Some Administrative template policies showing error as [131328 (The administrative template setting failed to be configured.)] after applied to windows 10 machine from MEM

Abdul Azeez 1

Hi,
I have applied some CIS benchmark policies But some of the policies showing error after i applied. Can you please help me to fix this and let me know why i get this error ?

2 answers

Rahul Jindal [MVP] 9,126 Reputation points MVP

2021-09-28T20:30:13.303+00:00

Do you have the same setting being configured using some other Intune policy or GPO? Have you looked under device management enterprise for event logs?
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment
Lu Dai-MSFT 28,336 Reputation points

2021-09-29T01:55:21.193+00:00

@AAbdulAzeez-8400 Thanks for posting in our Q&A. For this issue, I will share some information with you.

For "Turn off Windows Location Provider", this policy is currently only available as part of a Windows Insider release.
https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-locationprovideradm
For "Turn off automatic learning", this policy is available in the latest Windows 10 Insider Preview Build.
https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-globalization

So, the above two settings are not supported in the official windows version now.

For "Scan removable drives", it is only enforced in Windows 10 for desktop.
https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-allowfullscanremovabledrivescanning
For "Configure Windows Defender SmartScreen", it is added in windows 10, version 1703.
https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-smartscreen#smartscreen-enablesmartscreeninshell

Please make sure that the device meets the precondition. Then as RahulJindal said, please try to check if there is any detailed error message in Event viewer's Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Abdul Azeez 1 Reputation point

2021-09-30T06:02:27.35+00:00

Thanks for the response: I checked event viewer and got this error for some of above policies:

MDM PolicyManager: Policy is rejected by licensing, Policy: (Scan_DisableEmailScanning), Area: (ADMX_MicrosoftDefenderAntivirus), Result:(0x82B00006) Unknown Win32 Error code: 0x82b00006.

MDM PolicyManager: Policy is rejected by licensing, Policy: (RealtimeProtection_DisableBehaviorMonitoring), Area: (ADMX_MicrosoftDefenderAntivirus), Result:(0x82B00006) Unknown Win32 Error code: 0x82b00006.

MDM PolicyManager: Policy is rejected by licensing, Policy: (EnableSmartScreen), Area: (ADMX_WindowsExplorer), Result:(0x82B00006) Unknown Win32 Error code: 0x82b00006.

MDM ConfigurationManager: Command failure status. Configuration Source ID: (127ED142-70F6-4CC0-AD00-BF6EA03D2075), Enrollment Name: (MDMDeviceWithAAD), Provider Name: (Policy), Command Type: (Add: from Replace or Add), CSP URI: (./Device/Vendor/MSFT/Policy/Config/ADMX_WindowsExplorer/EnableSmartScreen), Result: (Unknown Win32 Error code: 0x82b00006).

I dont know why its showing policy rejected by licensing. we have M365 business standard and EMS E3. We have applied these policies to windows 10 pro with latest windows version (above 1909)

What could be the reason for these errors ?

Lu Dai-MSFT 28,336 Reputation points

2021-09-30T06:49:49.387+00:00

@Abdul Azeez Thanks for your update.

Generally, this error code occurs when the CSP doesn't support this OS. Based on my research, I find that ADMX_WindowsExplorer/EnableSmartScreen CSP doesn't support windows 10 pro devices.

However, others CSPs in these error messages support windows 10 pro devices. Could you please tell us that which group did you assign these policies, user group or devices group?

Abdul Azeez 1 Reputation point

2021-09-30T06:53:59.97+00:00

its device group

Abdul Azeez 1 Reputation point

2021-09-30T06:57:44.293+00:00

I also noticed that above failed errors are related to Microsoft defender. Do we need to have seperate Microsoft defender antivirus license to make this work?

Lu Dai-MSFT 28,336 Reputation points

2021-09-30T07:45:21.657+00:00

@Abdul Azeez There is no information describes that it needs separate license. With Q&A limitation, it is better to create an online support ticket to find the root cause. It is free. Here is the support link:
https://learn.microsoft.com/en-us/mem/get-support

Thanks for understanding.

Jason Sandys 31,146 Reputation points Microsoft Employee

2021-09-30T15:05:24.227+00:00

I dont know why its showing policy rejected by licensing. we have M365 business standard and EMS E3. We have applied these policies to windows 10 pro with latest windows version (above 1909)

Just because you have the licensing doesn't mean the device is actually licensed. The ADMX policies specifically require Enterprise and the others noted here may as well. Since you noted that the device is running Win Pro you need to determine why the device hasn't been upgraded to Enterprise.
Sign in to comment