Introduction

I have already created a post about Autopilot Troubleshooting nearly 2 years ago, but I wanted to update it and make it a little more structured and straight-forward.

What is Microsoft Intune Endpoint Management?

Essentially Microsoft Intune uses the capability of Windows Autopilot to enroll Windows 10 and 11 devices.

• On my blog you can find various Intune Endpoint Management blog posts

At a glance: Common issues and error codes

• Internet connectivity and firewall/proxy restrictions - first of all make sure the device has Internet connection and all the network endpoints are reachable
• Intune/Azure AD device restrictions - Platform or device count limits may be exceeded or a deployment profile or enrollment status page (ESP) may be configured incorrect or not assigned.
• Intune license make sure the user who sets up the device/signs-in in the out of the box experience (OOBE) has an appropriate Intune license assigned.
• Hardware: TPM version - Windows 11 requires TPM 2.0. Especially for self-deploying devices, this requires TPM attestation too and is never possible on a VM.
• Application installation issues - some Applications may not install during OOBE, usually the application needs some type of user input or too many applications are targeted to be installed during the ESP. I recommend a maximum of 5 applications for a smooth deployment.
• Hybrid - when attempting to use Hybrid Azure AD join, you will need an Intune connector to perform an offline domain join (ODJ), this offers a lot of potential issues.

Autopilot enrollment

Microsoft published a document about all Windows Autopilot deployment processes. (It is from 2019 but still has good value)

Troubleshooting in Intune portal/service

This section will give an overview of potential Intune/Azure AD portal settings that are misconfigured. You will always see a little description, likely (impacting) settings, a navigation or link where to find it and a sample image.

MDM & MAM scope

The MDM and MAM scope defines the set of users that are eligible to use Microsoft Intune for device management through Azure AD. Verify if the corresponding user is part of the MDM user scope selected group or switch it to all.

Devices>Enroll devices>Automatic Enrollment

Device join

It is key, that the setting Users may join the device to Azure AD is enabled for the Autopilot users. You may also check the Maximum number of devices per user if a non-Intune/device administrator sets up the device and joins it to AAD.

Azure AD>Devices

Enrollment device limit restrictions

There may be a device limit restriction applied to a non-Intune/device administrator.

Devices>Enroll devices>Enrollment device limit restrictions (at the side)

Enrollment device platform restrictions

Check the platform restriction and the blocked manufacturers.

Devices>Enroll devices>Enrollment device platform restrictions (at the side)

Deployment profile

Make sure the deployment profile is in the right Deployment method and has all settings configured as desired. (can mostly left to default). Make sure it is assigned to the right group, where your device hash or user is a member of.

Devices>Enroll devices>Deployment profile

Enrollment status page (ESP)

ESP can be completely skipped (Show app and profile configuration progress) or configured. Usually it is Block device use until required apps are installed if they are assigned to the user/device that makes problems during Autopilot, specify less than 5 apps. Make sure it is assigned to the right group, where your device hash or user is a member of.

Devices>Enroll devices>Enrollment status page

Monitor Autopilot deployments

In the Endpoint Manager admin center, naviagate to devices>Monitor.

Here you can find a (preview) report about Autopilot deployments and other useful monitoring subjects. For the enrollment, you can see the following information:

Troubleshooting on the device

How to open a command prompt in OOBE

Press Shift + (FN) F10 to open a cmd

Enter "powershell" in cmd to switch to a PowerShell session

These acronyms might be helpful to type into command prompt to open a Windows built-in system application:

• taskmgr - Task Manager
• explorer - File Explorer
• control - Control Panel
• devmgmt - Device Manager

Press Win + R and type "ms-settings:" to open the Windows Settings App

MDMDiagnostics

MDMDiagnostics is to dig deeper - please visit Michael Niehaus reference.

Troubleshooting in hybrid scenarios (Hybrid Azure AD Join)

I once made a complete blog post about Autopilot White Glove Hybrid AzureAD Join that explains the concept and process about it.

Additional component list

How it works

The Intune connector is responsible for doing the offline join most known as ODJ blob. This blob will be requested from the Intune cloud for a new device and generated through the Intune connector, uploaded back to the Intune cloud and the device will download the blob and (hopefully) apply it.

One more part is the connectivity check, which basically tries to communicate with the domain controller. This is usually the last step before rebooting and finishing the process. But imagine being offsite and have no connectivity with a domain controller, what is happening then? -Since some time, you can skip this step in the enrollment profile, which is also what I would do. This connectivity check is only useful, to guarantee that a user can later log on, after the enrollment, because the credentials will be checked against the domain controller, that obviously requires connection to the corporate network.

Event viewer

Check with event viewer on the server where Intune connector is installed, if there are any events during HAADJ. Therefore go to Applications and Services logs>ODJ Connector Service

Now create a filter to exclude events 30121 and 30150 to find the relevant ones faster. (on the left "Filter Current Log")

Now search for events 30130 and 30140 this two represent a successful ODJ request from Intune service.

Azure AD Connect sync

So if you are using HAADJ for your devices Intune will handle the enrollment into Intune and the domain join. But not the hybrid join to Azure and the subsequent issuance of a primary refresh token. (Learn more about this) For this we will need to wait for the next sync through AAD Connector to have the computer object in AAD too. There is a workaround for this:
Supercharge AAD Sync for new hybrid Azure AD joined Autopilot devices

Make sure the device is not domain joined before

It might sound logic, but definitely confirm that the device in HAADJ state is not domain joined through any component in the Windows image, task sequence or Windows Deployment Services (WDS). WDS can be deployed in standalone mode.

Other troubleshooting resources

• Microsoft Docs - Autopilot Troubleshooting overview
• Windows Autopilot - known issues
• Out of Office Hours - Troubleshooting reference

Find more on my blog:

Endpoint Management with Microsoft Intune

Ever wanted a full tutorial how to deal with Microsoft Autopilot Intune Technology? Well here it is!

OceanleafNiklas Tinner

Security

Fundamentals Microsoft security concepts V2Learn about Microsoft’s cloud security concepts to secure your organization with Microsoft 365 and Azure built-in products and features. The way to secure your digital assets such as identities, infrastructures, platforms, apps and data. These are the offic…

OceanleafNiklas Tinner

Defender Suite

Enterprise security solutions, cloud-based, intelligent and automated security responses for Endpoint, Identity, Office 365 and Cloud Apps. A full protection stack. Defender for EndpointHandle threat and vulnerability events on endpoints to prevent malicious and harmful contents. Microsoft Defender:…

OceanleafNiklas Tinner