Event ID 401MDM ConfigurationManager: CSP Node Operation

What to check

Turn on Show Analytic and Debug Logs in Event Viewer, then check the Result for the CSP URI you care about.

Find it with PowerShell

Run on the machine that logs it. Analytic and Debug logs are hidden and turned off by default: in Event Viewer choose View › Show Analytic and Debug Logs, then enable the log.

1
2Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug'; Id = 401 } -Oldest -MaxEvents 50 |
    Format-List TimeCreated, Id, Message

Hunt for it in Sentinel or Log Analytics

This works once a data collection rule sends the Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug log to your workspace, where it lands in the Event table.

1
2
3
4
5Event
| where TimeGenerated > ago(7d)
| where EventLog == "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Debug" and EventID == 401
| project TimeGenerated, Computer, Source, RenderedDescription
| order by TimeGenerated desc

Related Intune MDM events

• Event ID 75: Auto MDM Enroll: Succeeded
• Event ID 76: Auto MDM Enroll: Failed
• Event ID 306: SCEP certificate profile received (CspExecute)
• Event ID 400: MDM ConfigurationManager: Command failure status
• Event ID 1506: WiFiConfigurationServiceProvider: Node set value
• Event ID 107: Auto-enrolment task triggered
• Event ID 102: Auto-enrolment task completed
• Event ID 7016: Auto-enrolment task did not start

Search all 123 event IDs →