Event ID 306SCEP certificate profile received (CspExecute)

What to check

If the event is missing, the policy has not arrived: check assignment and last check-in. Any other result code points to the problem; next check the device to NDES communication.

Codes you'll see in this event

Find it with PowerShell

Run on the machine that logs it.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'; Id = 306 } -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" and EventID == 306
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Intune MDM events

• Event ID 75: Auto MDM Enroll: Succeeded
• Event ID 76: Auto MDM Enroll: Failed
• Event ID 400: MDM ConfigurationManager: Command failure status
• Event ID 401: MDM ConfigurationManager: CSP Node Operation
• Event ID 1506: WiFiConfigurationServiceProvider: Node set value
• Event ID 107: Auto-enrolment task triggered
• Event ID 102: Auto-enrolment task completed
• Event ID 7016: Auto-enrolment task did not start

Search all 123 event IDs →