Event ID 10301Retrieve certificate warning

What to check

Check the diagnostic code in the event details (for example 0x00000403).

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft Intune Connector'; Id = 10301 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft Intune Connector log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft Intune Connector" and EventID == 10301
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Intune connector events

• Event ID 10010: Connector service started
• Event ID 10020: Connector service stopped
• Event ID 10100: Connector certificate renewed
• Event ID 10102: Connector certificate renewal failed
• Event ID 10302: Retrieve certificate error
• Event ID 20100: PKCS certificate issued
• Event ID 20102: PKCS certificate issue failed
• Event ID 20202: Certificate revocation failed

Search all 123 event IDs →