Tattooing – An unusual bad omen
In Microsoft Intune, policy tattooing refers to when a configuration setting applied via a Configuration Service Provider (CSP) remains on a Windows device even after you remove or unassign the corresponding Intune policy. Each Windows CSP decides autonomously whether to “clean up” its settings upon policy removal; CSPs that don’t revert their changes leave those settings “tattooed” in the registry. Tattooing can cause significant headaches—for example, disabling the Microsoft Store with Intune, deleting that policy, and still seeing “…blocked by policy…” errors days later. In this post, we’ll define tattooing, show how to detect it, and outline detailed remediation and best-practice techniques to ensure your devices end up in the state you intend.
Table of Contents
What Causes Tattooing?
Configuration Service Provider Behavior
Intune uses Windows Configuration Service Providers (CSPs) to implement device settings. Some CSPs automatically remove their settings when a profile is unassigned, while others simply “tattoo” the registry and stop managing that key without ever clearing it.
MDM vs. GPO and Registry Persistence
Unlike traditional Group Policy, which can revert settings to “Not Configured,” MDM-delivered CSP settings often have no built-in “undo” flag. Once the registry key is written under paths like HKLM:\SOFTWARE\Policies\… or HKLM:\SOFTWARE\Microsoft\PolicyManager\current\…, it stays until explicitly changed.
Detecting Tattooed Settings
Event Log ID 819
When a non-tattooing CSP removes its settings, you’ll see Event ID 819 (“MDM PolicyManager: Delete policy…”) in the Windows Event Viewer under Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider. Absence of that event after unassignment often signals a tattooing issue.
Registry Inspection
You can confirm tattooing by examining the registry at the location that the policy changes a key or a value. If the value is the same as the deployed one, although you have removed the profile from Intune, a tattooing effect has happened.
Remediation Strategies
1. Redeploy a “Reverse” Policy
Create a new Intune configuration profile that explicitly sets the tattooed setting back to its default or desired state (e.g., enable the Store instead of turning it off) and assign it to the affected group.
2. Exempt and Re-Include Groups
Place devices in an exemption group (with no block policy), then deploy an “allow” policy, and finally move them back. This ensures the last policy the device processes is the enabling one.
3. Manual Registry Cleanup
On stubborn devices, delete the specific provider GUID under:
HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\<GUID>\…<br>
and clear the corresponding keys in \PolicyManager\current. Be cautious—improper registry edits can destabilize the device.
4. Use Intune Remediation Scripts
Leverage Intune’s Device Remediation feature to run a PowerShell script that removes or corrects tattooed registry values at scale.
5. Adopt Config Refresh
Microsoft’s Config Refresh feature promises to automatically remove previously applied policies, effectively wiping the slate clean and preventing tattooing from accumulating over time.
Best Practices to Avoid Tattooing Pitfalls
- Plan for Reversal: Before deploying a tattoo-prone setting (or in general any setting), note its default and prepare a “revert” profile to deploy when needed.
- Pilot First: Test policies on a small pilot group to catch tattooing behavior early.
- Document CSPs Used: Maintain an inventory of which CSPs your policies use—prioritize non-tattooing CSPs when possible.
- Monitor Logs and Registry: Regularly check Event ID 819 and key registry paths after policy changes.
- Stay Updated: Use the latest Windows versions where some CSPs no longer tattoo as aggressively.
Conclusion
Policy tattooing in Intune can turn simple configuration changes into long-running support nightmares. By understanding which CSPs tattoo settings, how to detect tattooed registry keys, and applying targeted remediation—whether via reverse policies, remediation scripts, manual cleanup, or Config Refresh—you can maintain predictable, clean device configurations and avoid getting stuck with stubborn settings that “just won’t go away.”
References and Documentation
- Configuration service providers for IT pros
- Configuration Service Provider
- Intro to Config Refresh – a refreshingly new MDM feature
Other interesting posts
