-1

I'm an IT Support Engineer for a company with around 60,000 workstations on our domain. We use AD for most things, but have just begun migrating to VMware's Workspace One.

Recently, we've had a bunch of reports from users that when they manually lock their workstations, it instead logs them out. All apps they had opened close and they need to reopen and login to all of them all over again.

We've checked the GPO and see no issues there, even tried deleting the .pol file and running gpupdate /force but cmd returned an error of unable to update group policy. The bizarre part is that if the machine auto-locks instead of manually locks, it behaves as it should; users log back in and their apps are all still opened.

Anyone have any clue what's going on?

I have noticed that on all these workstations running dsregcmd /status returns that WorkplaceJoined:NO DefaultWamSet:Error (0x80070520) and no details for any connected work accounts despite settings saying they are connected. Not sure if that could be the problem and why it can't get a GP update or if its entirely unrelated.

Attempted fixes:

Deleting .pol and running GPupdate /force to have it recreate the gpo. Update failed in cmd with no error code.

Unenrolling/renrolling in Workspace One.

Proposed next step: Disconnecting work accounts from settings, clearing the tpm and reinitializing it, reconnecting work accounts and retrying gpupdate /force

AirlineITTech13
  • 1

1 Answers1

-1

We were having an issue a bit like this. Devices worked but some couldn't load company portal and dsregcmd /status had a WAM error.

What ended up working for us:

  1. Close all apps (or reboot and don't open anything)
  2. Open elevated prompt
  3. dsregcmd /cleanupaccounts
  4. dsregcmd /leave
  5. Delete all files inside %localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Settings
  6. Delete all files inside %localappdata%\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AC\TokenBroker\Accounts
  7. Reboot

After the reboot every client having WAM issues was able to re-enroll their device using the 'work and school accounts' section of settings.

Hope this helps. The article that has these steps can be found here.

WillProvideTechTips4Treats
  • 1
  • 1