Protect what matters – even after you're gone. Make a plan for your digital legacy today.
Forum Discussion
AHappyFox
6 days agoNew Member
Group Policy Intune ADMX Ingestion Error
Hi 1Password Community,
We've been looking at managing 1Password policies through the generated ADMX+ADML files. The files themselves upload to Intune fine, but when the client is attempting to ingest the file(s) we receive the following error:
MDM ConfigurationManager: Command failure status. Configuration Source ID: (5B33F6A6-E59D-4384-8CB2-6858C3CCF0CD), Enrollment Name:
(MDMDeviceWithAAD), Provider Name: (Policy), Command Type: (Add: from Replace or Add), CSP URI:
(./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/OnePassword82518298-c5ba-4142-b473-7d937e4105c6/Policy/OnePassword82518298-c5ba-4142-b473-7d937e4105c6), Result: (Catastrophic failure).
See image 1
Originally, this was thought of as a bug as the feature was still fairly recently implemented. After a couple of months of waiting, I tried generating the files again earlier this week (currently using app version "1Password for Windows 8.11.20 (81120039)") and discovered the same error is still present. The patch notes for January 19th mention that this should have been fixed, but when trying again these past couple of days the error persisted.
https://releases.1password.com/windows/stable/#1password-for-windows-8.12.0
See image 2
Doing some research, I came across the following GitHub-repo: https://github.com/Micke-K/IntuneManagement/blob/master/ADMXImport.md, which mentions that QWORD-values are unsupported and will generate a catastrophic failure on the clients - exactly the same as we've been experiencing on our clients.
See image 3
Based on this revelation, I started to manually edit the ADMX and ADML-files to remove all entries for "longDecimal", which equals to these two policies:
- security_authenticatedUnlock_deviceBasedUnlock_askUnlockAfter
- security.autolock.minutes
Once these entries were removed from both files and reuploaded to Intune - it started working without any further errors:
- ADMX Ingestion:
MDM PolicyManager: ADMX Ingestion: EnrollmentId (8BE04C50-54DF-4B0D-AA1C-9A79C476C468), app name (OnePassword975d1c63-2406-4643-8f93-cb4034eb3382), setting type (Policy), unique Id (OnePassword975d1c63-2406-4643-8f93-cb4034eb3382), area (NULL). - Policy Creation:
MDM PolicyManager: Set policy string, Policy: (ManagedInstall), Area: (OnePassword975d1c63-2406-4643-8f93-cb4034eb3382~Policy~onepassword), EnrollmentID requesting merge: (8BE04C50-54DF-4B0D-AA1C-9A79C476C468), Current User: (Device), String: (<enabled/><data id="ManagedInstall" value="X" />), Enrollment Type: (0x6), Scope: (0x0).
See image 4 and 5
As the error appears to be related to the ADMX Ingestion not being able to handle QWORD-values, the root cause of the problem may lie with Microsoft. Would it be possible from 1Passwords side to look into having the two policies be handled through either a DWORD or a String instead of a QWORD?
2 Replies
- AHappyFoxNew Member
- AHappyFoxNew Member
I sadly hit the 10 images during a 24-hour window when creating this post as there was some invalid HTML. I'll re-add the images once the 24-hour windows has expired.
Edit: I've now tried to add the images on three separate attempts, with my last attempt showing they were successfully uploaded, but were missing upon a reload of the page.