diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index ceacdde6dd..d1ada9afe6 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -66,13 +66,13 @@ Devices that are joined to an on-premises Active Directory can enroll into MDM v ## Disable MDM enrollments -Starting in Windows 10, version 1607, IT admin can disable MDM enrollments for domain-joined PCs using Group Policy. Using the GP editor, the path is **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**. +In Windows 10 and Windows 11, IT admin can disable MDM enrollments for domain-joined PCs using Group Policy. Using the GP editor, the path is **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**.  Here is the corresponding registry key: -Key: \\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\MDM +HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM Value: DisableRegistration @@ -80,19 +80,8 @@ Value: DisableRegistration The following scenarios do not allow MDM enrollments: -- Built-in administrator accounts on Windows desktop cannot enroll into MDM. -- Standard users cannot enroll in MDM. Only admin users can enroll. -- Windows 8.1 devices enrolled into MDM via enroll-on-behalf-of (EOBO) can upgrade to Windows 10, but the enrollment is not supported. We recommend performing a server initiated unenroll to remove these enrollments and then enrolling after the upgrade to Windows 10 is completed. - -## Enrollment migration - -**Desktop:** After the MDM client upgrade from Windows 8.1 to Windows 10, enrollment migration starts at the first client-initiated sync with the MDM service. The enrollment migration start time depends on the MDM server configuration. For example, for Intune it runs every 6 hours. - -Until the enrollment migration is completed, the user interface will show no enrollment and server push will not work. - -To manually trigger enrollment migration, you can run MDMMaintenenceTask. - -**Mobile devices:** After the MDM client upgrade from Windows Phone 8.1 to Windows 10 Mobile, enrollment migration is performed during the first boot after the upgrade. +- Built-in administrator accounts on Windows desktop cannot enroll into MDM. +- Standard users cannot enroll in MDM. Only admin users can enroll. ## Enrollment error messages @@ -143,49 +132,49 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma
s:
MessageFormat
MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR
Message format is bad
Invalid message from the Mobile Device Management (MDM) server.
80180001
s:
Authentication
MENROLL_E_DEVICE_AUTHENTICATION_ERROR
User not recognized
The Mobile Device Management (MDM) server failed to authenticate the user. Try again or contact your system administrator.
80180002
s:
Authorization
MENROLL_E_DEVICE_AUTHORIZATION_ERROR
User not allowed to enroll
The user is not authorized to enroll to Mobile Device Management (MDM). Try again or contact your system administrator.
80180003
s:
CertificateRequest
MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR
Failed to get certificate
MENROLL_E_DEVICE_CERTIFICATEREQUEST_ERROR
The user has no permission for the certificate template or the certificate authority is unreachable. Try again or contact your system administrator.
80180004
s:
EnrollmentServer
MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR
80180005
a:
InternalServiceFault
MENROLL_E_DEVICE_INTERNALSERVICE_ERROR
The server hit an unexpected issue
There was an unhandled exception on the Mobile Device Management (MDM) server. Try again or contact your system administrator.
80180006
a:
InvalidSecurity
MENROLL_E_DEVICE_INVALIDSECURITY_ERROR
Cannot parse the security header
The Mobile Device Management (MDM) server was not able to validate your account. Try again or contact your system administrator.
80180007
DeviceCapReached
MENROLL_E_DEVICECAPREACHED
User already enrolled in too many devices. Delete or unenroll old ones to fix this error. The user can fix it without admin help.
The account has too many devices enrolled to Mobile Device Management (MDM). Delete or unenroll old devices to fix this error.
80180013
DeviceNotSupported
MENROLL_E_DEVICENOTSUPPORTED
Specific platform (e.g. Windows) or version is not supported. There is no point retrying or calling admin. User could upgrade device.
The Mobile Device Management (MDM) server doesn't support this platform or version, consider upgrading your device.
80180014
NotSupported
MENROLL_E_NOTSUPPORTED
Mobile device management generally not supported (would save an admin call)
MENROLL_E_NOT_SUPPORTED
Mobile Device Management (MDM) is generally not supported for this device.
80180015
NotEligibleToRenew
MENROLL_E_NOTELIGIBLETORENEW
Device is trying to renew but server rejects the request. Client might show notification for this if Robo fails. Check time on device. The user can fix it by re-enrolling.
The device is attempting to renew the Mobile Device Management (MDM) certificate, but the server rejected the request. Check renew schedule on the device.
80180016
InMaintenance
MENROLL_E_INMAINTENANCE
Account is in maintenance, retry later. The user can retry later, but they may need to contact the admin because they would not know when problem is solved.
The Mobile Device Management (MDM) server states your account is in maintenance, try again later.
80180017
UserLicense
MENROLL_E_USERLICENSE
License of user is in bad state and blocking the enrollment. The user needs to call the admin.
MENROLL_E_USER_LICENSE
There was an error with your Mobile Device Management (MDM) user license. Contact your system administrator.
80180018
InvalidEnrollmentData
MENROLL_E_ENROLLMENTDATAINVALID
The server rejected the enrollment data. The server may not be configured correctly.
The Mobile Device Management (MDM) server rejected the enrollment data. The server may not be configured correctly.
80180019