This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(316.8, 25%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETA%3C/text%3E%3C/svg%3E)
Hello,
I am trying to troubleshoot a SCEP deployment for Intune that I have setup. Currently, my Intune devices receive the SCEP certificate profile which I can see in the Event Viewer but it has an error code which I cannot find any documentation for.
I have been looking at this guide from MSFT which mentions a 0x2ab0003 error code I receive is 0x82ab0011. As they mention, the error code translates to DM_S_ACCEPTED_FOR_PROCESSING but they do not mention 0x82ab0011.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 40%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EJK%3C/text%3E%3C/svg%3E)
0x82ab0011 mean DM_NGC_MANAGED_BY_GP. There is GP template managing group policy which is conflicting with Intune/MDM policy. Go to gpedit.msc > Administrative templates > Windows hello > set everything to not configured.
Force the intune sync and see if the issue fixes.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(115.19999999999999, 70%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERS%3C/text%3E%3C/svg%3E)
Good catch, had an old GPO to enable WHfB. Deleting it solved the issue for me.
One other thing I noticed is that the InstallUserSid is NULL in the 306 event. This blog shows that field being filled in with a SID so maybe that is part of the problem.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 30%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
@Taylor Artunian , In the event, I notice it mentioned to trigger the device to start the certificate enrollment and the support operation execute is correct.
ClientCertificateInstall/SCEP/UniqueID/Install/Enroll
https://learn.microsoft.com/en-us/windows/client-management/mdm/clientcertificateinstall-csp
For the unknown win32 error, based on my research, I didn't find it mentioned in official article. For the InstallUserSid null, maybe this can be related. Could you check if it is the same for other users? Did it affect the certificate use?
Thanks and I look forward to your reply.
@Taylor Artunian How's everything going? Did we have the opportunity to check the information we mentioned before. If there's any update, feel free to let us know.
Hi Crystal, It is happening for other users. I also created another SCEP profile with different settings and the NDES server delivered the certificate with no errors. I opened a ticket with Intune support to see if they can help me with the one that doesn't work.
Thank you for the assistance.
@Taylor Artunian Thanks for the update. If there's any solution we get, I appreciate your help to post here. Thanks and have a nice day!
I am having the exact same error, did you ever figure out what is the problem? Its like the profile cannot grab the UPN of the user or something causing enrollment to fail.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(108.80000000000001, 50%, 20%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
Same issue, Jayesh solution doesn´t work, no GPOs applied for WHFB.