Checklist
Autopilot ESP troubleshooting checklist
Find the app or policy holding up the Enrollment Status Page, collect the right logs from OOBE, and fix the profile settings behind most Autopilot ESP timeouts.
Downloadable toolkits
Troubleshooting toolkits you can print and reuse
Checklists, log references and decision trees distilled from the guides on this site — free for the Microsoft community. Every resource links back to the full article it came from, so you can trust the steps and go deeper when you need to.
102resources
8toolkits
102source articles
Intune · 18 resources
Intune Troubleshooting Toolkit
Checklists for the enrollment, Win32 app, compliance, BitLocker, script and device-sync problems that fill an Intune admin's week, plus the Intune Management Extension log reference and an enrollment decision tree — each distilled from a full guide on this site.
15 checklists · 2 references · 1 decision tree
Checklist
Win32 app troubleshooting checklist
0x87D1041C means the installer finished but the detection rule found nothing. The usual causes (bitness, install context, version drift) and how to test detection on the device.
Checklist
Windows Autopilot error 0x80180014 when redeploying a device: cause and fix
A reused Autopilot device fails MDM enrollment with 0x80180014. Why it happens, and the documented fixes: unblock or remove the stale Intune record and check enrollment restrictions.
Checklist
Windows enrollment error 0x80180018 and its neighbours: what to check, and where
Windows MDM enrollment fails with 0x80180018 or a nearby 0x8018 code. What Microsoft documents for each code, which tenant setting is behind it, and how to confirm the fix in the enrollment event log.
Checklist
Compliance policy troubleshooting checklist
Why devices fail the built-in Is active, Enrolled user exists and Has a compliance policy assigned checks in Intune, and how to clear each one before Conditional Access blocks users.
Checklist
Android enrollment troubleshooting checklist
A practical checklist for failed Android personally owned work profile enrollments: Managed Google Play, restrictions, licences, device requirements, existing profiles and logs.
Checklist
iOS/iPadOS & Apple ADE troubleshooting checklist
Why Apple ADE devices don't appear in Intune or enroll without the right policy: device assignment, token sync limits and renewal, default policies, and why a reset is needed.
Checklist
Intune device not checking in: diagnosing a Windows device that stopped syncing
A Windows device shows a stale last check-in in Intune and policies stop arriving. How check-in works, what to inspect on the device (service, tasks, certificate, network) and when to re-enroll.
Checklist
BitLocker silent encryption not starting on Intune-managed devices: causes and fixes
Silent BitLocker not starting? Check TPM, UEFI, Secure Boot and WinRE, the required policy settings, startup authentication conflicts and recovery key backup to Microsoft Entra ID.
Checklist
Intune PowerShell scripts not running: execution context, 64-bit, signing and where to look
An Intune platform script reports Failed or never runs. How the Intune Management Extension executes scripts, what the three script settings change, how retries and re-runs work, and where to look.
Checklist
Hybrid join Autopilot deployments time out with 0x80004005: the 2026 known issue and the fix
Microsoft Entra hybrid join Autopilot deployments can time out with 0x80004005 on older Windows 11 builds. How to confirm the known issue, which KBs fix it and how to get devices onto a fixed build.
Checklist
Graph API / inventory export checklist
Export your Intune device inventory to CSV with the Microsoft Graph PowerShell SDK, spot stale and noncompliant devices, and run it unattended with certificate-based app-only sign-in.
Checklist
Profile error 65000 / remediation failed checklist
Windows profile showing error 65000 or Remediation failed (0x87D1FDE8)? Decode the codes, read event 404 on the device, check edition, build and OMA-URI data, and fix the setting.
Checklist
Windows Hello for Business provisioning checklist
Fix Windows Hello for Business PIN setup failures on Intune PCs: the 0x801C and 0x8009 codes, Event ID 360 prerequisite lines, conflicting policy sources and dsregcmd checks.
Checklist
BitLocker recovery key escrow checklist
Encrypted device but no recovery key in Intune? Read BitLocker events 845 and 846, fix the join state and policy, re-escrow with BackupToAAD-BitLockerKeyProtector and prove it worked.
Reference
IME log reference
What each Intune Management Extension log records, how to read them with CMTrace, what to search for, how to force a check-in, and how to collect the logs remotely.
Reference
Intune log collection & MDM diagnostics guide
Settings stuck on Conflict in Intune? Find the competing policies, confirm what the device received with the MDM diagnostic report and event log, and rule out Group Policy.
Decision tree
Enrollment & Autopilot troubleshooting decision tree
Start from what you see on the device and follow the branches to the guide that fixes it — 9 enrollment and Autopilot failures on one printable page.
Open / print
9 source articles
Intune · 10 resources
Jamf + Intune Toolkit
Printable checklists for running Jamf Pro with Microsoft Intune and Entra ID — Device Compliance setup and migration, Mac registration and Conditional Access errors, the partner connector, Platform SSO, Jamf Connect, Defender deployment and moving devices to Intune — plus a decision tree for Jamf-managed Macs that are blocked or not compliant.
9 checklists · 1 decision tree
Checklist
Jamf Pro Device Compliance setup checklist
Build the Applicable and Compliance smart groups, run the Jamf Pro Device Compliance wizard, add the Intune compliance partner and require compliant Macs without blocking registration.
Checklist
Legacy integration to Device Compliance migration checklist
Move Macs off Jamf Pro's retired macOS Conditional Access integration: what changes, an order of steps that avoids lockouts, Jamf's migration script, verification and a realistic rollback plan.
Checklist
Mac registration (Company Portal / jamfAAD) checklist
Fix Jamf Device Compliance registration on Macs: Account not onboarded, Device is already enrolled, keychain prompts, duplicate Entra devices and registrations that never turn compliant.
Checklist
Mac blocked by Conditional Access checklist
A Mac is compliant in Jamf Pro, yet Conditional Access returns AADSTS53000. Read the sign-in log, find the broken link (registration, compliance sync, browser or device ID) and fix it.
Checklist
Jamf partner connector checklist
Jamf devices not reporting compliance to Entra ID? Check the Intune partner status, scoping, licences, the Entra apps Jamf's wizard creates, Jamf Pro smart groups and legacy leftovers.
Checklist
Platform SSO on Jamf-managed Macs checklist
Configure the Microsoft Enterprise SSO plug-in and Platform SSO from Jamf Pro: payload values, Company Portal first, Device Compliance registration, verification and the errors to expect.
Checklist
Jamf Connect with Entra ID checklist
Fix Jamf Connect sign-in with Microsoft Entra ID: the app registration, ROPG password checks, Conditional Access after the June 2026 change, and the AADSTS errors at the Mac login window.
Checklist
Defender for Endpoint via Jamf Pro checklist
Deploy Defender for Endpoint to Macs with Jamf Pro in the right order: onboarding plist, settings, permission profiles, a smart group gate and the package. Then read mdatp health and fix its errors.
Checklist
Jamf Pro to Intune migration checklist
Plan a Jamf Pro to Intune move: map profiles and scripts, reassign ADE devices, choose OS 26 migration or a wipe, handle FileVault, Activation Lock and app licences, and fix enrollment errors.
Decision tree
Jamf-managed Mac blocked or not compliant: decision tree
Start from what you see on the device and follow the branches to the guide that fixes it — 9 enrollment and Autopilot failures on one printable page.
Open / print
4 source articles
Exchange Server · 26 resources
Exchange Server Troubleshooting Toolkit
Printable checklists for the Exchange Server errors admins search for most — back pressure and queue errors, relay, databases that won't mount, unhealthy DAG copies, stalled moves, failed setup and updates, OWA 500 errors, Outlook and ActiveSync connectivity and Exchange Management Shell failures — plus hybrid, certificate and patching checklists and message tracking and protocol log references. Each is distilled from a full guide on this site.
24 checklists · 2 references
Checklist
452 4.3.1 back pressure checklist
Exchange answers 452 4.3.1 when back pressure kicks in. Find the resource under pressure, fix the cause or move the queue database, and confirm transport is back to normal.
Checklist
451 4.4.0 DNS query failed checklist
Queues stuck in Retry with 451 4.4.0 DNS query failed? Find the DNS servers transport really uses, test lookups from the Exchange server, and fix the resolver or connector.
Checklist
Anonymous relay (550 5.7.54) checklist
Apps get 550 5.7.54 when relaying to external recipients. Build a dedicated Frontend receive connector, allow only specific IPs to relay, and test it without creating an open relay.
Checklist
Database won't mount checklist
Mount-Database fails with ec=1108 and eseutil /mh says Dirty Shutdown? Find the logs Exchange needs, run soft recovery safely, and know when to restore or reach for eseutil /p.
Checklist
DAG copy FailedAndSuspended checklist
A passive DAG copy in FailedAndSuspended won't heal itself. Read the real error, fix the disk or log problem behind it, reseed with Update-MailboxDatabaseCopy and prove the copy is healthy.
Checklist
Stalled mailbox move checklist
Read StatusDetail and the MRS report to tell throttling by design from real problems, then fix stalled or failed on-premises mailbox moves and resume them safely.
Checklist
Failed Exchange setup recovery checklist
Exchange setup says it previously failed during Install or BuildToBuildUpgrade? Find the real error, resume with the same build and media, and treat Watermark cleanup as a last resort.
Checklist
Components inactive after an update checklist
Mail flow or OWA down after an Exchange CU or SU? Check Get-ServerComponentState, find which requester holds ServerWideOffline Inactive, finish the update and reactivate safely.
Checklist
Cumulative update pre-flight checklist
A practical checklist for Exchange Server SE and 2019 cumulative updates: backups, Health Checker, AD preparation, maintenance mode, elevated setup and the checks that prove it worked.
Checklist
Exchange Server security update checklist
Why Exchange Server security updates fail or break OWA and ECP, the documented fixes for the common errors, and the checks that prove an update really installed on every server.
Checklist
OWA and ECP HTTP 500 checklist
HTTP 500 or Server Error in '/ecp' on Exchange? Use the error text, IIS and HttpProxy logs to find the cause: a non-elevated update, a missing config file, certificates or app pools.
Checklist
Outlook can't connect (MAPI/HTTP) checklist
Outlook shows Disconnected or can't create a profile against Exchange Server. Check the user's MAPI settings, Autodiscover, the MAPI virtual directory, healthcheck.htm and load balancer probes.
Checklist
ActiveSync troubleshooting checklist
Phones stop syncing or never start. Check the device access state and rules, fix the AD permission problem behind Event ID 1053, and read ActiveSync status codes in the IIS log.
Checklist
Exchange Management Shell (WinRM) checklist
EMS fails with a WinRM error? Match the exact message to its cause - kerbauth and WSMan modules, Remote PowerShell access, the port 80 binding, Require SSL or a proxy - and fix it safely.
Checklist
DAG patching with maintenance mode checklist
Put an Exchange Server DAG member into maintenance mode the supported way: drain transport, move databases, pause the cluster node, patch, then bring it back and prove it's healthy.
Checklist
Hybrid Configuration Wizard troubleshooting checklist
Where the HCW log lives, how to find the line that really failed, and fixes for the usual causes: TLS, stale servers, Autodiscover, certificates, OAuth (HCW8064) and MRS.
Checklist
Exchange hybrid certificate renewal checklist
A safe runbook for renewing the public certificate behind hybrid mail flow: install it on every server, enable SMTP, update the connectors or rerun the HCW, then prove TLS works.
Checklist
Exchange Server SE in-place upgrade checklist
Upgrade Exchange Server 2019 CU14 or CU15 to Exchange Server SE in place: prerequisites, AD preparation, the Setup command, DAG maintenance mode, product keys and post-upgrade checks.
Checklist
Email security gateway in front of Exchange checklist
A vendor-neutral checklist for any gateway in front of Exchange: a scoped receive connector, InternalSMTPServers, the header firewall, TLS, a smart host connector and no mail loops.
Checklist
Exchange Writer (VSS) backup failure checklist
vssadmin shows the Microsoft Exchange Writer Failed or Retryable, or logs pile up after a 'successful' backup? Reset the writer, fix DAG conflicts and prove it with Windows Server Backup.
Checklist
Veeam application-aware backup checklist
Veeam jobs failing on the Microsoft Exchange Writer, or logs not truncating after a green job? Check application-aware settings, guest credentials, freeze timeouts and DAG job design.
Checklist
Journaling to a third-party archive checklist
Send Exchange Server journal reports to a hosted archive: standard vs premium journaling, a hidden contact, a dedicated TLS send connector, JournalingReportNdrTo and proof of delivery.
Checklist
Third-party transport agent isolation checklist
Mail stuck in Submission, event 1050 or EdgeTransport crashes after adding or updating an on-server mail security product? Find the agent, isolate it safely and prove the fix.
Checklist
Load balancer health check checklist
Set up any load balancer for Exchange Server SE and 2019: per-protocol healthcheck.htm monitors, SSL bridging with Extended Protection, no affinity, SMTP and Kerberos, and bad-VIP symptoms.
Reference
Message tracking reference
Follow any email through Exchange Server SE or 2019: read the tracking event IDs, filter Get-MessageTrackingLog, search every server and set log retention.
Reference
SMTP protocol log reference
Turn on SMTP protocol logging on the right connector, find the log files and read a session line by line to spot TLS, authentication and relay failures.
Configuration Manager · 13 resources
Configuration Manager (SCCM) Toolkit
Checklists for the Configuration Manager problems that fill a ConfigMgr admin's week — client installs, client health, management points, content distribution, application and software update deployments, PXE and task sequences — plus co-management and cloud management gateway checklists, each distilled from a full guide on this site.
12 checklists · 1 reference
Checklist
Client installation checklist (ccmsetup.log)
Trace a failed Configuration Manager client install from client push to site assignment: ccm.log, ccmsetup.log, client.msi.log, return codes, MP lookup and boundaries.
Checklist
Client health and inactive clients checklist
Tell inactive clients from unhealthy ones, read CcmEval results on the device, repair WMI and broken clients safely, and clean up stale records with the right maintenance tasks.
Checklist
Management point health checklist
Diagnose an unhealthy Configuration Manager management point with mpcontrol.log, status message 5436, mplist and mpcert tests, IIS and SQL checks, and the client-side logs.
Checklist
Content distribution troubleshooting checklist
Follow content from the site server to a distribution point through distmgr.log, PkgXferMgr.log and smsdpprov.log, and know when to update, redistribute or validate.
Checklist
Application deployment troubleshooting checklist
Follow a failing Configuration Manager app through the client logs - evaluation, content, install and detection - and fix stuck installs, timeouts and 0x87D00324.
Checklist
Software updates troubleshooting checklist
Follow a Configuration Manager update from scan to install: WSUS location, WUAHandler.log scan errors, Group Policy conflicts, content download and maintenance windows.
Checklist
PXE boot troubleshooting checklist
Work through a failing PXE boot in order: network and IP helpers, the PXE-enabled distribution point, boot images, deployments and unknown computers, reading SMSPXE.log at each step.
Checklist
Task sequence (smsts.log) troubleshooting checklist
Find smsts.log in every phase, keep the device on the error with F8, read the log from the failure upwards and fix driver, network, content and domain join failures.
Checklist
Co-management troubleshooting checklist
Why Configuration Manager clients don't become co-managed: read CoManagementHandler.log and the MDM enrollment events, fix scope, licence and MFA causes, and check who owns each workload.
Checklist
Co-management enablement checklist
Prepare hybrid join and automatic MDM enrollment, run the Cloud Attach wizard against a pilot collection, then prove on the device and in the Intune admin center that it is co-managed.
Checklist
Cloud management gateway checklist
Deploy a Configuration Manager cloud management gateway on an Azure scale set, connect it to your site, bring internet clients onto it, and read the right logs when clients can't connect.
Checklist
Current branch upgrade checklist
Prepare the site, get the update through the service connection point, pass the prerequisite check, install it, unstick downloads and installs, and finish the post-upgrade tasks.
Reference
Boundaries and boundary groups reference
How Configuration Manager clients use boundaries and boundary groups to pick a site, management point and content source, how fallback works, and how to verify it.
Defender · 9 resources
Defender Toolkit
Onboarding, antivirus policy, attack surface reduction, tamper protection and sensor-health checklists for Microsoft Defender for Endpoint on Windows and macOS, including the Sense event IDs you need when onboarding goes wrong.
9 checklists
Checklist
MDE onboarding checklist
Connect Intune to Microsoft Defender for Endpoint, onboard Windows devices with an EDR policy, then prove it worked on the device, in the Defender portal and with a detection test.
Checklist
Defender Antivirus troubleshooting checklist
Intune says the antivirus policy succeeded but the device disagrees. Check the management channel, conflicts, passive mode, tamper protection and exclusion behaviour to find out why.
Checklist
ASR rules rollout & troubleshooting guide
A phased plan for attack surface reduction rules in Intune: standard rules straight to Block, the rest in Audit, measured with advanced hunting, narrow exclusions, then enforce.
Checklist
Device shows "Inactive" or "No sensor data" in Microsoft Defender: how to troubleshoot
What Inactive, Impaired communications and No sensor data mean in the Defender device inventory, and how to check the sensor, onboarding state, proxy and duplicate device records.
Checklist
MDE onboarding validation: Sense event IDs
A field guide to Defender for Endpoint onboarding failures: onboarding script error codes, SENSE Operational event IDs, Intune error codes, and the registry and service checks that show where it broke.
Checklist
Tamper protection and Intune: why a Defender setting won't change, and how to fix it
What tamper protection locks, the four places it can be managed and their precedence, how to see which one controls a device, and how to fix settings that won't apply or exclusions that aren't protected.
Checklist
Onboarding macOS to Defender for Endpoint with Intune: profiles, app and onboarding package
The Intune deployment for Defender for Endpoint on Mac in the documented order: system extensions, Full Disk Access, network filter, background services, the app, the onboarding package, mdatp checks and fixes.
Checklist
Defender for Identity sensor health checklist
Classic v2.x or new v3.x sensor? Prerequisites, the Directory Service account and gMSA, the Health issues page and the fixes for the sensor health alerts you'll actually see.
Checklist
First-hour incident response checklist
A time-boxed first hour for a Defender XDR incident: claim it, read the attack story, scope users, devices and mailboxes with hunting, contain safely and document the hand-off.
Entra ID · 12 resources
Entra ID Toolkit
Conditional Access, Primary Refresh Token, hybrid join and PIM checklists, walkthroughs for the AADSTS errors users actually report, Entra Connect sync errors, and a reference for reading sign-in logs like an engineer.
11 checklists · 1 reference
Checklist
Conditional Access deployment checklist
The core Conditional Access policies to deploy first, how they map to Microsoft's templates and Microsoft-managed policies, and how to roll them out in report-only mode without locking anyone out.
Checklist
PRT troubleshooting guide
How the Primary Refresh Token powers single sign-on on Windows, how to check it with dsregcmd and the AAD event logs, and how to fix a missing or stale PRT.
Checklist
Hybrid join troubleshooting checklist
Read dsregcmd /status for hybrid join failures, check the SCP and Entra Connect sync, use the User Device Registration log and clear devices stuck in Pending.
Checklist
PIM implementation checklist
Set up PIM for Microsoft Entra roles: role settings, eligible assignments, activation and approvals, PIM for Groups, alerts, access reviews, and the activation problems you'll hit.
Checklist
AADSTS53000 vs AADSTS53003: troubleshooting Conditional Access sign-in blocks
What AADSTS53000, 53001 and 53003 actually mean, how to find the blocking policy in the sign-in logs, and how to fix compliance and browser device-identity gaps.
Checklist
AADSTS50076, AADSTS50079 and AADSTS50158: fixing MFA and authentication-strength sign-in errors
What the MFA-related AADSTS codes mean, how to read the Authentication details and Conditional Access tabs of a sign-in, and how to fix legacy clients, unregistered users and authentication strength mismatches.
Checklist
Entra Connect sync errors: duplicates, InvalidSoftMatch and objects that never sync
How to read Entra Connect export errors such as AttributeValueMustBeUnique, InvalidSoftMatch and LargeObject, fix matching problems with ms-DS-ConsistencyGuid, and find objects that filtering keeps out of Entra ID.
Reference
Sign-in log reading reference
The four sign-in log types, the fields that matter, how to trace one failed sign-in end to end, KQL against the SigninLogs table, export and retention by licence, and the misreads that waste hours.
Checklist
Seamless SSO troubleshooting checklist
Domain-joined users getting password prompts again? Decode the 8100x sign-in errors, then check the intranet zone, klist and the AZUREADSSOACC account and key.
Checklist
Entra Connect staging-mode switch-over checklist
Build an Entra Connect staging server from an exported configuration, prove what it would export with csexport, and switch the active server without surprises.
Checklist
AD FS to cloud authentication migration checklist
A low-risk path off AD FS: inventory relying parties and claim rules, enable password hash sync, pilot with staged rollout, convert the domain with Graph PowerShell, then decommission.
Checklist
Hybrid join configuration checklist
Pilot Microsoft Entra hybrid join with a client-side SCP, get computer sync scope right, switch to the forest-wide SCP in Entra Connect and validate with dsregcmd and Graph.
Exchange Online · 7 resources
Exchange Online Toolkit
Mail-flow checklists for message trace, SPF/DKIM/DMARC, the NDRs admins meet most often, compromised-mailbox investigation and anti-spam tuning, plus the SMTP AUTH relay reference for printers and apps.
6 checklists · 1 reference
Checklist
Email never arrived? Using message trace in Exchange Online to find out why
Run a message trace in the Exchange admin center or with Get-MessageTraceV2, read the delivery status and events, and pull older data from downloadable reports.
Checklist
SPF/DKIM/DMARC setup checklist
Publish one correct SPF record, turn on DKIM signing in the Defender portal, then move DMARC from p=none to p=reject without blocking your own legitimate mail.
Checklist
NDR 550 5.7.520: fixing “Your organization does not allow external forwarding”
Why Exchange Online blocks automatic forwarding to external addresses with 5.7.520, and how to allow it only for the mailboxes that need it instead of for everyone.
Checklist
NDR 550 5.4.1 “Recipient address rejected: Access denied”: Directory-Based Edge Blocking
Why Exchange Online rejects mail with 550 5.4.1 at the perimeter, how Directory-Based Edge Blocking and the accepted domain type cause it, and how to fix each common cause.
Checklist
Compromised mailbox investigation checklist
Microsoft's response order for a compromised mailbox, cmdlets that find malicious inbox rules and forwarding across every mailbox, what to read in sign-in and audit logs, and how to harden afterwards.
Checklist
Legitimate email landing in Junk: how EOP decides and the right way to fix it
Read the X-Forefront-Antispam-Report header (CAT, SFV, BCL, compauth) to see why a good message was junked, then fix it the supported way: submissions, Tenant Allow/Block List, sender authentication, not bypass rules.
Reference
Printers and apps can't send via Microsoft 365: SMTP AUTH, relay connectors and 5.7.57
What error 5.7.57 means, how SMTP AUTH client submission, SMTP relay and Direct Send differ, how to fix each cause, and where Basic authentication for SMTP AUTH stands.
Microsoft 365 · 7 resources
Microsoft 365 Admin Toolkit
Tenant-wide checklists for Microsoft 365 administrators — licensing errors, tenant hardening, Copilot readiness, sensitivity labels and DLP — plus audit-log and external-sharing references.
5 checklists · 2 references
Checklist
Group-based licensing troubleshooting checklist
Why group-based licence assignments fail for some members, where to see the errors, how to list affected users with Microsoft Graph PowerShell, and how to fix and reprocess them.
Checklist
Tenant hardening checklist
A practical hardening pass for a Microsoft 365 tenant: track progress in Secure Score, then fix admin roles, app consent, legacy authentication, SMTP AUTH, risky defaults and auditing.
Checklist
Copilot readiness: oversharing clean-up checklist
Copilot uses only what people can already open, so oversharing surfaces fast. Find it with data access governance reports, contain it, and fix it with site owners and labels.
Checklist
Sensitivity label rollout checklist
A phased sensitivity label rollout: design a small taxonomy, publish with default labels, enable SharePoint and OneDrive support, then auto-label safely using simulation.
Checklist
DLP: simulation to enforcement checklist
Take a Purview DLP policy from template to enforcement: simulate with policy tips, tune out false positives, onboard devices for endpoint DLP, then switch it on in stages.
Reference
Audit log search reference
Answer who did what in Microsoft 365: audit retention by licence, Purview audit search jobs, Search-UnifiedAuditLog for large result sets, and the operation names worth knowing.
Reference
External sharing settings reference
How organization, site and link settings combine to decide who can share what in SharePoint and OneDrive, with Set-SPOTenant and Set-SPOSite commands to audit and set them.
Suggest a resource
Missing a checklist you'd use every week?
Tell me which problem you keep solving by hand — the next checklist, log reference or decision tree may come from your suggestion.