Troubleshooting Microsoft (Windows) Intune Extensions

Most of you are problably aware of Microsoft (Windows) Intune extensions and using them briefly without any issue(s). New extensions becomes automatically available through the Microsoft Intune connector and new updates are merged or installed to introduce new features taking benefits of the Microsoft Intune cloud services platform.

So far so good…but if you’ve bad luck extensions comes partly down or becomes not available at all to your Configuration Manager instance! Unfortunately there is no way to force a trigger of the tenant discovery process and thus the installation of Microsoft Intune extensions. In normal circumstances it will take up to 24 hours after registering your Intune subscription untill the Intune extensions comes down to your Configuration Manager instance. This pitty if you would speed up the process of installing new deployments or you’re in a disaster recovery scenario. Hereby some guidelines for troubleshooting Microsoft Intune extensions, logs locations(s), Certificate Thumbprint ID, SQL query and validating the connectivity with Microsoft Intune.

Validating Connectivity With Windows Intune

1. Download PSTools, see http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx 2. Open an elevated admin CMD window 3. Change directory to the folder that contains PSexec (unless psexec is in a folder in your PATH already). Type the following line. (-i is for interactive, -s is to run as system) psexec -i -s cmd.exe hit ENTER 4. Another CMD opens after hitting “Enter” above. Verify you are now running as the system by typing whoami. The reply should be “nt authority\system” 5. Launch IExplore.exe and go to manage.microsoft.com. If the connection fails, the system account has been blocked. Hereby you can rule out Proxy/Firewall issue(s) here.

Extensions

The following table lists the log files that contain information related to Extensions and applies to Configuration Manager 2012 R2.

http://technet.microsoft.com/en-us/library/hh427342.aspx#BKMK_WITLog

AdminUI.ExtensionInstaller

To repair your local installed extensions you can use the following commando on your (site)system. This applies to (site)systems where you’ve installed a Configuration Manager admin console:

.\adminconsole\adminui.extensioninstaller.exe SiteServerName=<ServerName> /repair

Certificate Thumbprint ID

Make sure your Certificate or thumbprint ID for both the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\SMS_DMP_CONNECTOR and Machine certificate assigned under the Machine\My Certificate store match. If they do not match re-install the Windows Intune Connector site system role.

Query Extensions State

The following SQL query can be used to determine what the Microsoft Intune extension state is of your Configuration Manager instance:

select L.Name, F.FeatureID, F.StateID,S.FeatureStateName,F.Flag, F.Error from MDMCFDFeature F join CFDLocalizedMetaData L on F.FeatureID=L.FeatureID join CFDFeatureState S on F.StateID=S.FeatureStateID where L.LocaleID=1033

Don’t forget to change the LocaleID to the appropriate ID corresponding you local/region. You can skip this entry to list all extensions by all locales.

Notes from the field

By following the above steps we sorted out that this was not a local issue at Configuration Manager site. The Windows Intune Technical Support team confirmed this was an issue at the Windows Intune backend. Recently Microsoft released a fix on their production servers that fixed the issue and resulted in comming down the missing extensions in Configuration Manager instance. This increases the chance that you win the lottery instead of encounter such problems … at least that’s the theory ;-)

See also my previous blog A closer look at Windows Intune Extensions…what’s in it for me? how the mechanism of Microsoft Intune extensions aka Windows Intune extension works. Big thank to the Windows Intune Technical Support Team providing some insights troubleshooting Microsoft Intune extensions.