Domain policies and SCCM not applying/replicatimg in a timely manner

Sergio Cedeno 1 Reputation point
2021-09-29T00:01:01.427+00:00

Hello,

I am in the process of deploying new systems with a fresh image to users. The image is 1909 and it places itself fine. The details for after Windows is installed is the issue. I typically run driver updates and then join the domain and reboot, and do whatever Windows updates there might be available. As the updates run, the domain policies should replicate along with whatever SCCM actions are available. I have run to an issue when I am trying "gpupdate /force" until I'm blue in the face.

I know the post image tasks will not go through when the system

  1. Doesn’t throw out a conflict during “gpupdate /force” - It throws something as such about an MDM policy not working. When the policy updates without issue, I know it isn’t working.
  2. The background doesn’t change to the company wallpaper/background.
  3. LAPS (security app) may not load correctly and the default admin password still works.
  4. The 21H1 update doesn’t show up. Checking updates stops at 20h2.
  5. Software Center may or may not brand at this point and the actions may not be there.
  6. We run an co-managed environment and with the previously listed symptoms, the systems in question might or might not show up on the MEM console and be co-managed and compliant.

At this point I can reboot and run gpupdate and it might work or it might not, and I can't make sense of the timing for when it does work.

Any direction would be greatly appreciated

Windows
Windows
A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.
4,803 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Limitless Technology 39,396 Reputation points
    2021-09-30T07:56:48.277+00:00

    Hello SergioCedeno

    What is the error you have about MDM? Maybe:

    "Windows failed to apply the MDM Policy settings. MDM Policy settings might have its own log file. Please click on the "More information" link."

    This would mean that the computer is already enrolled, then MDM throws the message as /force would try to enroll again. Additionally I would recommend to check the %windir%\debug\usermode\Gpsvc.log file as it can show you more details about the policies. I can recommend the next guide on how to use it for troubleshooting:

    https://learn.microsoft.com/en-us/archive/blogs/askds/a-treatise-on-group-policy-troubleshootingnow-with-gpsvc-log-analysis

    ------------------------------------------------------------------------------------------------------------

    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments