MDM Essentials 1 - MDM Policy Refresh
During the trials and tribulations of configuring or removing settings managed by Intune, I sometimes find myself wondering why certain settings are still applying to a system, despite me pressing “sync” within Company Portal or through Access Work or School. Then I remember that I need to perform a much more significant sync.
The Device Check-In, or MDM Policy Refresh, performed by the Intune Management Extension on Windows 10/11 is not just a standard incremental sync:
“Starting with Windows 10, version 1903, the settings that are implemented by the Policy CSP are actually refreshed during the device check-in. Not just tattooed once, but actually re-applied when for example adjusted by the user. Also, similar to that, those settings are also removed when no longer assigned” (Windows 10 MDM policy refresh – All about Microsoft Endpoint Manager (petervanderwoude.nl)).
As a note to self, and perhaps others, here are the top takeaways for triggering the bigger sync - the MDM Policy Refresh.
It is triggered Automatically
This scheduled task (one of three) is responsible for the 8-hourly MDM Policy Refresh performed automatically:
“Schedule #3 created by the enrollment client” | After triggered, repeat every 8 hours indefinitely
… but if you are in a hurry, or testing your changes, you might like a manual option.
It can be triggered Manually locally
If you want to trigger it locally on a Windows 10/11 machine, open up PowerShell as an Administrator and run:
Get-ScheduledTask -TaskName "Schedule #3 created by enrollment client" | Start-ScheduledTask
You can run it as standard user but I don’t think it works.
It can be triggered Manually remotely
If you want to trigger it on a single Windows 10/11 machine remotely perform the Device Action “Sync” from the Intune / MEM console. This will also trigger a full MDM Policy Refresh.
Useful Resources
There is a load of great information on how the IME agent performs synchronisation tasks after initial enrolment.
Windows 10 MDM policy refresh – All about Microsoft Endpoint Manager (petervanderwoude.nl)
Forcing an MDM sync from a Windows 10 client – Out of Office Hours (oofhours.com)
Force Intune policy sync from a PowerShell script - MSEndpointMgr