DMA Guard Fix for Intune Managed Devices

Overview

This guide covers how to resolve Error Code 55 on the MediaTek Wi-Fi 6 MT7921 Wireless LAN Card when the device is managed through Microsoft Intune. This issue is caused by the Kernel DMA Protection policy blocking the wireless card from initialising on startup.

This fix also applies to other wireless cards affected by DMA Guard policies.

Symptoms

• Wi-Fi adapter is not working or not appearing as connected.
• Device Manager shows the MediaTek Wi-Fi 6 MT7921 (or similar) with Error Code 55.
• The error message reads: “This device has been assigned one or more network resources that could not be satisfied.”
• The issue may return after a reboot or Intune policy sync, even after a manual fix.

Root Cause

The Kernel DMA Protection policy, deployed through Intune (typically under Endpoint Security or Device Configuration), is blocking the wireless card from being enumerated on startup. Code 55 indicates a security setting is preventing the device from loading.

When the policy setting “Enumeration policy for external devices incompatible with Kernel DMA Protection” is set to Block All, it prevents certain internal devices (like the MediaTek Wi-Fi card) from initialising.dsadsad

Resolution

Step 1: Confirm the Issue

Open Device Manager on the affected device and locate the Wi-Fi adapter. Check the device status and confirm it shows Error Code 55.

Step 2: Check the Registry Value

Open PowerShell as Administrator and run:

Get-ItemProperty -Path "HKLM:\Software\Policies\Microsoft\Windows\Kernel DMA Protection" -Name DeviceEnumerationPolicy

If the value is 0, the DMA Guard policy is actively blocking device enumeration.

Step 3: Identify the Intune Policy

In the Intune portal:

1. Go to Devices and find the affected device.
2. Check Device Configuration and look at Per-setting status.
3. Look for any policy containing DMA Guard or Kernel DMA Protection settings.
4. The setting to look for is “Enumeration policy for external devices incompatible with Kernel DMA Protection”, which will likely be set to Block All.

Step 4: Exclude the Device from the Policy

Rather than disabling the DMA Guard policy entirely (which would affect all devices), exclude only the affected device:

1. In Entra ID (Azure AD), go to Groups and create a new Security Group (e.g. “Exclude – DMA Guard Policy”).
2. Add the affected device as a member of the group.
3. Go back to the DMA Guard policy in Intune.
4. Under Assignments, add the new group under Excluded Groups.
5. Save the policy.

Using a group rather than a direct exclusion means you can easily add other affected devices in future without editing the policy each time.

Step 5: Apply the Registry Fix

Run the following PowerShell script as Administrator on the affected device:

$registryPath = "HKLM:\Software\Policies\Microsoft\Windows\Kernel DMA Protection"
$valueName = "DeviceEnumerationPolicy"
$valueType = "DWord"
$valueData = 2

if (-not (Test-Path $registryPath)) {
    New-Item -Path $registryPath -Force
}

Set-ItemProperty -Path $registryPath -Name $valueName -Value $valueData -Type $valueType

This sets the DeviceEnumerationPolicy to 2, which allows all devices to enumerate regardless of DMA compatibility.

Step 6: Reboot and Verify

Restart the device and confirm the Wi-Fi card is working correctly in Device Manager. Run the registry check from Step 2 again to confirm the value remains at 2.

Preventing Recurrence with Intune Proactive Remediations

If the issue keeps returning (for example, due to another policy conflict), you can deploy a Proactive Remediation in Intune to automatically detect and fix the problem.

Detection Script (Detect-DMAGuard.ps1)

Detection Script (Detect-DMAGuard.ps1)

$registryPath = "HKLM:\Software\Policies\Microsoft\Windows\Kernel DMA Protection"
$valueName = "DeviceEnumerationPolicy"

try {
    $value = Get-ItemProperty -Path $registryPath -Name $valueName -ErrorAction Stop
    if ($value.DeviceEnumerationPolicy -eq 2) {
        Write-Output "Compliant - Value is 2"
        exit 0
    } else {
        Write-Output "Non-compliant - Value is $($value.DeviceEnumerationPolicy)"
        exit 1
    }
} catch {
    Write-Output "Non-compliant - Key not found"
    exit 1
}

Remediation Script (Remediate-DMAGuard.ps1)

$registryPath = "HKLM:\Software\Policies\Microsoft\Windows\Kernel DMA Protection"
$valueName = "DeviceEnumerationPolicy"
$valueType = "DWord"
$valueData = 2

try {
    if (-not (Test-Path $registryPath)) {
        New-Item -Path $registryPath -Force
    }
    Set-ItemProperty -Path $registryPath -Name $valueName -Value $valueData -Type $valueType
    Write-Output "Remediated - Value set to 2"
    exit 0
} catch {
    Write-Output "Failed to remediate - $($_.Exception.Message)"
    exit 1
}