Windows configuration profile verification failing after settings applied

[GrayW]

Fleet version: 4.78.3 // @GrayW 4.79.1 (Render Instance)

Operating system: Various Windows 11 Pro // @GrayW W11 Pro 25H2

---

💥  Actual behavior

When deploying a configuration profile to Windows, the validation in Fleet UI shows a failure with the error message 'The MDM protocol returned a success but the setting couldn't be verified by osquery.'

Example Profile 1

<Replace>
  <Item>
    <Meta>
      <Format xmlns="syncml:metinf">chr</Format>
    </Meta>
    <Target>
      <LocURI>./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/InteractiveLogon_MessageTextForUsersAttemptingToLogOn</LocURI>
    </Target>
    <Data><![CDATA[You are about to log in to a COMPANY corporate workstation. Please ensure that your use of the system complies with the corporate security and privacy guidance you have been given. Should you have questions, please contact SD team via SERVICE SD ticket. 
    In order to log in to your computer please follow the steps given below:
    Hit Sign-in options
    Select your authentication method (PIN/Fingerprint)
    Enter your COMPANY email address then enter your PIN/Fingerprint.]]></Data>
  </Item>
</Replace>

Example Profile 2

<Replace>
  <Item>
    <Target>
      <LocURI>./Device/Vendor/MSFT/Policy/Config/RemoteAssistance/UnsolicitedRemoteAssistance</LocURI>
    </Target>
    <Meta>
      <Format xmlns="syncml:metinf">chr</Format>
    </Meta>
    <Data>&lt;disabled/&gt;</Data>
  </Item>
</Replace>

Example Profile 3

<Replace>
  <Item>
    <Target>
      <LocURI>./Device/Vendor/MSFT/Policy/Config/RemoteAssistance/SolicitedRemoteAssistance</LocURI>
    </Target>
    <Meta>
      <Format xmlns="syncml:metinf">chr</Format>
    </Meta>
    <Data>&lt;disabled/&gt;</Data>
  </Item>
</Replace>

Example Profile 4

<Replace>
  <Item>
    <Meta>
      <Format xmlns="syncml:metinf">chr</Format>
    </Meta>
    <Target>
      <LocURI>./Device/Vendor/MSFT/Policy/Config/UserRights/BackupFilesAndDirectories</LocURI>
    </Target>
    <Data>BUILTIN\Administrators</Data>
  </Item>
</Replace>
<Replace>
  <Item>
    <Meta>
      <Format xmlns="syncml:metinf">chr</Format>
    </Meta>
    <Target>
      <LocURI>./Device/Vendor/MSFT/Policy/Config/UserRights/RestoreFilesAndDirectories</LocURI>
    </Target>
    <Data>BUILTIN\Administrators</Data>
  </Item>
</Replace>

🛠️ To fix

🧑‍💻  Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Apply the above configuration profiles to a Windows device

🕯️ More info (optional)

I was unable to reproduce the same behaviour for profile 1, with it not even applying the settings to my test machine during the first test, and then applying on a second attempt but showing as verifying. Both times with a clean Windows 11 Pro 25H2 VM.

Others showed mixed inconsistent behaviour with being stuck verifying or failed.

Possibly linked to: #29769

[MagnusHJensen]

@GrayW Just to verify you could reproduce the behaviour for this profile:

<Replace>
  <Item>
    <Target>
      <LocURI>./Device/Vendor/MSFT/Policy/Config/RemoteAssistance/SolicitedRemoteAssistance</LocURI>
    </Target>
    <Meta>
      <Format xmlns="syncml:metinf">chr</Format>
    </Meta>
    <Data>&lt;disabled/&gt;</Data>
  </Item>
</Replace>

And on which env did you reproduce? Dogfood or elsewhere, same version (4.79.1) ?

[Sampfluger88]

Linked to Unthread ticket:

Profiles failing on Windows via OSQuery #11649

[GrayW]

@MagnusHJensen

I'd just restored the VM to test something else, but deploying the following as a profile this morning on Windows 11 Pro 24H2 has verified. On 25H2, it was stuck as verifying. Perhaps unrelated.

<Replace>
  <Item>
    <Target>
      <LocURI>./Device/Vendor/MSFT/Policy/Config/RemoteAssistance/SolicitedRemoteAssistance</LocURI>
    </Target>
    <Meta>
      <Format xmlns="syncml:metinf">chr</Format>
    </Meta>
    <Data>&lt;disabled/&gt;</Data>
  </Item>
</Replace>

MDM PolicyManager: Set policy string, Policy: (SolicitedRemoteAssistance), Area: (RemoteAssistance), EnrollmentID requesting merge: (69F14CE8-7AA8-4813-B969-535A5E7F4767), Current User: (Device), String: (<disabled/>), Enrollment Type: (0x0), Scope: (0x0).

[MagnusHJensen]

As a follow up note, my VM is 24H2, so seems like first step is to get a Windows machine onto Win11 25H2, and then try again and look at the event logs.

[GrayW]

Upgraded to 25H2.

• Existing profile for solicited verified. Likely as the settings were already in place.
• Added profile for unsolicited, which has been sat verifying for at least 20 minutes.
• Registry key appears to exist alongside the verified one