Disable Intune ESP FirstSync Registry Entries Event Logs

Let’s understand how to Disable Intune ESP for WVD, analyze Intune ESP FirstSync Registry Entries, & ESP Event Logs. Probably, I’m the odd one out here, and I require to disable the Enrollment Status Page (ESP) for Windows Virtual Desktop(WVD) deployments.

There are some special reasons that I don’t want to deploy ESP policy to WVD VMs. I will try to cover “special” reasons in future posts (maybe?). Also, you get a bit of understanding about troubleshooting options for the Enrollment Status Page from this post.

I have a post about Intune Enrollment Status Page Troubleshooting. In my experience, ESP works well with Windows Autopilot enrollment. However, ESP doesn’t solve the same purpose for Intune group policy enrollment used in the WVD world.

Patch My PC

Issue Intune ESP

The following are some of the steps I tried to fix Intune ESP policy issue with the portal workload. I didn’t want to use any custom CSP policy to disable ESP before testing all other possibilities.

I tried to deploy “disable ESP policy” using the option Show app and profile configuration progress to NO without any luck.

Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting

I also tried to configure the stupid things like “Show an error when installation takes longer than the specified number of minutes” to 1 minute again without any luck.

1E Nomad
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting

Well, all these ESP policies are set to priority 1. But again, no luck. WVD users were still getting ESP screens after Windows 10 2004 upgrade. This was a bit irritating.

Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting

Intune ESP Known Issues

I don’t know how many of you noticed the ESP known issues documentation on Microsoft docs. I don’t want to pretend that I understand the first point from the known issue list.

Disabling the ESP profile doesn’t remove the ESP policy from devices and users still get ESP when they login to the device for the first time. The policy isn’t removed when the ESP profile is disabled.

Is this reason why I am getting all these inconsistent test results related to Enrollment Status Page (ESP)? I don’t know! Let me know what you think in the comments.

Intune ESP FirstSync Registry Entries

I tried to check the registry entries for corresponding registry entries for ESP policies. The ESP policy configuration from the MEM admin center portal never seems to make any registry entry changes.

Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting

The registry details of Intune ESP -> Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\E3FFGF09-E4T7-421F-A54E-31774312A31C\FirstSync

Initial Registry Entries for Intune ESP policies

  • AllowCollectLogsButton -> 4294967295
  • BlockInStatusPage -> 7
  • BlockInStatusPage -> 0
  • SkipUserStatusPage -> 0
  • SyncFailureTimeout -> 90 (Even though I set the policy as 60 Minutes)
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting

Registry Entries after Enrollment and Restart

  • AllowCollectLogsButton -> 4294967295
  • BlockInStatusPage -> 7
  • IsServerProvisioningDone -> 1
  • BlockInStatusPage -> 0
  • SkipUserStatusPage -> 0
  • SyncFailureTimeout -> 90 (Even though I set the policy as 60 Minutes)
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting

Intune ESP Related Even Log Entries

Now, let’s check the Intune ESP policy-related event log entries. This might help you to troubleshoot Intune ESP (Enrollment Status Page) issues.

Event Logs -> Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin

  • Event ID 352 – First Sync: Setting ContinueAnyway. EnrollmentID: (E9B207C1-F3EA-44FF-BB71-BDF820DE59DA) SID: (S-1-5-21-1493617020-3973123668-451752572-367741) Value: (0x1).
  • Event ID 351 -First Sync: Setting IsSyncDone. EnrollmentID: (E9B207C1-F3EA-44FF-BB71-BDF820DE59DA) SID: (NULL) Value: (0x1) FromServer: (0x0).
  • Event ID 361 – First Sync: Getting DeviceProvisioningStatus. EnrollmentID: (E9B207C1-F3EA-44FF-BB71-BDF820DE59DA) Status: (0x2).
  • Event ID 360 -First Sync: Setting DeviceProvisioningStatus. EnrollmentID: (E9B207C1-F3EA-44FF-BB71-BDF820DE59DA) SID: (NULL) Status: (0x0) FromServer: (0x0).
  • Event ID 2300 – Bootstrap Enrollment Status Page: publish notification value: (0x1).
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting

Disable Intune ESP

Finally, I was able to fix to disable Intune ESP policy (out of box policy as mentioned above) issue with the custom Windows 10 CSP mentioned below. More details about here.

Provider/ProviderID/FirstSyncStatus/SkipDeviceStatusPage Added in Windows 10, version 1803. This node decides whether or not the MDM device progress page skips after Azure AD is joined or Hybrid Azure AD is joined in OOBE.

Provider/ProviderID/FirstSyncStatus/SkipUserStatusPage – Added in Windows 10, version 1803. This node decides whether or not the MDM user progress page skips after Azure AD is joined or Hybrid Azure AD Joins after the user’s login.

  • Name: Disable User ESP
  • OMA-URI: ./Vendor/MSFT/DMClient/Provider/MS DM Server/FirstSyncStatus/SkipUserStatusPage
  • Data type: Boolean Value: True 
  • Name: Disable Device ESP
  • OMA-URI: ./Vendor/MSFT/DMClient/Provider/MS DM Server/FirstSyncStatus/SkipDeviceStatusPage
  • Data type: Boolean Value: True
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting

Registry Details after deploying disable Intune ESP policies to Windows 10 devices.

You can get the registry details of Intune ESP -> Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\{EnrollmentGUID}\FirstSync

  • SkipDeviceStatusPage – ffffffff
  • SkipUserStatusPage – ffffffff
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\A1FGHFE4-3C44-462A-8E60-D470F2486D44\FirstSync]
"SyncFailureTimeout"=dword:0000005a
"BlockInStatusPage"=dword:00000007
"SkipDeviceStatusPage"=dword:ffffffff
"SkipUserStatusPage"=dword:ffffffff
"AllowCollectLogsButton"=dword:ffffffff
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting
Disable Intune ESP for WVD | FirstSync Registry Entries | Event Logs | Troubleshooting

Resources

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.