The Intune enrolment appears to be corrupted.

Question

The Intune enrolment appears to be corrupted.

Zayan zay 40

Hi Team,

For an unknown reason, one of our Windows devices has not synced with Intune for more than a month, although Microsoft Defender is still communicating.

I need to re-enrol the device. The laptop (AKSLTD098) is currently showing in Intune, Microsoft Entra ID, and Microsoft Defender. It is a Hybrid Microsoft Entra joined device.

What is the recommended approach to re-enrol the device without creating duplicate records while ensuring Microsoft Defender remains fully onboarded?

Any advice or best practices would be greatly appreciated.

Thanks

JUNIOR SIPILANYAMBE 115 Reputation points

2026-07-21T10:38:29.3133333+00:00

Since Defender is still communicating, it sounds like only the Intune MDM enrollment is affected. I'd recommend confirming the MDM enrollment status and attempting a clean re-enrollment rather than deleting the device outright. If done carefully, you can usually avoid duplicate device records while keeping Microsoft Defender onboarded. Hopefully someone from the Intune team can confirm the recommended process for hybrid-joined devices.

1 answer

Your answer

JUNIOR SIPILANYAMBE 115 Reputation points

2026-07-21T10:38:29.3133333+00:00

Since Defender is still communicating, it sounds like only the Intune MDM enrollment is affected. I'd recommend confirming the MDM enrollment status and attempting a clean re-enrollment rather than deleting the device outright. If done carefully, you can usually avoid duplicate device records while keeping Microsoft Defender onboarded. Hopefully someone from the Intune team can confirm the recommended process for hybrid-joined devices.

Answer 1

For a Hybrid Microsoft Entra joined Windows device, the supported re-registration path is to remove the current device registration locally and let the device register again, rather than manually creating a second enrollment. The documented steps are:

Open Command Prompt as administrator.
Run:
```
   dsregcmd.exe /debug /leave
```
Sign out and then sign back in to trigger the scheduled task that registers the device again with Microsoft Entra ID.

This is the documented re-register method for Microsoft Entra hybrid joined Windows 10/11 and Windows Server 2016/2019 devices.

To reduce the chance of duplicate records:

Do not manually add the device as a new separate object before completing the local re-registration.
If the device was only disabled in Microsoft Entra ID, an administrator can re-enable it instead of re-registering it.
If the device was deleted in Microsoft Entra ID, use the re-registration steps above.

Because Microsoft Defender is still communicating, that aligns with the documented Defender security settings management architecture: devices can continue management through Microsoft Defender for Endpoint, and a device registration exists in Microsoft Entra ID. If a device is not fully registered, Defender security settings management can use a synthetic device identity in Microsoft Entra ID, and when a full Microsoft Entra registration is later created, the synthetic registration is removed and management continues uninterrupted by using the full registration.

To verify Defender remains correctly managed after re-registration:

In the Microsoft Defender portal, check Device inventory.
Review the Managed by column or the device page.
It should show the device is managed by MDE.

If Intune enrollment still behaves as though the machine is already enrolled after re-registration, one documented Intune cause is stale enrollment state. In that case:

Open MMC.
Add the Certificates snap-in for Computer account > Local Computer.
Go to Certificates (Local computer) > Personal > Certificates.
Delete the Intune certificate issued by Sc_Online_Issuing, if present.
If present, delete the registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OnlineManagement
Try to re-enroll again.

Warning: deleting registry keys is risky. Back up the registry first and follow the documented steps carefully.

If the issue needs further validation before or after re-enrollment, an Intune administrator can run the Intune Windows enrollment diagnostic from Microsoft 365 admin center > Support > Help & support.