Hi Sean,

This is about the Certificate Support for Mandatory Profiles​ setting that you configure through Group Policy, not about the Personal Certificates Windows Common Setting in the UEM Management Console.

Both log files indicate that that Group Policy setting is in effect:

[DEBUG]    Certificate support for mandatory profiles is enabled

[...]

[INFO ] Modifying profile state (certificate support)

Disabling the '\\server\share\general\Windows Settings\Personal Certificates.INI' file (as you did in the No Personal Cert case) is irrelevant for this.

Once you disable the Group Policy setting, you'll see the correct profile state in Windows.