Windows 10 MDM for the Group Policy Gurus


If you're an old-school group policy admin, you may be finding that the world of Mobile Device Management (MDM) in Windows 10 doesn't offer quite the same level of reporting and troubleshooting tools as you are used to. I'll keep this page as up-to-date as possible with tips and tricks for settings/policy management, reporting and troubleshooting for Windows 10 desktop devices and how the they relate to traditional group policy management. If you have any additions, please let me know!

Update: 20th October 2017 – In Windows 1709, getting MDM settings report (and logs) is much easier so I've documented those steps. Also added some the "Who wins" section.

Getting Resultant Settings (aka GPResult)

In Group Policy we use:

GPResult /h file.html or rsop.msc

In MDM we use:

Access work or school, Info, Create Report, Export.

Open the report from C:\Users\Public\Documents\MDMDiagnostics. The report will be called MDMDiagReport.html (You will also see an XML version and an export of the Device Management logs for further troubleshooting)

To find out what the policy settings values mean, go to Windows 10 URI Settings reference here: https://docs.microsoft.com/en-au/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune

 

Option 2: the quick and dirty way to check if your policy was downloaded by windows 10 - run powershell:

get-item 'HKLM:\Software\Microsoft\PolicyManager\current\device\*'

Troubleshooting Policy Application Events (Event Logging)

In Group Policy we use:

Microsoft-Windows-GroupPolicy/Operational, or Advanced Logging

In MDM we use:

Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin

Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug

Forcing a Policy Update (Aka GPUPDATE)

In Group Policy we use:

Gpupdate /Force

In MDM we use:

Settings>Access Work or School>Info>Sync

Settings Synchronization interval

In Group Policy we use:

A default value of 90 minutes with a 30 minute random offset (can be customized)

In MDM we use:

Every 3 minutes for 30 minutes after enrollment, and then every 8 hours

 

Who Wins?

In Windows 10, version 1709, when the same policy is configured in GP and MDM, the GP policy wins (GP policy is take precedence over MDM). In the future release of Windows 10 this might change with the ability for an IT admin to determine this behaviour - see https://docs.microsoft.com/en-au/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy

 

 


Comments (1)

  1. Guntrum Riesling says:

    This is great info, thank you.

    Looking forward to any updates that you have in the future!

Skip to main content