Security Policy Errors

Fix Intune Error 0x87d1fde8 for Account Lockout Threshold OMA-URI

Natalie Taylor Oct 1, 2026 869 views

Question details

The user is attempting to configure the account lockout threshold in Microsoft Intune via a custom OMA-URI but encounters error code 0x87d1fde8.

Fix Intune Error 0x87d1fde8 for Account Lockout Threshold OMA-URI

Product: Microsoft Intune
Device & OS: Windows
Scenario: Deploying a custom DeviceLock/AccountLockoutPolicy OMA-URI profile to enforce security policies across managed organization devices.
Observed behavior: The policy deployment fails and returns error code -2016281112 (0x87d1fde8), indicating an invalid data type, unrecognized value format, or incorrect OMA-URI path.

Before you start

Ensure you have access to the Microsoft Intune admin center with appropriate endpoint security administrator permissions and keep the latest Windows Client MDM Policy CSP documentation open for reference.

Solution 1Recommended

Verify and Correct the OMA-URI Path and Data Type

Check the Microsoft Intune Policy CSP documentation to ensure the OMA-URI path and data type match the expected format exactly, adjusting from simple integers to formatted strings if required.

Error 0x87d1fde8 typically signifies that the OMA-URI path is incorrect or the provided data type does not match the Configuration Service Provider (CSP) requirements. While a value might logically be an integer (like 4 failed attempts), the specific CSP node may require a string formatted as an XML payload.

Access the Configuration Profile

Log in to the Microsoft Intune admin center, navigate to Devices, select Configuration profiles, and click on your custom OMA-URI profile to edit it.

Verify the OMA-URI Path

Ensure the path exactly matches the current Microsoft documentation (e.g., ./Device/Vendor/MSFT/Policy/Config/DeviceLock/DevicePasswordExpiration). Paths are case-sensitive.

Check Data Type and Value Formatting

If the documentation specifies 'String' for the data type rather than 'Integer', format the value as an XML string (for example, <data id="MaxDevicePasswordFailedAttempts" value="4"/>) rather than typing the number 4.

Test on a Pilot Device

Save the updated configuration profile and assign it to a small test group. Sync the test device and monitor the deployment status to confirm the 0x87d1fde8 error is resolved before applying it broadly.

Verify and Correct the OMA-URI Path and Data Type

Documentation Updates: Microsoft frequently updates CSP paths and requirements. Always refer to the official Windows Client MDM documentation for the most current DeviceLock CSP configurations to avoid deployment errors.

Free Microsoft Office alternative

Manage Your Organization's Documents Seamlessly with WPS Office

While troubleshooting endpoint management policies in Microsoft Intune, consider streamlining your software deployments with WPS Office. It is a lightweight, cost-effective alternative to Microsoft Office that offers excellent compatibility and easy deployment across enterprise devices.

1. Download the Enterprise Installer: Obtain the official WPS Office deployment package tailored for enterprise environments.
2. Deploy via Intune: Upload the installer to Microsoft Intune and configure silent installation parameters.
3. Assign and Use: Assign the app to your endpoint groups so users can immediately start working with familiar document formats.

Fully compatible with Microsoft Word, Excel, and PowerPoint formats.Lightweight installation footprint, making it ideal for mass endpoint deployment via Intune.Familiar user interface drastically reduces training time for employees.Cost-effective solution with robust PDF editing and sharing tools included.

microsoft office alternative - wps office

Frequently Asked Questions

What does Intune error code 0x87d1fde8 mean?

This error code usually translates to 'Remediation failed' or indicates a problem with the configuration payload. It is most commonly caused by an incorrect OMA-URI path, mismatched data types (such as passing an integer when a string is expected), or attempting to deploy a setting that is unsupported by the target device's OS version.

How do I format a string value for a custom OMA-URI if a simple number fails?

If the Policy CSP documentation requires a string data type for a numerical setting, it often expects a specific XML format based on the SyncML standard. For example, instead of entering '4', you may need to enter a string like '<data id="AccountLockoutThreshold" value="4"/>'. Always refer to the SyncML examples provided in the Microsoft documentation.

Why do the account lockout duration and reset counter policies also fail with the same error?

These policies belong to the same DeviceLock CSP configuration node. If you have fundamentally misunderstood the required data type (e.g., using Integer instead of String) or used an outdated OMA-URI syntax for the threshold, the same formatting mistakes will cause the duration and reset counter policies to fail with the same 0x87d1fde8 error.

Microsoft Office Security Issues