{"id":621,"date":"2026-02-13T20:16:51","date_gmt":"2026-02-13T20:16:51","guid":{"rendered":"https:\/\/cun.ie\/blog\/?p=621"},"modified":"2026-07-23T10:53:38","modified_gmt":"2026-07-23T10:53:38","slug":"dma-guard-fix-for-intune-managed-devices","status":"publish","type":"post","link":"https:\/\/cun.ie\/blog\/2026\/02\/13\/dma-guard-fix-for-intune-managed-devices\/","title":{"rendered":"DMA Guard Fix for Intune Managed Devices"},"content":{"rendered":"\n
\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t
\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t
\n

Overview<\/h2>\n\n\n\n

This guide covers how to resolve Error Code 55 on the MediaTek Wi-Fi 6 MT7921 Wireless LAN Card when the device is managed through Microsoft Intune. This issue is caused by the Kernel DMA Protection policy blocking the wireless card from initialising on startup.<\/p>\n\n\n\n

This fix also applies to other wireless cards affected by DMA Guard policies.<\/p>\n\n\n\n

Symptoms<\/h2>\n\n\n\n
    \n
  • Wi-Fi adapter is not working or not appearing as connected.<\/li>\n\n\n\n
  • Device Manager shows the MediaTek Wi-Fi 6 MT7921 (or similar) with Error Code 55.<\/li>\n\n\n\n
  • The error message reads: \"This device has been assigned one or more network resources that could not be satisfied.\"<\/li>\n\n\n\n
  • The issue may return after a reboot or Intune policy sync, even after a manual fix.<\/li>\n<\/ul>\n\n\n\n

    Root Cause<\/h2>\n\n\n\n

    The Kernel DMA Protection policy, deployed through Intune (typically under Endpoint Security or Device Configuration), is blocking the wireless card from being enumerated on startup. Code 55 indicates a security setting is preventing the device from loading.<\/p>\n\n\n\n

    When the policy setting \"Enumeration policy for external devices incompatible with Kernel DMA Protection\" is set to Block All, it prevents certain internal devices (like the MediaTek Wi-Fi card) from initialising.dsadsad<\/p>\n\n\n\n

    Resolution<\/h2>\n\n\n\n

    Step 1: Confirm the Issue<\/h3>\n\n\n\n

    Open Device Manager on the affected device and locate the Wi-Fi adapter. Check the device status and confirm it shows Error Code 55.<\/p>\n\n\n\n

    Step 2: Check the Registry Value<\/h3>\n\n\n\n

    Open PowerShell as Administrator and run:<\/p>\n\n\n\n

    Get-ItemProperty -Path "HKLM:\\Software\\Policies\\Microsoft\\Windows\\Kernel DMA Protection" -Name DeviceEnumerationPolicy<\/code><\/pre>\n\n\n\n
    If the value is 0, the DMA Guard policy is actively blocking device enumeration.<\/p>\n\n\n\n
    Step 3: Identify the Intune Policy<\/h3>\n\n\n\n
    In the Intune portal:<\/p>\n\n\n\n
      \n
    1. Go to Devices and find the affected device.<\/li>\n\n\n\n
    2. Check Device Configuration and look at Per-setting status.<\/li>\n\n\n\n
    3. Look for any policy containing DMA Guard or Kernel DMA Protection settings.<\/li>\n\n\n\n
    4. The setting to look for is \"Enumeration policy for external devices incompatible with Kernel DMA Protection\", which will likely be set to Block All.<\/li>\n<\/ol>\n\n\n\n
      Step 4: Exclude the Device from the Policy<\/h3>\n\n\n\n
      Rather than disabling the DMA Guard policy entirely (which would affect all devices), exclude only the affected device:<\/p>\n\n\n\n
        \n
      1. In Entra ID (Azure AD), go to Groups and create a new Security Group (e.g. \"Exclude - DMA Guard Policy\").<\/li>\n\n\n\n
      2. Add the affected device as a member of the group.<\/li>\n\n\n\n
      3. Go back to the DMA Guard policy in Intune.<\/li>\n\n\n\n
      4. Under Assignments, add the new group under Excluded Groups.<\/li>\n\n\n\n
      5. Save the policy.<\/li>\n<\/ol>\n\n\n\n
        Using a group rather than a direct exclusion means you can easily add other affected devices in future without editing the policy each time.<\/p>\n\n\n\n
        Step 5: Apply the Registry Fix<\/h3>\n\n\n\n
        Run the following PowerShell script as Administrator on the affected device:<\/p>\n\n\n\n
        $registryPath = "HKLM:\\Software\\Policies\\Microsoft\\Windows\\Kernel DMA Protection"\n$valueName = "DeviceEnumerationPolicy"\n$valueType = "DWord"\n$valueData = 2\n\nif (-not (Test-Path $registryPath)) {\n    New-Item -Path $registryPath -Force\n}\n\nSet-ItemProperty -Path $registryPath -Name $valueName -Value $valueData -Type $valueType<\/code><\/pre>\n\n\n\n
        This sets the DeviceEnumerationPolicy to 2, which allows all devices to enumerate regardless of DMA compatibility.<\/p>\n\n\n\n
        Step 6: Reboot and Verify<\/h3>\n\n\n\n
        Restart the device and confirm the Wi-Fi card is working correctly in Device Manager. Run the registry check from Step 2 again to confirm the value remains at 2.<\/p>\n\n\n\n
        Preventing Recurrence with Intune Proactive Remediations<\/h2>\n\n\n\n
        If the issue keeps returning (for example, due to another policy conflict), you can deploy a Proactive Remediation in Intune to automatically detect and fix the problem.<\/p>\n\n\n\n
        Detection Script (Detect-DMAGuard.ps1)<\/p>\n\n\n\n
        Detection Script (Detect-DMAGuard.ps1)<\/h3>\n\n\n\n
        $registryPath = "HKLM:\\Software\\Policies\\Microsoft\\Windows\\Kernel DMA Protection"\n$valueName = "DeviceEnumerationPolicy"\n\ntry {\n    $value = Get-ItemProperty -Path $registryPath -Name $valueName -ErrorAction Stop\n    if ($value.DeviceEnumerationPolicy -eq 2) {\n        Write-Output "Compliant - Value is 2"\n        exit 0\n    } else {\n        Write-Output "Non-compliant - Value is $($value.DeviceEnumerationPolicy)"\n        exit 1\n    }\n} catch {\n    Write-Output "Non-compliant - Key not found"\n    exit 1\n}<\/code><\/pre>\n\n\n\n
        Remediation Script (Remediate-DMAGuard.ps1)<\/p>\n\n\n\n
        $registryPath = "HKLM:\\Software\\Policies\\Microsoft\\Windows\\Kernel DMA Protection"\n$valueName = "DeviceEnumerationPolicy"\n$valueType = "DWord"\n$valueData = 2\n\ntry {\n    if (-not (Test-Path $registryPath)) {\n        New-Item -Path $registryPath -Force\n    }\n    Set-ItemProperty -Path $registryPath -Name $valueName -Value $valueData -Type $valueType\n    Write-Output "Remediated - Value set to 2"\n    exit 0\n} catch {\n    Write-Output "Failed to remediate - $($_.Exception.Message)"\n    exit 1\n}<\/code><\/pre>\n<\/div>\n\t\t\t<\/div>\n\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\n\t\t\t<\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"\n
        Overview<\/h2>\n\n\n\n
        This guide covers how to resolve Error Code 55 on the MediaTek Wi-Fi 6 MT7921 Wireless LAN Card when the device is managed through Microsoft Intune. This issue is caused by the Kernel DMA Protection policy blocking the wireless card from initialising on startup.<\/p>\n\n\n\n
        This fix also applies to other wireless cards affected by DMA Guard policies.<\/p>\n\n\n\n
        Symptoms<\/h2>\n\n\n\n
          \n
        • Wi-Fi adapter is not working or not appearing as connected.<\/li>\n\n\n\n
        • Device Manager shows the MediaTek Wi-Fi 6 MT7921 (or similar) with Error Code 55.<\/li>\n\n\n\n
        • The error message reads: \"This device has been assigned one or more network resources that could not be satisfied.\"<\/li>\n\n\n\n
        • The issue may return after a reboot or Intune policy sync, even after a manual fix.<\/li>\n<\/ul>\n\n\n\n
          Root Cause<\/h2>\n\n\n\n
          The Kernel DMA Protection policy, deployed through Intune (typically under Endpoint Security or Device Configuration), is blocking the wireless card from being enumerated on startup. Code 55 indicates a security setting is preventing the device from loading.<\/p>\n\n\n\n
          When the policy setting \"Enumeration policy for external devices incompatible with Kernel DMA Protection\" is set to Block All, it prevents certain internal devices (like the MediaTek Wi-Fi card) from initialising.dsadsad<\/p>\n\n\n\n
          Resolution<\/h2>\n\n\n\n
          Step 1: Confirm the Issue<\/h3>\n\n\n\n
          Open Device Manager on the affected device and locate the Wi-Fi adapter. Check the device status and confirm it shows Error Code 55.<\/p>\n\n\n\n
          Step 2: Check the Registry Value<\/h3>\n\n\n\n
          Open PowerShell as Administrator and run:<\/p>\n\n\n\n
          Get-ItemProperty -Path \"HKLM:\\Software\\Policies\\Microsoft\\Windows\\Kernel DMA Protection\" -Name DeviceEnumerationPolicy<\/code><\/pre>\n\n\n\n
          If the value is 0, the DMA Guard policy is actively blocking device enumeration.<\/p>\n\n\n\n
          Step 3: Identify the Intune Policy<\/h3>\n\n\n\n
          In the Intune portal:<\/p>\n\n\n\n
            \n
          1. Go to Devices and find the affected device.<\/li>\n\n\n\n
          2. Check Device Configuration and look at Per-setting status.<\/li>\n\n\n\n
          3. Look for any policy containing DMA Guard or Kernel DMA Protection settings.<\/li>\n\n\n\n
          4. The setting to look for is \"Enumeration policy for external devices incompatible with Kernel DMA Protection\", which will likely be set to Block All.<\/li>\n<\/ol>\n\n\n\n
            Step 4: Exclude the Device from the Policy<\/h3>\n\n\n\n
            Rather than disabling the DMA Guard policy entirely (which would affect all devices), exclude only the affected device:<\/p>\n\n\n\n
              \n
            1. In Entra ID (Azure AD), go to Groups and create a new Security Group (e.g. \"Exclude - DMA Guard Policy\").<\/li>\n\n\n\n
            2. Add the affected device as a member of the group.<\/li>\n\n\n\n
            3. Go back to the DMA Guard policy in Intune.<\/li>\n\n\n\n
            4. Under Assignments, add the new group under Excluded Groups.<\/li>\n\n\n\n
            5. Save the policy.<\/li>\n<\/ol>\n\n\n\n
              Using a group rather than a direct exclusion means you can easily add other affected devices in future without editing the policy each time.<\/p>\n\n\n\n
              Step 5: Apply the Registry Fix<\/h3>\n\n\n\n
              Run the following PowerShell script as Administrator on the affected device:<\/p>\n\n\n\n
              $registryPath = \"HKLM:\\Software\\Policies\\Microsoft\\Windows\\Kernel DMA Protection\"\n$valueName = \"DeviceEnumerationPolicy\"\n$valueType = \"DWord\"\n$valueData = 2\n\nif (-not (Test-Path $registryPath)) {\n    New-Item -Path $registryPath -Force\n}\n\nSet-ItemProperty -Path $registryPath -Name $valueName -Value $valueData -Type $valueType<\/code><\/pre>\n\n\n\n
              This sets the DeviceEnumerationPolicy to 2, which allows all devices to enumerate regardless of DMA compatibility.<\/p>\n\n\n\n
              Step 6: Reboot and Verify<\/h3>\n\n\n\n
              Restart the device and confirm the Wi-Fi card is working correctly in Device Manager. Run the registry check from Step 2 again to confirm the value remains at 2.<\/p>\n\n\n\n
              Preventing Recurrence with Intune Proactive Remediations<\/h2>\n\n\n\n
              If the issue keeps returning (for example, due to another policy conflict), you can deploy a Proactive Remediation in Intune to automatically detect and fix the problem.<\/p>\n\n\n\n
              Detection Script (Detect-DMAGuard.ps1)<\/p>\n\n\n\n
              Detection Script (Detect-DMAGuard.ps1)<\/h3>\n\n\n\n
              $registryPath = \"HKLM:\\Software\\Policies\\Microsoft\\Windows\\Kernel DMA Protection\"\n$valueName = \"DeviceEnumerationPolicy\"\n\ntry {\n    $value = Get-ItemProperty -Path $registryPath -Name $valueName -ErrorAction Stop\n    if ($value.DeviceEnumerationPolicy -eq 2) {\n        Write-Output \"Compliant - Value is 2\"\n        exit 0\n    } else {\n        Write-Output \"Non-compliant - Value is $($value.DeviceEnumerationPolicy)\"\n        exit 1\n    }\n} catch {\n    Write-Output \"Non-compliant - Key not found\"\n    exit 1\n}<\/code><\/pre>\n\n\n\n
              Remediation Script (Remediate-DMAGuard.ps1)<\/p>\n\n\n\n
              $registryPath = \"HKLM:\\Software\\Policies\\Microsoft\\Windows\\Kernel DMA Protection\"\n$valueName = \"DeviceEnumerationPolicy\"\n$valueType = \"DWord\"\n$valueData = 2\n\ntry {\n    if (-not (Test-Path $registryPath)) {\n        New-Item -Path $registryPath -Force\n    }\n    Set-ItemProperty -Path $registryPath -Name $valueName -Value $valueData -Type $valueType\n    Write-Output \"Remediated - Value set to 2\"\n    exit 0\n} catch {\n    Write-Output \"Failed to remediate - $($_.Exception.Message)\"\n    exit 1\n}<\/code><\/pre>\n","_et_gb_content_width":"","footnotes":""},"categories":[2],"tags":[],"class_list":["post-621","post","type-post","status-publish","format-standard","hentry","category-guides"],"_links":{"self":[{"href":"https:\/\/cun.ie\/blog\/wp-json\/wp\/v2\/posts\/621","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cun.ie\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cun.ie\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cun.ie\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cun.ie\/blog\/wp-json\/wp\/v2\/comments?post=621"}],"version-history":[{"count":2,"href":"https:\/\/cun.ie\/blog\/wp-json\/wp\/v2\/posts\/621\/revisions"}],"predecessor-version":[{"id":628,"href":"https:\/\/cun.ie\/blog\/wp-json\/wp\/v2\/posts\/621\/revisions\/628"}],"wp:attachment":[{"href":"https:\/\/cun.ie\/blog\/wp-json\/wp\/v2\/media?parent=621"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cun.ie\/blog\/wp-json\/wp\/v2\/categories?post=621"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cun.ie\/blog\/wp-json\/wp\/v2\/tags?post=621"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}