Troubleshoot Windows Devices That Won't Sync with Intune

Troubleshoot Windows Devices That Won’t Sync with Intune

An Intune device can show an old check-in, fail a manual sync, or check in without applying the policy you expected. These are different symptoms. Record the device’s last check-in time, the sync method, the policy or workload, the exact error, and the time of the latest attempt before changing client state.

Trigger one supported sync

From Company Portal, open Settings → Sync. You can also use Settings → Accounts → Access work or school → select the connected work account → Info → Sync, or request Sync for the device in the Intune admin center. A sync from Company Portal or Settings initiates MDM and Intune Management Extension check-in activity on supported enrolled Windows devices.

Wait for the request to complete and compare the device’s last check-in and device sync status in the admin center. A policy assignment showing “Succeeded” does not necessarily mean the specific setting is active; inspect the policy’s per-setting status and the device-side evidence.

Read the client evidence

On the device, review Event Viewer → Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider → Admin around the sync time. Use the event’s result code and policy URI to distinguish authentication, enrollment, network, and policy-processing failures.

For app or PowerShell workload issues, inspect the relevant Intune Management Extension logs, including IntuneManagementExtension.log and AppWorkload.log. Those logs are not a substitute for MDM event logs when the MDM sync itself did not start.

Check that the device can reach required Microsoft management endpoints through its current network, proxy, VPN, and TLS inspection path. Compare a working device in the same network and assignment scope before changing firewall rules.

Check whether a required service was disabled

For a documented Windows 10 failure where manual sync does not start and no MDM event is logged, Microsoft identifies the dmwappushservice service being disabled as a possible cause. Check its state before making changes:

Get-Service -Name dmwappushservice | Select-Object Name, Status, StartType

If this specific condition matches the device and its management configuration, follow Microsoft’s remediation to restore the service’s required startup configuration, then initiate one more sync and verify the check-in time.

Restart the management extension only when its check-in is stuck

If MDM check-in is working but the Intune Management Extension workload is not checking in, Microsoft documents restarting the IntuneManagementExtension service as a way to trigger an extension check-in:

Restart-Service -Name IntuneManagementExtension

Use this only after identifying an IME-specific symptom. It does not repair a disabled MDM service, a blocked enrollment, a conflicting assignment, or a tenant-side policy issue.

Avoid broad cache and enrollment resets

Do not delete the Intune program-data directory, remove all enrollment registry keys, disconnect the work account, run dsregcmd /leave, or re-enroll as generic sync fixes. Those actions can remove diagnostic evidence, break management, or disconnect organizational access. Use a documented, scenario-specific recovery procedure only after the logs identify that condition and an administrator has reviewed the impact.

Primary references: Microsoft’s Windows device sync instructions, Intune Management Extension check-in guidance, and Windows devices that can’t sync after enrollment.