Fix Windows Devices Showing Not Compliant in Intune

Managing Windows devices within Microsoft Intune can sometimes lead to compliance issues, where devices are marked as “Not Compliant.” This can prevent access to corporate resources, hinder security policies, and cause frustration for users and IT administrators alike. Fortunately, resolving these compliance issues is often straightforward once you understand the root causes and proper troubleshooting steps. This guide walks you through the process of fixing Windows devices that show as not compliant in Intune, ensuring your fleet remains secure and compliant with your organization’s policies.

What You’ll Need

• Administrative access to the Microsoft Endpoint Manager admin center
• Access to the affected Windows device(s)
• Basic understanding of Intune policies and device management
• Optional: PowerShell or Command Prompt access on Windows devices for advanced troubleshooting

Step-by-Step

1. Identify the Non-Compliance Issue
   Log into the Microsoft Endpoint Manager admin center. Navigate to Devices > All devices. Find the device(s) marked as “Not Compliant.” Click on the device to view details. Under the Device compliance tab, review the compliance report to understand which policies are failing.
2. Review Compliance Policies
   Check the policies assigned to the device group. Common issues include password policies, encryption requirements, or OS version policies. Ensure that the policies are correctly configured and applicable to the device. Also, verify that the device is correctly assigned to the intended device groups.
3. Check Device Settings and Status
   On the Windows device, open Settings > Accounts > Access work or school. Select the connected account and click Info. Review the device’s enrollment status, compliance status, and any error messages. If the device is not properly enrolled, you may need to re-enroll it.
4. Sync the Device with Intune
   On the Windows device, open Settings > Accounts > Access work or school. Select the connected account, then click Sync. This prompts the device to fetch the latest policies from Intune. Wait a few minutes and then refresh the compliance status in Endpoint Manager.
5. Update or Correct Device Settings
   If specific policies are failing, manually update the device settings to comply. For example, if encryption is required, ensure BitLocker is enabled. If password complexity is an issue, set a compliant password. Use Control Panel > BitLocker Drive Encryption or Settings > Accounts > Sign-in options for adjustments.
6. Remediate and Re-evaluate
   After making the necessary adjustments, force a compliance check by clicking Sync on the device in Endpoint Manager. Confirm the device shows as compliant after the sync completes. If issues persist, consider removing and re-enrolling the device.
7. Review and Adjust Policies if Needed
   Sometimes, overly strict policies or misconfigurations cause compliance failures. Review your policies in Endpoint Manager under Devices > Compliance policies. Adjust settings to be realistic and achievable for all devices, then redeploy.
8. Automate Monitoring and Alerts
   Set up alerts in Endpoint Manager to notify you when devices become non-compliant. Regular monitoring helps catch issues early and maintain an overall compliant device fleet.

Common Mistakes

• Failing to assign policies to the correct device groups
• Ignoring device sync prompts; devices need to sync periodically to update policies
• Disregarding error messages during enrollment or policy application
• Using outdated policies or configurations that conflict with current device settings
• Not re-enrolling devices after major OS updates or resets

Tips

• Always keep your policies up to date, reflecting current security requirements
• Use the Troubleshooting + support feature in Endpoint Manager for detailed logs
• Encourage users to perform regular device syncs and updates
• Document common compliance issues and solutions for your organization
• Leverage PowerShell scripts for bulk remediation if needed

Troubleshooting

If your device remains non-compliant after following the above steps, consider the following troubleshooting tips:

• Check Event Logs: On the Windows device, open Event Viewer and look for entries related to MDM, enrollment, or compliance errors. This can reveal specific issues like failed policy applications or errors with encryption.
• Verify Enrollment Status: Ensure the device is properly enrolled with the correct management authority. Re-enroll if necessary, following your organization’s device enrollment process.
• Review Policy Conflicts: Conflicting policies can cause compliance issues. Review all assigned policies and remove or modify conflicting ones.
• Update Windows: Make sure the device is running a supported, up-to-date version of Windows. Outdated OS versions can cause compliance checks to fail.
• Use Troubleshooting Tools: Utilize the Troubleshooting + support feature in Endpoint Manager to generate logs and identify issues.
• Consult Support Resources: When stuck, consult Microsoft documentation or reach out to Microsoft support for complex cases.

Frequently Asked Questions

1. Why does my Windows device show as not compliant even after fixing policies?

This can happen if the device hasn’t synced recently, policies are conflicting, or there are underlying OS issues. Ensure the device syncs and review logs for errors.

2. How often should devices sync with Intune to stay compliant?

Devices typically sync every 8-24 hours automatically. You can manually sync via Settings > Accounts > Access work or school > Info > Sync now.

3. What should I do if re-enrolling a device doesn’t fix compliance issues?

Ensure the device is properly unenrolled first, then re-enroll following your organization’s process. Check for device OS updates and remove conflicting policies.

4. Can I fix compliance issues remotely?

Yes, many issues can be resolved remotely through Endpoint Manager by pushing policies, forcing device syncs, or issuing commands via PowerShell.

5. How do I prevent compliance issues in the future?

Regularly review and update policies, educate users on device management best practices, and monitor compliance dashboards for early detection.

Related

• Fix Windows 0x0000011b Network Printing Error Easily
• How to Fix the ‘Window Has Crashed’ Error in VS Code on Windows 11
• Fix Wi-Fi Blocking Encrypted DNS Traffic Warning on iPhone and iPad