2016345612(Syncml(500) - Intune Compliance Policy Error

Craig Pennington 325 Reputation points
2023-09-05T13:23:04.57+00:00

We have had this recurring issue for a long time now, and despite searching the error all over the place, there seem to be a lot of other IT professionals in the same boat, but no obvious answers.

The error is on the Anti-Virus setting on the default compliance policy.

2016345612(Syncml(500): The recipient encountered an unexpected condition which prevented it from fulfilling the request)User's image

The compliance policy in question is assigned to all users.

This is a very annoying issue as it stops users from being able to access any MSFT apps as it marks the device as non compliant.

we are forced to add users to the exclusion list of the policy until the error clears on it's own days/weeks later.

If anyone has any ideas on what could be the cause or any possible fixes, it would be greatly appreciated

Microsoft Security | Intune | Compliance
Microsoft Security | Intune | Other

23 answers

Sort by: Newest
Most helpful Newest Oldest
  1. David Gorman 5 Reputation points
    2024-07-12T08:09:52.4833333+00:00

    Oh, this is still a problem. How frustrating.

    Maybe there should be a Grant Access check on Conditional Access policies to at least check if it's a company device, which would be comparable to hybrid join criteria.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. Aaron Murphy 40 Reputation points
    2024-05-09T17:39:03.67+00:00

    I have recently found that the following commands, in order, fix this issue fairly reliably (syncml issue on either Firewall or AV compliance)

    • Connect to MgGraph with Intune scopes

    Connect-MgGraph -scope DeviceManagementManagedDevices.PrivilegedOperations.All, DeviceManagementManagedDevices.ReadWrite.All,DeviceManagementManagedDevices.Read.All

    $device = Get-MgDeviceManagementManagedDevice -Filter "contains(deviceName,'<DEVICENAME>')"

    Sync-MgDeviceManagementManagedDevice -ManagedDeviceId $device.id

    • Trigger a compliance check via local process on PC (use remote shell or execute locally)

    Start-Process -FilePath "C:\Program Files (x86)\Microsoft Intune Management Extension\Microsoft.Management.Services.IntuneWindowsAgent.exe" -ArgumentList "intunemanagementextension://synccompliance"

    • Trigger a sync via local scheduled task on PC (use remote shell or execute locally)

    Get-ScheduledTask -TaskName “Schedule #3 created by enrollment client” | Start-ScheduledTask

    Was this answer helpful?

    10+ people found this answer helpful.
  3. Nick Eckermann 606 Reputation points
    2024-04-05T14:55:57.59+00:00

    Compliance delays on pre-provisioned devices have been an ongoing issue for us. My own view of what is happening at least for us. We have had multiple cased open going back to early 2023.

     

    Word on the street is updates are coming to Intune 2404 that will help alleviate some of the compliance delays on devices in error due to a transient state. I think the goal here was changes to the reporting of the transient state of the FW/AV components. Think SyncML500 errors. 

     

    Devices that are pre-provisioned and a delay occurs from user enrollments, think sitting for x days before enrollment, are impacted by the day 1 scheduled task not running every 3 minutes for 15 minutes / every 15min for 2 hours for syncing the device. These tasks are scheduled to run after enrollment but are created and started on the pre-provisioned day. When the user finishes the enrollment, they are not updated with the current date for the user enrollment so they don't seem to run any more to help get the device syncing and compliant like you would see on a user only enrollment. 

    \Microsoft\Windows\EnterpriseMgmt{enrollmentGUID}\Schedule #1 created by enrollment client

    \Microsoft\Windows\EnterpriseMgmt{enrollmentGUID}\Schedule #2 created by enrollment client

    https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot#policy-refresh-intervals

     

    We have noticed users that use Windows Hello for Business log into the device faster than the AV/FW services are fully working after a restart and the login scheduled task (\Microsoft\Windows\EnterpriseMgmt{enrollmentGUID}\Login Schedule created by enrollment client) to kick off a sync reports a transient syncml500 error for those components to Intune on the policy and since the devices have never been compliant, they do not follow the error state grace period and get marked non-compliant. Additional manual sync may be required to get out of this state. Since the scheduled day 1 tasks don't run it is a manual process. Or you may have to wait until the every 8 hour sync happens. \Microsoft\Windows\EnterpriseMgmt{enrollmentGUID}\Schedule #3 created by enrollment client

    https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows#device-security

    https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-monitor#device-behavior-with-a-compliance-setting-in-error-state

    Was this answer helpful?

    7 people found this answer helpful.
    0 comments
  4. Anthony Yeshan Isuru De Silva 5 Reputation points
    2024-04-05T04:24:06.85+00:00

    Hi Guys, i have had this issue for several users. fix is to turn off the windows firewall and turn it back again. then go to company portal click once on check access and wait 2-3mins until it completes. do not click again and again as it will then take more time. if its taking way too long turn off the conditional access policy that check for compliance. then once company portal check is ok you can turn on the conditional access.

    To verify further you can check azure ad portal devices and select the device you are checking on. check if its compliant. Then you can go to intune portal check if it shows compliant. it may be compliant on azure ad and not in intune. give it some time and then it will show compliant on intune as well.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  5. Tanner Wilkin 0 Reputation points
    2024-03-14T10:40:48.45+00:00

    We also have started to have this problem. Multiple restarts and checking status from Company Portal app does not help. Security app confirms all services are running with green checkmarks.

    Seems like a problem between Intune system and company portal app. I finally got this to work after 2 1/2 hours with a user. Had to do many restarts and status checking, but eventually the laptop became compliant.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.