← cd ~/events
// events/400 · Intune MDM
Event ID 400MDM ConfigurationManager: Command failure status
An MDM command for a CSP failed on the device. Microsoft documents it for RemoteWipe doWipe returning 'The request is not supported'.
| Log | Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin |
|---|---|
| Source | DeviceManagement-Enterprise-Diagnostics-Provider |
| Area | Intune MDM |
What to check
Read the Provider Name and CSP URI to see which CSP failed. For RemoteWipe, run reagentc /info: the CSP needs Windows RE to be enabled.
Find it with PowerShell
Run on the machine that logs it.
Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'; Id = 400 } -MaxEvents 50 |
Format-List TimeCreated, Id, MessageHunt for it in Sentinel or Log Analytics
This works once a data collection rule sends the Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin log to your workspace, where it lands in the Event table.
Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin" and EventID == 400
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated descRelated Intune MDM events
- Event ID 75: Auto MDM Enroll: Succeeded
- Event ID 76: Auto MDM Enroll: Failed
- Event ID 306: SCEP certificate profile received (CspExecute)
- Event ID 401: MDM ConfigurationManager: CSP Node Operation
- Event ID 1506: WiFiConfigurationServiceProvider: Node set value
- Event ID 107: Auto-enrolment task triggered
- Event ID 102: Auto-enrolment task completed
- Event ID 7016: Auto-enrolment task did not start