Troubleshooting Intune: RemoteWipe CSP Errors on Windows 10 Clients Explained

Table of Contents

RemoteWipe is a crucial feature within Microsoft Intune, enabling administrators to remotely erase all data from a lost, stolen, or decommissioned Windows 10 device. This capability is vital for maintaining data security and compliance within an organization. However, situations can arise where a RemoteWipe command fails to execute, leaving sensitive data vulnerable and device management in limbo. This article delves into a specific scenario where RemoteWipe fails on Windows 10 clients, generating an Event ID 400 error, and provides a comprehensive solution.

Understanding RemoteWipe in Intune¶

Microsoft Intune serves as a cloud-based unified endpoint management (UEM) solution that helps manage and secure devices across various platforms. Among its many features, RemoteWipe stands out as a critical security measure. It allows IT administrators to initiate a factory reset on a device, removing all user data, applications, and settings, effectively returning the device to its initial state. This action is indispensable in scenarios such as device loss, employee departure, or device repurposing, ensuring that corporate data does not fall into the wrong hands.

The RemoteWipe functionality relies on a Configuration Service Provider (CSP) within Windows. CSPs are interfaces that allow mobile device management (MDM) servers, like Intune, to configure settings on a Windows device. They define various configurable settings and the methods to manage them, providing a standardized way for MDM solutions to interact with the operating system. The RemoteWipe CSP specifically handles commands related to device wiping and resetting, making it a cornerstone for device security and lifecycle management.

Symptoms: Event ID 400 and “The Request Is Not Supported”¶

When an Intune RemoteWipe command fails to execute on a Windows 10 client, the device typically shows no indication of the wipe process beginning. Instead, an error message is logged in the device’s Event Viewer, specifically Event ID 400. This error is consistently found within the Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin event log, indicating an issue with enterprise device management. The specific error message associated with this event is “The request is not supported.”

This particular error message is highly indicative of a missing or disabled prerequisite that the RemoteWipe CSP requires to function correctly. While the MDM command reaches the device, the underlying operating system component necessary to fulfill the doWipe action is unavailable. Consequently, the device cannot process the command, leading to the failed wipe operation and potential security concerns. Understanding the details within the event log is crucial for pinpointing the exact cause of the failure.

The event log entry provides a wealth of information that can guide the troubleshooting process. Here’s a breakdown of the key elements found in a typical Event ID 400 log entry related to RemoteWipe failures:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider" Guid="{3DA494E4-0FE2-415C-B895-FB5265C5C83B}" />
  <EventID>400</EventID>
  <Version>0</Version>
  <Level>2</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8000000000000000</Keywords>
  <TimeCreated SystemTime="2017-06-29T13:18:40.644619600Z" />
  <EventRecordID>17327</EventRecordID>
  <Correlation />
  <Execution ProcessID="2560" ThreadID="8612" />
  <Channel>Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin</Channel>
  <Computer>DESKTOP PC</Computer>
  <Security UserID="S-1-5-18" />
  </System>
- <EventData>
  <Data Name="Message1">9B5DC01F-D64E-488A-BB24-F0E9DA4FBF47</Data>
  <Data Name="Message2">MDMFull</Data>
  <Data Name="Message3">RemoteWipe</Data>
  <Data Name="Message4">CmdType_Execute</Data>
  <Data Name="Message5">./Vendor/MSFT/RemoteWipe/doWipe</Data>
  <Data Name="HexInt1">0x80070032</Data>
  </EventData>
</Event>

From this XML data, the most critical pieces of information for troubleshooting are:

• Log Name: Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin – Confirms the issue is related to MDM operations.
• Event ID: 400 – The specific error identifier.
• Provider Name: DeviceManagement-Enterprise-Diagnostics-Provider – The component logging the error.
• CSP URI: ./Vendor/MSFT/RemoteWipe/doWipe – This specifies the exact CSP and command that was attempted. doWipe is the command to initiate the wipe.
• Result: The request is not supported. – This message, often accompanied by the hexadecimal error code 0x80070032, directly points to the operating system’s inability to execute the requested action. The error code 0x80070032 translates to ERROR_NOT_SUPPORTED.

Understanding these details allows administrators to quickly narrow down the potential causes and focus on the correct solution. The repetition of “The request is not supported” across different fields of the event data strongly emphasizes that a fundamental capability is missing on the client device.

The Root Cause: Disabled Windows Recovery Environment (Windows RE)¶

The primary reason for the “The request is not supported” error during a RemoteWipe operation on Windows 10 clients is a disabled or unavailable Windows Recovery Environment (Windows RE). Windows RE is a recovery platform based on Windows Preinstallation Environment (Windows PE) that provides a set of tools to help users diagnose and recover from various system issues. It’s the environment that allows a device to perform advanced startup options, system restores, and, critically, factory resets.

RemoteWipe functionality fundamentally relies on Windows RE to execute the device reset command. When Intune sends a doWipe command, the operating system attempts to invoke its built-in recovery capabilities to perform the factory reset. If Windows RE is disabled, missing, or improperly configured, the system lacks the necessary environment and tools to carry out the wipe. Consequently, the doWipe command cannot be supported, leading to the Event ID 400 error. Without Windows RE, the device cannot access the bootable environment required to erase the primary operating system partition and re-initialize the device.

Solution: Enabling Windows Recovery Environment¶

The solution to this issue involves verifying the status of Windows RE and enabling it if it’s found to be disabled. This ensures that the Windows 10 client has the necessary recovery tools in place for the RemoteWipe command to execute successfully.

Step 1: Check Windows RE Status¶

The first step is to determine the current state of Windows RE on the affected client device. This can be done using the reagentc.exe command-line utility, which manages the Windows RE image and recovery partition.

1. Open Command Prompt as Administrator: Search for “cmd” in the Start menu, right-click on “Command Prompt,” and select “Run as administrator.”
2. Execute the Reagentc /info command: Type the following command and press Enter:
   

   Reagentc /info
   

   
   This command will display information about the current Windows RE configuration, including its status, location, and the boot configuration data (BCD) identifier.

A healthy and enabled Windows RE configuration will show “Windows RE status: Enabled” in the output. For example:

Windows Recovery Environment (Windows RE) status:
    Windows RE status: Enabled
    Windows RE location: \\?\GLOBALROOT\device\harddisk0\partition4\Recovery\WindowsRE
    Boot Configuration Data (BCD) identifier: 12345678-abcd-ef01-2345-67890abcdef0
    Recovery image location:
    Recovery image index: 0
    Custom image location:
    Custom image index: 0

If the output shows “Windows RE status: Disabled,” then this is the cause of your RemoteWipe failures.

Step 2: Enable Windows RE¶

If Reagentc /info reports that Windows RE is disabled, you must enable it. This is typically a straightforward process, but it can encounter issues if the recovery image (Winre.wim) is missing or if there isn’t sufficient space on a recovery partition.

1. Open Command Prompt as Administrator: If not already open from the previous step, open an elevated Command Prompt.
2. Execute the Reagentc /enable command: Type the following command and press Enter:
   

   Reagentc /enable
   

   
   If successful, you will see a message indicating the operation completed successfully. After this, run Reagentc /info again to confirm that the status now shows “Enabled.”

Advanced Troubleshooting for Reagentc /enable Failures¶

In some cases, the Reagentc /enable command might fail. This usually happens if:

• The Windows RE image file (Winre.wim) is missing or corrupted: This file is crucial for Windows RE to function. It might be missing if it was accidentally deleted, if the system was improperly imaged, or if a Windows update failed.
• There is no dedicated recovery partition or insufficient free space: Windows RE typically resides on a separate recovery partition. If this partition doesn’t exist, is too small, or is full, Reagentc /enable may not be able to set up Windows RE.

If Reagentc /enable fails, you might need to perform additional steps:

• Locate or restore Winre.wim:
  • You can often find Winre.wim in C:\Windows\System32\Recovery. If it’s not there, you might need to extract it from your Windows installation media (install.wim or install.esd) using tools like DISM (Deployment Image Servicing and Management).
  • For example, to mount an installation image and copy Winre.wim:
    1. Mount your Windows ISO or connect to your installation media.
    2. Create a temporary mount folder: md C:\mount
    3. Find the index for your Windows edition in install.wim: Dism /Get-WimInfo /WimFile:D:\sources\install.wim (replace D: with your media drive).
    4. Mount the image: Dism /Mount-Wim /WimFile:D:\sources\install.wim /Index:1 /MountDir:C:\mount /ReadOnly
    5. Copy Winre.wim: copy C:\mount\Windows\System32\Recovery\Winre.wim C:\Windows\System32\Recovery
    6. Unmount the image: Dism /Unmount-Wim /MountDir:C:\mount /Discard
    7. Then attempt Reagentc /enable again.
• Create or extend a recovery partition: This is a more complex task that involves using disk management tools like diskpart. It requires advanced knowledge and caution, as incorrect partition management can lead to data loss. Generally, a recovery partition should be at least 300 MB, with at least 50 MB free after the Winre.wim is placed there. Often, Windows automatically manages this, but if the disk layout is custom or corrupted, manual intervention might be necessary.

Once Windows RE is successfully enabled and confirmed via Reagentc /info, the device should now be capable of processing the RemoteWipe command.

Step 3: Re-attempt RemoteWipe from Intune¶

After successfully enabling Windows RE on the client device, you can now re-issue the RemoteWipe command from your Intune console.

1. Navigate to Devices in Intune: Go to the Microsoft Intune admin center, then select Devices > All devices.
2. Select the Target Device: Find and select the Windows 10 client that previously failed the wipe.
3. Initiate RemoteWipe: In the device’s overview page, select Wipe or Retire (depending on your desired action and setup). Confirm the action.

The device should now respond to the RemoteWipe command as expected. Monitor the device and its event logs to confirm the successful initiation and completion of the wipe process. You should no longer see the Event ID 400 error related to “The request is not supported.”

Best Practices and Prevention¶

To prevent similar RemoteWipe failures in the future, consider implementing the following best practices for managing your Windows 10 clients:

• Standardized Imaging and Provisioning: Ensure that your Windows 10 deployment images and provisioning processes always include a properly configured and enabled Windows RE. This should be a standard part of your baseline image.
• Regular Audits: Periodically audit the Windows RE status on your managed devices, especially critical ones. This can be automated using PowerShell scripts or custom compliance policies in Intune to report on the Reagentc /info status.
• Monitor Disk Space: Ensure that your device’s disk partitions, particularly the recovery partition, have adequate free space. Low disk space can lead to issues with Windows RE updates or functionality.
• Intune Compliance Policies: Consider creating Intune compliance policies that check for the presence and enabled status of Windows RE. Devices found non-compliant could be flagged for remediation or prevented from accessing corporate resources until fixed.
• Educate IT Staff: Ensure that your IT support and device management teams are aware of the dependency between RemoteWipe and Windows RE, and are familiar with the reagentc command for quick diagnosis and remediation.

By understanding the critical role of Windows Recovery Environment in the RemoteWipe process and implementing proactive management strategies, organizations can significantly reduce the risk of failed device wipes, thereby enhancing data security and simplifying device lifecycle management. The “The request is not supported” error, while frustrating, ultimately points to a fundamental OS component that, once addressed, restores full functionality to a vital Intune feature.

Conclusion¶

The failure of an Intune RemoteWipe command, marked by Event ID 400 and the message “The request is not supported,” can be a critical security concern. This issue is almost invariably linked to a disabled Windows Recovery Environment (Windows RE) on the Windows 10 client. By systematically checking the Windows RE status using Reagentc /info and enabling it with Reagentc /enable, administrators can effectively resolve this problem and restore the device’s ability to perform a factory reset. Proactive management of Windows RE across your fleet, including standardized imaging and regular audits, is key to maintaining a robust and secure device management infrastructure. Ensuring that this core Windows component is always operational is paramount for effective endpoint security and compliance.

Have you encountered this specific RemoteWipe issue, or do you have other troubleshooting tips for Intune device actions? Share your experiences and insights in the comments below!