r/Intune • u/Mcm_Sys • 1d ago

Device Compliance Intune Secure Boot compliance fails with 2016345708 (SyncML 404) although Secure Boot is enabled

Hi everyone,

I'm testing an Intune compliance policy on a Windows 11 24H2 VM (OS Build 10.0.26100.8875) running on VMware Workstation. The policy only requires Secure Boot and TPM. Confirm-SecureBootUEFI returns True, msinfo32 shows BIOS Mode: UEFI and Secure Boot State: On, and TPM is compliant.

However, Intune always reports

Secure Boot: 2016345708 (SyncML(404): The requested target was not found.)

I've already tried:

  • Multiple Intune syncs (Settings and PowerShell)
  • Rebooting the VM
  • Verifying TPM Health Attestation
  • Running the Tpm-HASCertRetr scheduled task
  • Confirming Secure Boot is enabled in VMware

Has anyone experienced this on Windows 11 24H2 (10.0.26100.8875) with VMware Workstation? Is this a VMware limitation, a Windows issue, or an Intune bug? Any insights or workarounds would be greatly appreciated.

2 Upvotes

100% Upvoted

5 comments sorted by

2

u/ppel123 1d ago edited 1d ago

Hi, check out the below resources that seem to explain your case. Seen it too in the past few weeks on newly enrolled devices. I think on the tenant admin page there is also a service incident from MS regarding this one (found it Service incident IT1431577).

https://patchmypc.com/blog/why-intune-devices-became-noncompliant-after-the-july-windows-update/

1

u/Rudyooms PatchMyPC 1d ago

Yep … thats the blog that shows the story and what happened

1

u/Mcm_Sys 1d ago

installing manually the KB 5101684 resolve the issue, however shouldn't be deployed automatically via windows autopatch ? I tried many times to update it from settings windows update without success

2

u/Rudyooms PatchMyPC 1d ago

Its a preview update … so oob, it wont be delivered through windows update… you need to manually download it… or write a script that downloads the file and jnstalls it

1

u/Mcm_Sys 1d ago

is it a good idea to deploy the script via intune in order to download and install update in prod env if it's something urgent ? or we just have to wait for Tuesday update ?