Windows AutoPilot (IntuneManagementExtension) could not be stopped

Question

Windows Autopilot troubleshooting FAQ | Microsoft Learn

The guidance in the above article relating to the "MDM wins over Group Policy" (Control Conflict Policy) is unclear so I am looking for community feedback whilst I also ask Microsoft through a support article.

I'm trying to determine if the overall setting enablement of the control conflict policy is the problem or if that a device that has been targeted with other Policy CSPs that are handled under the control conflict policy is the issue (Policy CSP | Microsoft Learn - bottom of the page). We're hoping it is not the first option of just simply enabling, since we're really trying to transition a lot over to Intune in a hybrid environment where we can deliver a lot of the user-experience and device configuration quicker.

I am suspecting this being the issue to what I am seeing from the testing we're doing to understand the root case, as we're facing issues with the intunemanagementextension MSI being installed from the first CSP it runs.

Service 'Microsoft Intune Management Extension' (intunemanagementextension) could not be stopped. Verify that you have sufficient privileges to stop system services (and this is running as SYSTEM itself shown in the Application event log under ID 11921).

Appreciate any feedback

Answer 1

@OliverS, Thanks for posting in Q&A. In general, when the same setting is configured in both GPO and Intune. The GPO will take effect instead of the configuration in Intune. Then one policy MDMWinsOverGP comes and when it set value as 1, the Intune policy setting will win over GPO and it will take effect. But it only applies to policies in Policy CSP. But for migration, to avoid conflict, the recommended method is to configure it only in Intune and remove the policy in GPO.

https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-controlpolicyconflict#mdmwinsovergp

For the error when you stop the service, it shows you don't have enough permission to do this. Not relate with any CSP policy configured.

For Microsoft Intune Management Extension', this is a very important component and will be used when deploy PowerShell script, Win32 application and Microsoft Store new app. It will automatically installed during Autopilot phase. When the service is stopped, something like app deployment during Autopilot will be affected. And Autopilot will be failed. Could you let us know why you want to stop this service?

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.