diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index ceacdde6dd..d1ada9afe6 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -66,13 +66,13 @@ Devices that are joined to an on-premises Active Directory can enroll into MDM v ## Disable MDM enrollments -Starting in Windows 10, version 1607, IT admin can disable MDM enrollments for domain-joined PCs using Group Policy. Using the GP editor, the path is **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**. +In Windows 10 and Windows 11, IT admin can disable MDM enrollments for domain-joined PCs using Group Policy. Using the GP editor, the path is **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**. ![Disable MDM enrollment policy in GP Editor.](images/mdm-enrollment-disable-policy.png) Here is the corresponding registry key: -Key: \\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\MDM +HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM Value: DisableRegistration @@ -80,19 +80,8 @@ Value: DisableRegistration The following scenarios do not allow MDM enrollments: -- Built-in administrator accounts on Windows desktop cannot enroll into MDM. -- Standard users cannot enroll in MDM. Only admin users can enroll. -- Windows 8.1 devices enrolled into MDM via enroll-on-behalf-of (EOBO) can upgrade to Windows 10, but the enrollment is not supported. We recommend performing a server initiated unenroll to remove these enrollments and then enrolling after the upgrade to Windows 10 is completed. - -## Enrollment migration - -**Desktop:** After the MDM client upgrade from Windows 8.1 to Windows 10, enrollment migration starts at the first client-initiated sync with the MDM service. The enrollment migration start time depends on the MDM server configuration. For example, for Intune it runs every 6 hours. - -Until the enrollment migration is completed, the user interface will show no enrollment and server push will not work. - -To manually trigger enrollment migration, you can run MDMMaintenenceTask. - -**Mobile devices:** After the MDM client upgrade from Windows Phone 8.1 to Windows 10 Mobile, enrollment migration is performed during the first boot after the upgrade. +- Built-in administrator accounts on Windows desktop cannot enroll into MDM. +- Standard users cannot enroll in MDM. Only admin users can enroll. ## Enrollment error messages @@ -143,49 +132,49 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma

s:

MessageFormat

MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR

-

Message format is bad

+

Invalid message from the Mobile Device Management (MDM) server.

80180001

s:

Authentication

MENROLL_E_DEVICE_AUTHENTICATION_ERROR

-

User not recognized

+

The Mobile Device Management (MDM) server failed to authenticate the user. Try again or contact your system administrator.

80180002

s:

Authorization

MENROLL_E_DEVICE_AUTHORIZATION_ERROR

-

User not allowed to enroll

+

The user is not authorized to enroll to Mobile Device Management (MDM). Try again or contact your system administrator.

80180003

s:

CertificateRequest

-

MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR

-

Failed to get certificate

+

MENROLL_E_DEVICE_CERTIFICATEREQUEST_ERROR

+

The user has no permission for the certificate template or the certificate authority is unreachable. Try again or contact your system administrator.

80180004

s:

EnrollmentServer

MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR

- +The Mobile Device Management (MDM) server encountered an error. Try again or contact your system administrator.

80180005

a:

InternalServiceFault

MENROLL_E_DEVICE_INTERNALSERVICE_ERROR

-

The server hit an unexpected issue

+

There was an unhandled exception on the Mobile Device Management (MDM) server. Try again or contact your system administrator.

80180006

a:

InvalidSecurity

MENROLL_E_DEVICE_INVALIDSECURITY_ERROR

-

Cannot parse the security header

+

The Mobile Device Management (MDM) server was not able to validate your account. Try again or contact your system administrator.

80180007

@@ -242,43 +231,43 @@ In Windows 10, version 1507, we added the deviceenrollmentserviceerror element.

DeviceCapReached

MENROLL_E_DEVICECAPREACHED

-

User already enrolled in too many devices. Delete or unenroll old ones to fix this error. The user can fix it without admin help.

+

The account has too many devices enrolled to Mobile Device Management (MDM). Delete or unenroll old devices to fix this error.

80180013

DeviceNotSupported

MENROLL_E_DEVICENOTSUPPORTED

-

Specific platform (e.g. Windows) or version is not supported. There is no point retrying or calling admin. User could upgrade device.

+

The Mobile Device Management (MDM) server doesn't support this platform or version, consider upgrading your device.

80180014

NotSupported

-

MENROLL_E_NOTSUPPORTED

-

Mobile device management generally not supported (would save an admin call)

+

MENROLL_E_NOT_SUPPORTED

+

Mobile Device Management (MDM) is generally not supported for this device.

80180015

NotEligibleToRenew

MENROLL_E_NOTELIGIBLETORENEW

-

Device is trying to renew but server rejects the request. Client might show notification for this if Robo fails. Check time on device. The user can fix it by re-enrolling.

+

The device is attempting to renew the Mobile Device Management (MDM) certificate, but the server rejected the request. Check renew schedule on the device.

80180016

InMaintenance

MENROLL_E_INMAINTENANCE

-

Account is in maintenance, retry later. The user can retry later, but they may need to contact the admin because they would not know when problem is solved.

+

The Mobile Device Management (MDM) server states your account is in maintenance, try again later.

80180017

UserLicense

-

MENROLL_E_USERLICENSE

-

License of user is in bad state and blocking the enrollment. The user needs to call the admin.

+

MENROLL_E_USER_LICENSE

+

There was an error with your Mobile Device Management (MDM) user license. Contact your system administrator.

80180018

InvalidEnrollmentData

MENROLL_E_ENROLLMENTDATAINVALID

-

The server rejected the enrollment data. The server may not be configured correctly.

+

The Mobile Device Management (MDM) server rejected the enrollment data. The server may not be configured correctly.

80180019