Windows enrollment rarely explains itself: you get "Something went wrong" and a code such as 80180018, an event 76, or a Client ErrorCode in dsregcmd /status. This reference lists the codes Microsoft documents for MDM enrollment (0x8018…) and for Microsoft Entra join and hybrid join (0x801C…, plus the TPM and network codes behind them), with the meaning, the usual cause in an Intune tenant and the first check. Autopilot codes have their own Windows Autopilot quick reference.
Codes in this quick reference
0x80180018 MENROLL_E_USERLICENSE: the user's licence state blocks enrollmentOOBE / Access work or school0x80180003 MENROLL_E_DEVICE_AUTHORIZATION_ERROR: the user isn't authorized to enrollOOBE / Access work or school0x80180013 MENROLL_E_DEVICECAPREACHED: the user has enrolled too many devicesOOBE / Access work or school0x80180014 MENROLL_E_DEVICENOTSUPPORTED: Your organization does not support this version of Windows.OOBE / Access work or school0x8018002b Auto MDM Enroll: Failed (Group Policy automatic enrollment, event 76)DeviceManagement-Enterprise-Diagnostics log0x80180031 MENROLL_E_MDM_NOT_CONFIGURED: MDM isn't configuredOOBE / Access work or school0x80180026 MENROLL_E_DEVICE_MANAGEMENT_BLOCKED: MDM enrollment was blockedOOBE / Access work or school0x8018001C MENROLL_E_PLATFORM_LICENSE_ERROR: this Windows version doesn't support the enrollment typeOOBE / Access work or school
+ 42 more codes in the tables below.
How to read these codes#
The same failure can surface in three places:
- On screen. During OOBE or in Settings › Accounts › Access work or school, the error page usually drops the
0xprefix, so0x80180018appears as 80180018. - Enrollment event log. Applications and Services Logs › Microsoft › Windows › DeviceManagement-Enterprise-Diagnostics-Provider › Admin. For Group Policy automatic enrollment, event 75 is a success and event 76 (
Auto MDM Enroll: Failed) carries the code. - Join diagnostics. For hybrid join, the Diagnostic Data section of
dsregcmd /statusshows the Error Phase (precheck, discover, auth or join), the Client ErrorCode and the Server ErrorCode; a failed discovery adds a sub-error, as inDRS Discovery Test : FAIL [0x801c0021/0x80072ee2]. Older builds log this under Microsoft › Windows › User Device Registration (events 304, 305 and 307).
The prefix names the component: 0x8018… is the MDM enrollment client (MENROLL_E_ values from MDMRegistration.h), 0x801C… is Microsoft Entra device registration (DSREG_), 0x8009…, 0x8028… and 0x8029… come from the TPM and key storage, and 0x80072E… or 0x80072F… are WinINet network errors. When Intune declines an enrollment it also returns a fault subcode such as DeviceCapReached, shown in brackets below where Microsoft documents one. Some logs print signed decimals instead of hex:
PowerShell
'0x{0:X8}' -f -2145648611 # 0x801C001D
[int]0x80180018 # -2145910760
# Collect enrollment and provisioning logs into one cab
mdmdiagnosticstool.exe -area 'DeviceEnrollment;DeviceProvisioning' -cab C:\enroll.cabMDM enrollment codes (0x8018…)#
Most of these are decided by tenant settings, so start in the Microsoft Intune admin center.
Licence, scope and restrictions#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x80180018 | MENROLL_E_USERLICENSE: the user's licence is in a state that blocks enrollment (UserLicense) | No Intune licence, or the Intune service plan is switched off inside the licence | Users › All users › the user › Licenses (0x80180018 guide) |
0x80180003 | MENROLL_E_DEVICE_AUTHORIZATION_ERROR: the user isn't authorized to enroll | Intune declined the user (fault subcode Authorization); Microsoft doesn't list specific triggers | The user's licence, the MDM user scope under Devices › Device onboarding › Enrollment › Windows › Automatic Enrollment, and the enrollment restrictions that apply to them |
0x80180013 | MENROLL_E_DEVICECAPREACHED: the user has already enrolled too many devices (DeviceCapReached) | The Intune device limit restriction (it doesn't apply to Group Policy, bulk or device enrollment manager enrollments) | The user's device records; retire old ones before raising the limit |
0x80180014 | MENROLL_E_DEVICENOTSUPPORTED: platform or version not supported (DeviceNotSupported); on screen "Your organization does not support this version of Windows." | Windows (MDM) set to Block in a device platform restriction; on a reused Autopilot device, the old Intune record | Every Windows platform restriction that can apply (0x80180014 guide) |
0x8018002b | Auto MDM Enroll: Failed (Unknown Win32 Error code: 0x8018002b), event 76, Group Policy enrollment | UPN with an unverified or non-routable suffix such as .local, or MDM user scope set to None | Fix the UPN suffix in AD, then Start-ADSyncSyncCycle -PolicyType Delta; check the MDM user scope |
0x80180031 | MENROLL_E_MDM_NOT_CONFIGURED: MDM isn't configured | Windows found no MDM configuration to use; Microsoft gives no further detail | Automatic Enrollment: MDM user scope and the default MDM URLs; an empty MdmUrl in dsregcmd /status |
0x80180026 | MENROLL_E_DEVICE_MANAGEMENT_BLOCKED: MDM was blocked, possibly by Group Policy | The Disable MDM Enrollment policy; Microsoft also lists an old Intune PC client (agent) left installed | DisableRegistration under HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM; gpresult /h C:\gp.html |
0x8018001C | MENROLL_E_PLATFORM_LICENSE_ERROR: the installed Windows version doesn't support this enrollment type | An edition that can't use the chosen enrollment method | The edition in Settings › System › About |
0x80180015 | MENROLL_E_NOTSUPPORTED: MDM isn't supported on this device at all | A device type or SKU that can't be MDM-managed | Edition and device type; retrying won't help |
Device state and re-enrollment#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x8018000A | MENROLL_E_DEVICE_ALREADY_ENROLLED; on screen "The device is already enrolled." | Another user already enrolled the device or joined it to Microsoft Entra ID | Sign in as that account, remove its connection in Access work or school, then enroll |
0x8007064c | "The machine is already enrolled." (enrollment log) | An earlier enrollment, a cloned image of an enrolled PC, or the old account certificate still present | Remove the Sc_Online_Issuing Intune certificate and HKLM\SOFTWARE\Microsoft\OnlineManagement (back up first) |
0x80180009 | MENROLL_E_ENROLLMENT_IN_PROGRESS: another enrollment is already running | Overlapping attempts, such as the Group Policy task and a manual enrollment | Let the first attempt finish, then retry once |
0x8018001B | MENROLL_E_PLATFORM_WRONG_STATE: an invalid operation, such as enrolling the same device twice | Leftover enrollment state | Old connections in Access work or school; entries under HKLM\SOFTWARE\Microsoft\Enrollments |
0x8018000B | MENROLL_E_DEVICE_NOT_ENROLLED: the device isn't enrolled | An action needs an enrollment that no longer exists | MdmUrl in dsregcmd /status and the Intune record (Company Portal guide) |
0x80180016 | MREGISTER_E_NOTELIGIBLETORENEW: the server rejected the MDM certificate renewal (NotEligibleToRenew) | Microsoft's first suspect is the device clock; otherwise the service no longer accepts this enrollment for renewal | Device date and time; if the clock is right, re-enroll, which Microsoft says can resolve it (check-in guide) |
0x80180030 | MENROLL_E_USER_CANCELED: the user canceled the operation | Sign-in or enrollment prompt closed | Retry with the user present |
Network, certificates and service responses#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x80180010 | MENROLL_E_CONNECTIVITY: a network error such as DNS failure or a timeout | Proxy, firewall or DNS blocking the enrollment endpoints | Test-NetConnection enrollment.manage.microsoft.com -Port 443 |
0x80180012 | MENROLL_E_INVALIDSSLCERT: the SSL certificate wasn't valid | TLS inspection replacing Microsoft's certificate | Exclude the Intune endpoints from inspection |
0x8018000D | MENROLL_E_DISCOVERY_SEC_CERT_DATE_INVALID: certificate date invalid during discovery | Wrong device clock, or an inspected certificate | Date, time and time zone; w32tm /resync |
0x80180001 | MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR: invalid message format from the server (MessageFormat) | A proxy altering the response | Retry on a network without the proxy |
0x80180029 | MENROLL_E_EMPTY_MESSAGE: HTTP 200 with an empty message | A proxy or captive portal answering instead of Intune | The same test off the proxy |
0x80180002 | MENROLL_E_DEVICE_AUTHENTICATION_ERROR: the server failed to authenticate the user (Authentication) | Token not accepted: wrong account, or sign-in blocked | The user's Microsoft Entra sign-in log at that time |
0x8018000F | MENROLL_E_WAB_ERROR: error during web authentication broker (WAB) enrollment | The sign-in page couldn't complete: blocked URLs or a policy prompt | Sign-in log; required Microsoft Entra URLs |
0x80180005, 0x80180006, 0x80180008 | Server errors: management server failure, unhandled exception, unknown error | Usually transient on the service side | Intune service health; retry, then open a case with the time and code |
0x80180027 | MENROLL_E_CERTPOLICY_PRIVATEKEYCREATION_FAILED: the private key couldn't be created | Microsoft names no cause; the key is generated on the device, so the TPM and key storage are the first suspects | Get-Tpm (TpmPresent, TpmReady); TPM firmware |
0x80180032 | The server responded with a custom error string (Microsoft's page reuses the 0x80180031 constant name here) | Intune sent its own reason | Read the text in the DeviceManagement-Enterprise-Diagnostics-Provider Admin log |
0x8018001E to 0x80180025 | MENROLL_E_PROV_*: provisioning failed in a configuration service provider (CSP) | A client-side step failed after the service accepted the device | The event log and registry dump in the MDM diagnostics cab; for 0x80180022 during Autopilot see the Autopilot reference |
Messages without a code#
| Message | Meaning | Usual cause | First check |
|---|---|---|---|
| "This account is not allowed on this phone." | Licence check failed | No valid Intune licence | Assign a licence that includes Intune |
| "Looks like we can't connect to the URL for your organization's MDM terms of use." | The MDM terms of use step failed | Basic Mobility and Security plus Intune in one tenant with an unlicensed user, or a blank or wrong terms of use URL | The licence; Restore default MDM URLs so the URL is https://portal.manage.microsoft.com/TermsofUse.aspx |
| "A setup failure has occurred during bulk enrollment." | Provisioning package join failed | The package's account (package_GUID) isn't allowed to join devices | Entra ID › Devices › Device settings: Users may join devices to Microsoft Entra ID |
Microsoft Entra join and hybrid join codes (0x801C…)#
Hybrid join runs in the system context (the Automatic-Device-Join task under Microsoft › Windows › Workplace Join), so test proxies and firewalls as SYSTEM; netsh winhttp show proxy shows the machine proxy. Windows Hello codes in the same range, such as 0x801C03ED, are in the Windows Hello for Business errors guide.
Discovery: SCP, DRS and realm#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x801c001d | DSREG_AUTOJOIN_ADCONFIG_READ_FAILED: the service connection point (SCP) couldn't be read; with event 220, the computer object couldn't be read | Missing or wrong SCP; AD replication (errors 1312 or 1317) | The SCP (SCP guide); AD replication health |
0x801c0021 | DSREG_AUTOJOIN_DISC_FAILED: generic discovery failure | Discovery metadata couldn't be fetched; the sub-error has the detail | The DRS Discovery Test line (dsregcmd guide) |
0x801c001f | DSREG_AUTOJOIN_DISC_WAIT_TIMEOUT: discovery timed out | enterpriseregistration.windows.net unreachable as SYSTEM | Machine proxy and firewall rules |
0x801c003d | DSREG_AUTOJOIN_USERREALM_DISCOVERY_FAILED: couldn't tell whether the domain is managed or federated | login.microsoftonline.com unreachable as SYSTEM | Proxy authentication for the computer account |
0x801c003a | DSREG_DISCOVERY_TENANT_NOT_FOUND: wrong tenant ID in the SCP, or no active subscription | SCP pointing at the wrong tenant | The azureADId keyword on the SCP |
0x801c0025 | DSREG_SERVER_BUSY: HTTP 503 from the device registration service | Service temporarily unavailable | Retry later |
0x8007000d | E_INVALIDDATA: the server's JSON response couldn't be parsed | A proxy returning an HTML sign-in page with HTTP 200 | Proxy authentication for the computer account |
Join phase, device objects and quotas#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x801c03f2 | DSREG_E_DIRECTORY_FAILURE: DirectoryError, typically "The device object by the given id (…) isn't found." | Sync-join tried before Microsoft Entra Connect synced the computer | The computer's OU in sync scope; wait for a sync cycle (dsregcmd guide) |
0x801c0002 | DSREG_E_DEVICE_AUTHENTICATION_ERROR: AuthenticationError from the registration service | Certificate on the device object doesn't match the sync-join one, usually because sync hasn't finished | Let sync finish, then retry |
0x801c0006 | DSREG_E_DEVICE_INTERNALSERVICE_ERROR: error response from the registration service | Service side; the server error code has the reason | Server ErrorCode and Server Message in dsregcmd /status |
0x801C000E | Device registration quota reached (reported by admins; Microsoft documents the device limit, not this code) | The user has hit the Microsoft Entra maximum number of devices per user, which blocks further registrations | Entra ID › Devices › Device settings; delete stale devices |
AADSTS90002: Tenant UUID not found. | DirectoryError during sync-join | No active subscription, or a wrong tenant ID in the SCP | The SCP tenant ID |
| "Your request is throttled temporarily. Please try after 300 seconds." | DirectoryError during federated join | Several registration requests in quick succession | Wait for the cool-down, then retry |
TPM and network errors#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x80090016 | NTE_BAD_KEYSET: the TPM keyset doesn't exist | TPM cleared, or an image sysprepped from a joined or registered PC | Stop clearing TPMs; build images from a PC that was never joined |
0x80290407, 0x80280036 | TPM_E_PCP_INTERNAL_ERROR (generic TPM error); TPM_E_NOTFIPS (TPM in FIPS mode isn't supported) | TPM firmware or mode | TPM firmware update; Windows 10 1809 and later finish the join without the TPM |
0x80090031 | NTE_AUTHENTICATION_IGNORED: the TPM is locked out | Transient lockout | Wait for the cool-down; the next attempt should succeed |
0x80072ee2 | WININET_E_TIMEOUT: network timeout | Proxy or firewall dropping the connection | https://enterpriseregistration.windows.net from the system context |
0x80072efd, 0x80072efe | WININET_E_CANNOT_CONNECT; WININET_E_CONNECTION_ABORTED | Connection blocked or cut off | Firewall rules; retry from a stable network |
0x80072ee7 | WININET_E_NAME_NOT_RESOLVED: the server name couldn't be resolved | DNS | Resolve-DnsName enterpriseregistration.windows.net |
0x80072f8f | WININET_E_DECODING_FAILED: the response couldn't be decoded | A proxy modifying the server response | Bypass inspection for the registration endpoints |
How to verify a fix#
Repeat the failed step, then confirm:
- Enrollment log: a new event 75 and no new event 76. For user-driven enrollment, Sync under Access work or school › the account › Info completes.
- Join state:
dsregcmd /statusshowsAzureAdJoined : YES(plusDomainJoined : YESfor hybrid), anMdmUrlonenrollment.manage.microsoft.comand, once the user signs in,AzureAdPrt : YES. - Intune: the device appears under Devices › Windows with a recent check-in, and its Microsoft Entra record shows Microsoft Intune as the MDM.
PowerShell
dsregcmd /status | Select-String 'AzureAdJoined|DomainJoined|MdmUrl|AzureAdPrt '
Get-WinEvent -LogName 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin' -MaxEvents 200 |
Where-Object Id -in 75, 76 | Select-Object TimeCreated, Id, Message -First 5To retry Group Policy enrollment now, run the Schedule created by enrollment client for automatically enrolling in MDM from Microsoft Entra ID task under Microsoft › Windows › EnterpriseMgmt. For hybrid join, sign out and back in so Automatic-Device-Join runs again.
References#
- Troubleshooting Windows device enrollment errors in Intune (Microsoft Learn): on-screen messages and causes
- MDM registration error values (MDMRegistration.h) (Microsoft Learn): the MENROLL_E codes
- Mobile device enrollment (Microsoft Learn): server fault subcodes
- Troubleshoot Microsoft Entra hybrid joined devices (Microsoft Learn): DSREG, TPM and network codes
