Chapter 16: Troubleshooting Microsoft Endpoint Manager

In this chapter, you will learn about the methods for requesting help while you are configuring your Microsoft Endpoint Manager (MEM) environment and, when you run into issues, learn how to resolve them either by yourself or with a little bit of help from Microsoft Support.

In this chapter, we'll go through the following topics:

• Troubleshooting MEM
• Service health and message center
• Troubleshoot blade in MEM
• Troubleshooting Windows 10 MEM enrollment
• Windows 10 device diagnostics
• Troubleshooting application delivery
• Troubleshooting Autopilot
• Windows 11 Autopilot diagnostics page
• Troubleshooting locating a Windows device
• Troubleshooting Microsoft Edge

Troubleshooting MEM

Under the Tenant admin blade, you have Tenant status. This is where some important information about your tenant is stored, such as the following:

• Tenant name and Tenant location: Here, you can see what part of the world your tenant is in—in this case, Europe.
• MDM authority: MDM stands for mobile device management. This is not as important as it was in the past.
• Service release: This is important. Here, you can follow whether your tenant has been upgraded to the latest service release.

Intune is a service that Microsoft updates monthly, so depending on where your tenant is located, you may see that your version of Intune is updated before others, based on this deployment schedule:

1. Day 1: User interface (UI) rolls out to the Asia Pacific region.
2. Day 2: UI rolls out to Europe, the Middle East, and Africa.
3. Day 3: UI rolls out to North America.
4. Day 4+: UI rolls out to Intune for Government.

The following screenshot...

Service health and message center

SERVICE HEALTH shows active incidents and advisories. This information is made easy to access in the MEM admin center, as you can see from the following screenshot representation. The same information is also available in the Microsoft 365 Service health dashboard in the Microsoft 365 admin center:

Figure 16.3 – Service health and message center

In the Tenant admin blade, you have an option to log a free support ticket when you have a Microsoft Intune subscription, as illustrated in the following screenshot:

Figure 16.4 – Intune support

Click on Intune to start the Microsoft Intune support workflow. First, you will be guided through common scenarios or recommended support articles. If none of these help you to resolve your issue, you can create a support request, where you need to provide as much detailed information as possible.

Troubleshoot blade in MEM

Inside the Troubleshoot blade, the information technology (IT) admin can select the user from where the troubleshooting starts inside the MEM admin center.

Go to Troubleshooting + support and you are ready to start. If you instead want to troubleshoot a userless device, you can start the Device blade and locate the device directly to see which profiles and apps are assigned to the device. In this case, however, we want to find and help an end user by performing the following steps:

1. Select the user who you want to help by clicking the Select user button, as illustrated in the following screenshot:

   Figure 16.5 – Troubleshooting: Select user button

2. The first section is ASSIGNMENTS, where you can see the applications that are available or needed by the user, as illustrated in the following screenshot:

   Figure 16.6 – Troubleshooting assignments

3. By way of an example, you have an option to change the scope to Configuration profiles,...

Troubleshooting Windows 10 MEM enrollment

You might get this error as part of the out-of-box experience (OOBE) when Azure Active Directory (Azure AD) joins a Windows 10 device (this is not a device known in the Autopilot service):

Figure 16.14 – OOBE: Something went wrong

You can follow these steps to troubleshoot your enrollment:

1. Go to Devices | Monitor | Enrollment failures in the MEM admin center, as illustrated in the following screenshot:

   Figure 16.15 – Enrollment failures

   Important note

   If the user is blocked from enrolling in Azure AD, enrollment will never proceed to Microsoft Intune and will therefore not show up if the Intune report for enrollment fails.

2. In the MEM admin center, you can go to Home | Devices | Windows | Windows enrollment, as illustrated in the following screenshot:

   Figure 16.16 – MDM Automatic Enrollment

3. Click Automatic Enrollment to configure the MDM user scope, which will take you to the following...

Windows 10 device diagnostics

By leveraging the DiagnosticLog Configuration Service Provider (CSP), Microsoft Intune can collect logs remotely on a Windows 10 device that is online and has internet connectivity.

Client requirements

There are some client requirements for remote log collection from the MEM admin center, including the Windows build version. These are outlined in more detail here:

• Desktop: Windows 10 1909/19H2 or later (build number 10.0.18363+)— Home, Pro, Enterprise, and Education versions supported.
• HoloLens 2: Windows 10 2004/20H1 or later (build number 10.0.19041+).
• Devices must be online and available via the internet, and Windows Push Notification Service (WNS) must have access to the machine.

The following screenshot shows the Collect diagnostics option:

Figure 16.22 – Collect diagnostics

The IT admin will ask you to click Yes before Intune reaches out to the device and collects the logs, as illustrated...

Troubleshooting application delivery

There are different app types in Microsoft Intune that require different approaches for troubleshooting, listed as follows:

• Win32 apps
• Line-of-business (LOB) apps
• Microsoft Store apps

Win32

In the MEM admin center on a specific device, the Managed Apps blade provides the IT admin with information on the installation status of an app, and also includes installation failures.

The Troubleshooting pane within Intune provides failure details, including details about managed apps on a user's device. Details about the end-to-end (E2E) life cycle of an app are provided under each device in the Managed Apps pane. You can view installation issues, such as when an app was created, modified, targeted, and delivered to a device, as illustrated in the following screenshot:

Figure 16.28 – Managed Apps installation status

By clicking on the failed app, Microsoft Intune will provide an error code...

Troubleshooting Autopilot

As part of the Monitoring blade in the MEM admin center, there is a report that shows the status of Autopilot deployments in the tenant. This report can be used as an example to monitor new devices that go through Windows Autopilot and give the IT admin an overview of the successes/failures and the total deployment time for devices.

When you are troubleshooting Windows Autopilot, it is important to be familiar with the following workflow:

1. A wireless (Wi-Fi) or wired (Ethernet) connection is established.
2. The Windows Autopilot profile is downloaded. When you use a wired connection or manually establish a wireless connection, the profile downloads from the Autopilot deployment service as soon as the network connection is in place. If you have an Ethernet connection, you may experience a situation where regional and language settings are bypassed. This can be configured in the Autopilot profile.
3. The next step is user authentication. When performing...

Windows 11 Autopilot diagnostics page

When you deploy Windows 11 with Autopilot, you can enable users to view additional detailed troubleshooting information about the Autopilot provisioning process. A new Windows Autopilot diagnostics page provides IT admins and end users with a user-friendly view to troubleshoot Windows Autopilot failures.

If you set Turn on log collection and diagnostics page for end users to Yes, you will enable Windows Autopilot diagnostics on an Autopilot device, as illustrated in the following screenshot:

Figure 16.33 – ESP profile

If there are any errors during the Windows Autopilot process, the end user has an option to see more details by clicking view diagnostics, as illustrated in the following screenshot:

Figure 16.34 – Windows Autopilot failure

This will start the new Windows Autopilot diagnostics page for Windows 11, which is currently only available for the user-driven Windows Autopilot...

Troubleshooting locating a Windows device

To get the location of a lost or stolen Windows device on a map, use the Locate device action in Microsoft Intune.

These are the Windows versions supported:

• Windows 10 version 20H2 (10.0.19042.789) or later
• Windows 10 version 2004 (10.0.19041.789) or later
• Windows 10 version 1909 (10.0.18363.1350) or later
• Windows 10 version 1809 (10.0.17763.1728) or later

The Windows Location service is off by default, as illustrated in the following screenshot:

Figure 16.38 – Location service is off

It requires the user to turn it on if they want to leverage this feature or create a policy that turns the location service on. To do that, perform the following steps:

1. Create a policy in the Settings Catalog to enable the location service on your Windows devices, as illustrated in the following screenshot:

   Figure 16.39 – Enable Location Service profile

2. Search for privacy and select...

Troubleshooting Microsoft Edge

Microsoft has released a new Chromium-based version of Microsoft Edge. This new version provides best-in-class compatibility with extensions and websites. This also means that there are new ways to perform troubleshooting and new policies that can manage the Edge browser.

Let's start by taking a look at the policy troubleshooting tool that is built into the browser itself. By entering Edge://policy/ in the address bar, you can access the Policies page, as illustrated in the following screenshot:

Figure 16.45 – Edge policy

You can see all the policy settings and the policy value of each setting applied to the Edge browser.

To check whether the browser is updated to the latest version, you can enter edge://settings/help in the address bar of the Edge browser. This will take you to the following screen:

Figure 16.46 – About Edge

To check which flags are configured in the Edge browser...

Summary

In this chapter, you've learned about most of the deployment errors that could occur during the configuration of MEM.

The knowledge you gain after reading this chapter will help you to troubleshoot some common errors while kicking the tires and will enable you to become the expert that you need and want to be in order to maintain production workloads in your business!

In the next chapter, we will learn about troubleshooting Windows 365.

Questions

1. Is Microsoft Support included in your Microsoft Intune subscription?

   a) Yes

   b) No

2. Does Windows Location Services need to be enabled on Windows to work from Microsoft Intune?

   a) Yes

   b) No

Answers

1. (A)
2. (A)

Further reading

In case you want to learn more after reading this chapter, please use one of the following free online resources:

• Troubleshoot app installation issues—Intune | Microsoft Docs:
• Troubleshooting packaging, deployment, and query of Windows apps—Win32 apps | Microsoft Docs: https://docs.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting