Automatic MDM Enrollment - Windows 10 Clients - Scenario

Question

question

VeeraRagavan-5624 asked Feb 24, '22 VeeraRagavan-5624 answered Mar 23, '22

Automatic MDM Enrollment - Windows 10 Clients - Scenario

Hello Techie's,

Here is the Scenario, I Would like to take help

I have 3 Different Forest/Domain's

Domain 1 - ABC.COM
Domain 2 - XYZ.COM
Domain 3 - 123.COM

Domain 1 - ABC.COM - We have the Azure AD Connect, and Installed with MECM - With Co Management. All Management via Intune
Domain 1 - Azure AD Connect which Collect the Details of AD - All 3 Domains (Domain 1, 2 and 3)

Now, We want Domain 2 and Domain 3 has to be Controlled via Intune
So we have done the following..

XYZ.COM - Users are Assigned with Azure AD P1, Microsoft Intune Licenses
XYZ.COM - Users are Available in the Azure AD, Azure Portal
XYZ.COM - Devices are Available in the Azure AD, Azure Portal
XYZ.COM - Created the GPO, and Assigned the MDM Profile for Enrollment - User Credential

Out Put, Event ID : 76 - Auto MDM Enroll: Device Credential (0x0), Failed (Unknown Win32 Error code: 0x8018002b)

We cannot see the MDM URL, MDMTOUURL, MDM Compliance URL while running the DSREGCMD /Status

From the Intune Side, We do not have any Restrictions. Enrollment

Also no Restrictions with Device Type - As well.. Devices are Targeted to this Group

Question:

Is it Really Possible to Manage the Domain 2 (XYZ) Clients via Intune? which the Tenant belongs to Domain 1 (ABC)

Now the Current Status is Device is showing as Hybrid Azure AD Joined, along with Registered and Activity time

Any Steps from your suggestion, Expertise can help... We need to Manage the Domain 2, Domain 3 Devices has to be Manage via Intune is the Goal

Little more Update from my side

I have mentioned the Domain Name as

XYZ.COM and it is more likely as XYZ.Local

Its Local Domain, and not registered/Purchased any where. Can you refer some link to register this Domain.

In late time, I Found that this Domains are not Registered yet with Azure Portal

mem-intune-general mem-intune-enrollment

image.png (75.8 KiB)

image.png (451.9 KiB)

image.png (106.0 KiB)

image.png (86.2 KiB)

image.png (89.1 KiB)

image.png (30.2 KiB)

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

VeeraRagavan-5624 · Feb 25 at 08:50 AM

Additional Comments:

We followed the Approach and Declare the Tenant ID and Tenant Name

https://365bythijs.be/2019/11/02/troubleshooting-hybrid-azure-ad-join/

0 ·

Answer 1 · 2022-02-24T14:35:06.357Z

EswarKoneti-MVP answered Feb 24, '22 VeeraRagavan-5624 commented Feb 25, '22

is xyz and 123 domains are routable? check this Microsoft document for more information https://docs.microsoft.com/en-us/troubleshoot/mem/intune/troubleshoot-windows-enrollment-errors#auto-mdm-enroll-failed

Thanks,
Eswar
www.eskonr.com

· 3

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

VeeraRagavan-5624 · Feb 24 at 03:12 PM

Hello Eswar,

My Sincere sorry - Which I Forget to Post this information earlier.

Yes, the XYZ and 123 Domains are Rotatable. We changed it for User Login Name.. From :TestUser1@ABC.COM to TestUser1@XYZ.COM

Following that Successful Azure AD Replication...

But Once again, it makes the same Scenario..

With Successful User and Device details as Hybrid - Still causing the same issue..

0 ·

image.png (220.7 KiB)

VeeraRagavan-5624 VeeraRagavan-5624 · Feb 24 at 04:30 PM

Hello Experts,

Do you suggest any...Troubleshooting Techniques..

0 ·

VeeraRagavan-5624 · Feb 25 at 07:53 AM

Hello Eswar,

Yes we tried to perform the Routing with the Login from TestUser1@XYZ.COM to TestUser1@ABC.com as well.

In Addition, We also Created Registry Entries to the Work Station for the Enrollment

https://365bythijs.be/2019/11/02/troubleshooting-hybrid-azure-ad-join/

Still it is ending up with same error..

Little trick here, the Domain ABC.COM is Yet to be Registered. We are using ABCon365.onmicrosoft.com as the Tenant Name. Currently the Tenant name is only as "Available" and not as Registered.

https://docs.microsoft.com/en-us/azure/active-directory/devices/hybrid-azuread-join-control#configure-client-side-registry-setting-for-scp

0 ·

image.png (44.0 KiB)

Answer 2 · 2022-03-01T07:12:49.883Z

RahulJ-3048 answered Mar 1, '22

Syncing multiple domains/forests using single Azure AD connect is going to be tricky. I hope you might have already checked https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-topologies to confirm your scenario is supported even though it's syncing devices as well as users to Azure AD.

Also, MDM Enrollment GP - User authentication can be tricky sometimes - I know Anoop reported a strange issue like this (https://www.anoopcnair.com/intune-enrollment-error-unknown-win32-error/), but I don't think that is the case in your scenario.

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 3 · 2022-03-23T15:48:25.46Z

VeeraRagavan-5624 answered Mar 23, '22

Hello All,

I Found the Answer...

After Verifying the Domain, and made the UPN Rout-able to XYZ. Com for all Users with Azure AD P1 License, and Intune helped to On Board the Devices to Intune (Hyrbrid Join with GPO Settings)

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

question