oeltayeb.com · Intune Troubleshooting Toolkit

Checklist

Profile error 65000 / remediation failed checklist

Based on the article: Intune profile error 65000 and 0x87D1FDE8 (Remediation failed): causes and fixes · 5 min read

Error 65000 and Remediation failed are among the least helpful results in Intune: they tell you a Windows device received a setting and didn't apply it, but not why. In this post I'll decode the related codes, show how to find the failing setting and CSP node on the device, and fix the usual causes: edition, build, licensing, custom OMA-URI data and competing configuration.

Symptoms to confirm

  • A configuration profile shows Error for some devices, and Per setting status lists one or more settings with error 65000.
  • The device's Device configuration list shows the profile with 0x87D1FDE8 or -2016281112, sometimes displayed without the minus sign.
  • Custom OMA-URI profiles report other codes from the same family, or SyncML errors.
  • On the device, the MDM Admin event log records event ID 404.
65000
0x87D1FDE8 Remediation failed
-2016281112 (Remediation failed)
0x87D1FDE9 Not applicable for this device
0x87D1FDEB Data type conversion failed
0x87D10196 Syncml (406): The requested command failed because an optional feature in the request was not supported.
0x87D101F4 Syncml (500): The recipient encountered an unexpected condition which prevented it from fulfilling the request
Event ID 404: MDM ConfigurationManager: Command failure status.

Likely causes

  • Edition: the setting needs Enterprise or Education and the device runs Pro.
  • Licensing: the device should have stepped up to Enterprise through subscription activation but is still Pro.
  • Build: the setting was added in a later Windows release.
  • Device state: the setting depends on something the device lacks, such as BitLocker prerequisites, or Defender Antivirus being the active antivirus.
  • Custom OMA-URI mistakes: wrong path or scope, wrong data type, wrong value format, or an ADMX that was never ingested.
  • +1 more causes in the full article.
CodeMicrosoft's messageWhat it usually points to
0x87D1FDE8Remediation failedThe device couldn't apply or keep the value
0x87D1FDE9Not applicable for this devicePlatform, edition or OS doesn't support the setting
0x87D1FDEAInvalid parameter to CIM settingValue outside the allowed range or format
0x87D1FDEBData type conversion failedOMA-URI data type doesn't match the CSP
0x87D1FDEENot applicable because it lost in conflict resolutionAnother policy owns the setting
0x87D10194Syncml (404): The requested target was not found.Wrong path, or the node doesn't exist on this build
0x87D10196Syncml (406): The requested command failed because an optional feature in the request was not supported.Feature unsupported on this edition or build
0x87D101F4Syncml (500): The recipient encountered an unexpected condition which prevented it from fulfilling the requestThe CSP failed while applying; read the event log

Checklist

  1. 1

    Find the exact setting

    Open the profile and select Per setting status, or go to Devices › All devices, open the device, select Device configuration, then the profile and the failing setting. Note the setting name and test with one affected device.

  2. 2

    Read event 404 on the device

    Failures are logged under Applications and Services Logs › Microsoft › Windows › DeviceManagement-Enterprise-Diagnostics-Provider › Admin. Event 404 includes the CSP URI of the node that failed and a Result such as (The system cannot find the file specified.):

    powershell
    Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'
    Id      = 404
} -MaxEvents 30 -ErrorAction SilentlyContinue |
    Format-List TimeCreated, Message
  3. 3

    Check edition and build

    powershell
    Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
    Select-Object EditionID, DisplayVersion, CurrentBuild, UBR

    Each setting's CSP page on Microsoft Learn lists its scope, supported editions and minimum OS version; in the settings catalog, the setting's Learn more link takes you there. If the device should be Enterprise, fix the licence or activation.

  4. 4

    Correct custom OMA-URI settings

    • Copy the path from the CSP documentation; use ./Device/ for device scope and ./User/ only where the CSP supports user scope.
    • Match the data type (Integer, String, Boolean and so on) to the CSP's format. A mismatch can surface as 0x87D1FDEB or as a SyncML error.
    • ADMX-backed policies take the String data type with a value in this shape:
    xml
    <enabled/>
<data id="ExampleElementId" value="ExampleValue"/>

    Third-party ADMX settings only work after the ADMX file is ingested; see importing custom ADMX templates. Where a settings catalog equivalent exists, use it instead of OMA-URI.

  5. 5

    Deal with state-dependent settings

  6. 6

    Remove competing owners

    If another Intune policy or a GPO sets the same value, give the setting one owner. The policy conflicts guide covers this, including MDMWinsOverGP.

Verify

  • Sync from Access work or school › Info › Sync or with the Sync device action.
  • No new event 404 entries appear for that CSP URI, and the effective value shows under HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\<Area> or in a fresh MDM diagnostic report.
  • Per setting status shows Succeeded. Reporting can lag behind the device, so trust the device-side checks first.

Prevent it next time

Microsoft Learn references