3010": "Success - a restart is required to complete the install.", "1707": "MSI: Installation completed successfully.", "1605": "MSI: This action is only valid for products that are currently installed." }, "logInfo": { "AppEnforce.log": "App install/uninstall execution: command lines, exit codes, detection after install.", "AppDiscovery.log": "App detection method evaluation (is it installed?).", "AppIntentEval.log": "Applicability and intent (required/available) evaluation for apps.", "CAS.log": "Content Access Service: content location lookups and ccmcache management.", "ContentTransferManager.log": "Schedules and monitors content downloads (BITS/DO/BranchCache).", "DataTransferService.log": "BITS download jobs and HTTP errors from DPs.", "LocationServices.log": "MP/DP/SUP location lookups, site assignment, boundary resolution.", "ClientLocation.log": "Site assignment tasks.", "ClientIDManagerStartup.log": "Client identity, registration and certificate selection.", "CcmMessaging.log": "Communication between the client and management point.", "CcmExec.log": "SMS Agent Host service activity.", "CcmEval.log": "Daily client health evaluation and remediation.", "CertificateMaintenance.log": "Client certificate maintenance.", "PolicyAgent.log": "Policy requests and downloads from the MP.", "PolicyEvaluator.log": "Policy compilation into WMI.", "execmgr.log": "Package/program and task sequence execution.", "InventoryAgent.log": "Hardware/software inventory and heartbeat discovery.", "WUAHandler.log": "Windows Update Agent: scan source (WSUS) and scan results.", "ScanAgent.log": "Software update scan requests and results.", "UpdatesDeployment.log": "Update deployments, maintenance windows, user notifications.", "UpdatesHandler.log": "Update download and install jobs.", "UpdatesStore.log": "Compliance status of scanned updates.", "RebootCoordinator.log": "Restart scheduling and notifications.", "StateMessage.log": "State messages sent to the MP.", "SCClient_*.log": "Software Center user activity.", "ccmsetup.log": "Client install/upgrade (ccmsetup).", "client.msi.log": "Client MSI verbose install log.", "smsts.log": "Task sequence execution.", "CoManagementHandler.log": "Co-management workload handling.", "ComplRelayAgent.log": "Compliance relay for co-management.", "DcmWmiProvider.log": "Configuration item / baseline evaluation (WMI provider).", "CIAgent.log": "Configuration item processing (apps, updates, baselines).", "IntuneManagementExtension.log": "IME main log: check-ins, Win32 apps, scripts, policy processing.", "AppWorkload.log": "Win32 app download, install, detection (newer IME versions).", "AppActionProcessor.log": "Win32 app applicability and action processing.", "AgentExecutor.log": "Intune PowerShell script and remediation execution output.", "HealthScripts.log": "Remediations (Proactive Remediations) schedule and results.", "ClientHealth.log": "IME client health checks.", "Sensor.log": "IME sensor / inventory activity.", "Win32AppInventory.log": "Win32 app inventory collection.", "DeviceHealthMonitoring.log": "Endpoint analytics / device health monitoring.", "ClientCertCheck.log": "IME certificate checks.", "MDM Admin (Event Log)": "DeviceManagement-Enterprise-Diagnostics-Provider/Admin: MDM enrollment and CSP policy results.", "Entra AAD (Event Log)": "AAD/Operational: Microsoft Entra sign-in, token and Primary Refresh Token (PRT) problems.", "Device Registration (Event Log)": "User Device Registration/Admin: Entra device registration, Entra join and hybrid join failures.", "Modern Deployment Admin (Event Log)": "ModernDeployment-Diagnostics-Provider/Admin: Windows provisioning and Autopilot activity.", "Autopilot (Event Log)": "ModernDeployment-Diagnostics-Provider/Autopilot: Autopilot profile and Enrollment Status Page events.", "Windows Update Client (Event Log)": "WindowsUpdateClient/Operational: Windows Update scan, download and install errors and warnings.", "AppX Deployment (Event Log)": "AppXDeployment-Server/Operational: Store and MSIX app install and registration errors and warnings.", "WaAppAgent.log": "Azure VM agent (WindowsAzure\\Logs): the agent that runs VM extensions and reports VM health.", "himds.log": "Azure Arc connected machine agent: hybrid instance metadata service, connection to Azure Arc." } }