[{"data":1,"prerenderedAt":2344},["ShallowReactive",2],{"post:\u002F2026\u002F04\u002F08\u002Fintune-autopilot-provisioning-failures-and-how-to-actually-debug-them\u002F":3},{"post":4,"newer":2303,"older":2313,"related":2323,"series":2342},{"id":5,"title":6,"body":7,"canonical":2285,"categories":2286,"date":2288,"description":2289,"extension":2290,"featured":2291,"hero":2292,"image":2292,"meta":2293,"navigation":541,"path":2294,"readingTime":441,"seo":2295,"series":2292,"seriesOrder":2292,"sites":2296,"source":2292,"stem":2297,"tags":2298,"updated":2292,"url":2301,"__hash__":2302},"blog\u002Fblog\u002F2026\u002F04\u002F08\u002Fintune-autopilot-provisioning-failures-and-how-to-actually-debug-them.md","Intune: Autopilot Provisioning Failures and How to Actually Debug Them",{"type":8,"value":9,"toc":2277},"minimark",[10,14,19,22,164,180,187,252,256,275,282,298,309,318,325,374,383,390,1481,1487,1495,1502,1506,1526,1540,1547,1551,1554,1581,1584,1588,1599,2189,2196,2206,2209,2213,2273],[11,12,13],"p",{},"Autopilot is one of the better ideas Microsoft has shipped for endpoint management, and it's also one of the easiest things to make look unreliable by debugging it wrong. When a machine fails partway through the enrollment status page, the instinct on most help desks is to reimage it and try again. Sometimes that works, which is exactly the problem: it teaches everyone that Autopilot is flaky instead of teaching anyone what actually went wrong. I've found that treating a stuck Autopilot run as a diagnosable event, not a coin flip, is the difference between a five-minute fix and a recurring mystery.",[15,16,18],"h2",{"id":17},"read-the-error-code-before-you-touch-the-machine","Read the error code before you touch the machine",[11,20,21],{},"Most Autopilot failures surface a specific code, and almost nobody reads it before they wipe the device. When there is one, record it before you reset anything. The earlier version of this post got two of the most common ones wrong, so here they are as Microsoft documents them:",[23,24,25,41],"table",{},[26,27,28],"thead",{},[29,30,31,35,38],"tr",{},[32,33,34],"th",{},"Code",[32,36,37],{},"Where you see it",[32,39,40],{},"What Microsoft says it means",[42,43,44,63,84,97,113,125,138,151],"tbody",{},[29,45,46,53,60],{},[47,48,49],"td",{},[50,51,52],"code",{},"0x800705B4",[47,54,55,56],{},"Self-deploying or pre-provisioning, usually at ",[57,58,59],"strong",{},"Securing your hardware",[47,61,62],{},"A general timeout. The common cause in self-deploying mode is a device that isn't TPM 2.0 capable, such as a virtual machine. Those can't use self-deploying mode at all.",[29,64,65,70,73],{},[47,66,67],{},[50,68,69],{},"0x80180014",[47,71,72],{},"Re-running Autopilot on a device that was deployed before",[47,74,75,76,79,80,83],{},"Either the device was previously deployed with self-deploying or pre-provisioning mode and its Intune record has to be deleted (or the device unblocked under ",[57,77,78],{},"Windows Autopilot > Devices > Unblock device","), or ",[57,81,82],{},"Windows (MDM)"," enrollment is set to Block in a device platform restriction that applies to it.",[29,85,86,91,94],{},[47,87,88],{},[50,89,90],{},"0x801c03ea",[47,92,93],{},"Self-deploying",[47,95,96],{},"TPM attestation failed, so the Microsoft Entra join with a device token failed.",[29,98,99,104,107],{},[47,100,101],{},[50,102,103],{},"0x81039001",[47,105,106],{},"Self-deploying or pre-provisioning technician flow",[47,108,109,112],{},[50,110,111],{},"E_AUTOPILOT_CLIENT_TPM_MAX_ATTESTATION_RETRY_EXCEEDED",", intermittent; a retry may succeed.",[29,114,115,120,122],{},[47,116,117],{},[50,118,119],{},"0xc1036501",[47,121,93],{},[47,123,124],{},"Automatic MDM enrollment can't pick an MDM because there are multiple MDM configurations in Entra ID.",[29,126,127,132,135],{},[47,128,129],{},[50,130,131],{},"0x80070774",[47,133,134],{},"Hybrid join, during ESP",[47,136,137],{},"Domain mismatch between where the Intune Connector for Active Directory runs and where devices are targeted.",[29,139,140,145,148],{},[47,141,142],{},[50,143,144],{},"0x801C03F3",[47,146,147],{},"Pre-provisioning, in the User Device Registration admin log",[47,149,150],{},"Entra ID can't find the device object, usually because someone deleted it.",[29,152,153,158,161],{},[47,154,155],{},[50,156,157],{},"80180018",[47,159,160],{},"\"Something went wrong\" page",[47,162,163],{},"An Intune enrollment problem, typically a missing license or too many devices enrolled for the user.",[11,165,166,167,169,170,172,173,175,176,179],{},"My original text said ",[50,168,69],{}," meant a conflicting Entra ID object from an old enrollment, and that ",[50,171,52],{}," almost always meant waiting on an app scoped to the wrong group. Neither matches Microsoft's documentation. With ",[50,174,69],{}," in particular, the ETW trace shows ",[50,177,178],{},"Enrollment blocked for AP device by SDM One Time Limit Check",", which points you straight at the device record, not at Entra ID. None of these get fixed by reimaging alone. They get fixed by looking at the code and correcting the cause; a reset or redeployment may still be needed afterward, but only once the record or configuration is right.",[11,181,182,183,186],{},"The Autopilot event log (",[57,184,185],{},"Applications and Services Logs > Microsoft > Windows > ModernDeployment-Diagnostics-Provider > Autopilot",") adds the profile side of the story. The event IDs I look for first:",[188,189,190,201,214,227,236,246],"ul",{},[191,192,193,196,197,200],"li",{},[57,194,195],{},"807"," ",[50,198,199],{},"ZtdDeviceIsNotRegistered",": the hardware hash isn't uploaded or isn't assigned to a profile.",[191,202,203,206,207,196,210,213],{},[57,204,205],{},"809"," and ",[57,208,209],{},"815",[50,211,212],{},"ZtdDeviceHasNoAssignedProfile",": the assigned profile was deleted, or nothing is assigned and there's no default.",[191,215,216,196,219,222,223,226],{},[57,217,218],{},"908",[50,220,221],{},"SerialNumberMismatch"," \u002F ",[50,224,225],{},"ProductKeyIdMismatch",": the registration doesn't match the hardware; re-register.",[191,228,229,206,232,235],{},[57,230,231],{},"171",[57,233,234],{},"172",": TPM identity confirmation failed during self-deploying mode.",[191,237,238,241,242,245],{},[57,239,240],{},"153"," with ",[50,243,244],{},"ProfileState_Available",": a profile was downloaded, so the problem is later in the flow.",[191,247,248,251],{},[57,249,250],{},"163",": a profile is already on the device and won't be downloaded again until it's reset.",[15,253,255],{"id":254},"collect-the-evidence-properly","Collect the evidence properly",[11,257,258,259,262,263,266,267,270,271,274],{},"Intune already does part of this for you. When a Windows Autopilot deployment fails, the device can automatically capture and upload a diagnostics package, one set per day per device, kept for 28 days. It's on by default under ",[57,260,261],{},"Tenant administration > Device diagnostics"," and shows up on the device's ",[57,264,265],{},"Diagnostics"," tab. On Windows 11 user-driven deployments, turning on ",[57,268,269],{},"Turn on log collection and diagnostics page for end users"," in the ESP profile also gives the technician the Autopilot diagnostics page with ",[57,272,273],{},"Ctrl+Shift+D",".",[11,276,277,278,281],{},"On the device itself, ",[57,279,280],{},"Shift+F10"," at OOBE opens a command prompt, and this is the collection command Microsoft gives in the Autopilot known issues:",[283,284,289],"pre",{"className":285,"code":286,"language":287,"meta":288,"style":288},"language-cmd shiki shiki-themes github-dark","mdmdiagnosticstool.exe -area \"Autopilot;TPM\" -cab C:\\autopilot.cab\n","cmd","",[50,290,291],{"__ignoreMap":288},[292,293,296],"span",{"class":294,"line":295},"line",1,[292,297,286],{},[11,299,300,301,304,305,308],{},"For enrollment and provisioning problems more broadly, use the areas from the MDM log collection doc; the zip contains ",[50,302,303],{},"MDMDiagHtmlReport.html",", ",[50,306,307],{},"MDMDiagReport.xml",", a registry dump and the admin event logs:",[283,310,312],{"className":285,"code":311,"language":287,"meta":288,"style":288},"mdmdiagnosticstool.exe -area \"DeviceEnrollment;DeviceProvisioning;Autopilot\" -zip C:\\Users\\Public\\Documents\\MDMDiagReport.zip\n",[50,313,314],{"__ignoreMap":288},[292,315,316],{"class":294,"line":295},[292,317,311],{},[11,319,320,321,324],{},"To turn that into something readable, Michael Niehaus's ",[50,322,323],{},"Get-AutopilotDiagnostics"," script on the PowerShell Gallery parses the live device or a captured archive and lists the profile, ESP tracking, apps, policies and certificates with their status. The gallery page notes it doesn't work on ARM64:",[283,326,330],{"className":327,"code":328,"language":329,"meta":288,"style":288},"language-powershell shiki shiki-themes github-dark","Install-Script -Name Get-AutopilotDiagnostics -Force\nGet-AutopilotDiagnostics.ps1 -CABFile C:\\autopilot.cab\nGet-AutopilotDiagnostics.ps1 -Online\n","powershell",[50,331,332,353,364],{"__ignoreMap":288},[292,333,334,338,342,346,348,350],{"class":294,"line":295},[292,335,337],{"class":336},"sDLfK","Install-Script",[292,339,341],{"class":340},"snl16"," -",[292,343,345],{"class":344},"s95oV","Name ",[292,347,323],{"class":336},[292,349,341],{"class":340},[292,351,352],{"class":344},"Force\n",[292,354,356,359,361],{"class":294,"line":355},2,[292,357,358],{"class":336},"Get-AutopilotDiagnostics.ps1",[292,360,341],{"class":340},[292,362,363],{"class":344},"CABFile C:\\autopilot.cab\n",[292,365,367,369,371],{"class":294,"line":366},3,[292,368,358],{"class":336},[292,370,341],{"class":340},[292,372,373],{"class":344},"Online\n",[11,375,376,379,380,274],{},[50,377,378],{},"-Online"," looks up additional app and policy details from your tenant, which makes the output far easier to read on a real deployment. The Intune Management Extension logs, which cover Win32 apps and scripts, are in ",[50,381,382],{},"%ProgramData%\\Microsoft\\IntuneManagementExtension\\Logs",[11,384,385,386,389],{},"When I'm at the device and want a one-screen answer before digging through archives, I run this from the Shift+F10 prompt (",[50,387,388],{},"powershell.exe -ExecutionPolicy Bypass -File D:\\Get-AutopilotTriage.ps1",") or from an elevated session afterwards. It reads the Autopilot profile values Windows stored, pulls the known Autopilot event IDs plus recent errors from the MDM and device registration logs, checks the TPM, prints the device clock, and saves the diagnostics archive:",[283,391,393],{"className":327,"code":392,"language":329,"meta":288,"style":288},"\u003C#\n.SYNOPSIS\n    One-screen Autopilot triage on the affected device.\n.DESCRIPTION\n    Reads the Autopilot profile values from\n    HKLM:\\SOFTWARE\\Microsoft\\Provisioning\\Diagnostics\\Autopilot, lists the\n    documented Autopilot event IDs from the ModernDeployment-Diagnostics-Provider\n    log, the latest errors from the DeviceManagement-Enterprise-Diagnostics-Provider\n    and User Device Registration admin logs, TPM readiness and the device clock,\n    then runs mdmdiagnosticstool to capture an archive for deeper analysis.\n.PARAMETER OutputFolder\n    Folder for the diagnostics archive. Defaults to C:\\AutopilotTriage.\n.PARAMETER MaxEvents\n    Number of recent errors to show per log. Defaults to 5.\n.EXAMPLE\n    .\\Get-AutopilotTriage.ps1\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.0 (2026-04-08)\n    Requires: Elevated PowerShell on the affected device.\n#>\n\n[CmdletBinding()]\nparam (\n    [Parameter()]\n    [string]$OutputFolder = \"C:\\AutopilotTriage\",\n\n    [Parameter()]\n    [int]$MaxEvents = 5\n)\n\nNew-Item -Path $OutputFolder -ItemType Directory -Force | Out-Null\n\n# Profile values Windows received from the Autopilot deployment service.\nWrite-Host \"== Autopilot profile\" -ForegroundColor Cyan\n$profileKey = \"HKLM:\\SOFTWARE\\Microsoft\\Provisioning\\Diagnostics\\Autopilot\"\n$apProfile = Get-ItemProperty -Path $profileKey -ErrorAction SilentlyContinue\nif ($apProfile) {\n    $apProfile | Select-Object -Property CloudAssignedTenantDomain, CloudAssignedTenantId, IsAutopilotDisabled, TenantMatched, CloudAssignedOobeConfig | Format-List\n} else {\n    Write-Host \"No Autopilot profile values found. The device may not be registered, or the profile download failed.\"\n}\n\n# Documented Autopilot event IDs and what they mean.\n$known = @{\n    100 = \"Profile not found yet (usually transient)\"\n    153 = \"Profile state changed (ProfileState_Available = profile downloaded)\"\n    163 = \"Already provisioned; reset the device to download a new profile\"\n    171 = \"TPM identity confirmation failed (self-deploying)\"\n    172 = \"Could not mark profile available (see 171)\"\n    807 = \"ZtdDeviceIsNotRegistered: hash not uploaded or not assigned\"\n    809 = \"Assigned profile was deleted\"\n    815 = \"No profile assigned and no default profile\"\n    908 = \"Serial number or product key mismatch; re-register\"\n}\nWrite-Host \"== Autopilot events\" -ForegroundColor Cyan\n$apEvents = Get-WinEvent -LogName \"Microsoft-Windows-ModernDeployment-Diagnostics-Provider\u002FAutopilot\" -MaxEvents 200 -ErrorAction SilentlyContinue |\n    Where-Object { $known.ContainsKey($_.Id) }\n$apEvents | Select-Object -First 15 -Property TimeCreated, Id, @{ Name = \"Meaning\"; Expression = { $known[$_.Id] } } | Format-Table -AutoSize\n\n# Latest errors from the enrollment and registration logs.\n$logs = @(\n    \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\u002FAdmin\",\n    \"Microsoft-Windows-User Device Registration\u002FAdmin\"\n)\nforeach ($log in $logs) {\n    Write-Host \"== Errors: $log\" -ForegroundColor Cyan\n    $errors = Get-WinEvent -FilterHashtable @{ LogName = $log; Level = 2 } -MaxEvents $MaxEvents -ErrorAction SilentlyContinue\n    if ($errors) {\n        $errors | Select-Object -Property TimeCreated, Id, @{ Name = \"Message\"; Expression = { ($_.Message -split \"`r?`n\")[0] } } | Format-Table -AutoSize -Wrap\n    } else {\n        Write-Host \"No errors (or log not present).\"\n    }\n}\n\n# TPM readiness matters for self-deploying and pre-provisioning.\nWrite-Host \"== TPM\" -ForegroundColor Cyan\nGet-Tpm | Select-Object -Property TpmPresent, TpmReady, TpmEnabled, TpmActivated, TpmOwned | Format-List\n\n# A large clock offset breaks TPM attestation and can cause ESP timeouts.\nWrite-Host \"== Clock\" -ForegroundColor Cyan\nWrite-Host \"Device UTC time: $((Get-Date).ToUniversalTime().ToString('yyyy-MM-dd HH:mm:ss')). Compare with a known-good clock.\"\n\n# Archive for Get-AutopilotDiagnostics or a support case.\n$cab = Join-Path -Path $OutputFolder -ChildPath \"autopilot.cab\"\n& mdmdiagnosticstool.exe -area \"Autopilot;TPM\" -cab $cab | Out-Null\nWrite-Host \"Diagnostics archive: $cab\"\n",[50,394,395,401,408,413,421,427,433,439,445,451,457,468,474,484,490,498,504,512,518,524,530,536,543,555,564,575,596,601,610,626,632,637,665,670,676,690,701,722,731,773,785,794,800,805,811,825,836,847,858,869,880,891,902,913,924,929,941,976,991,1053,1058,1064,1077,1085,1091,1096,1111,1129,1172,1181,1262,1272,1281,1287,1292,1297,1303,1315,1355,1360,1366,1378,1407,1412,1418,1441,1467],{"__ignoreMap":288},[292,396,397],{"class":294,"line":295},[292,398,400],{"class":399},"sAwPA","\u003C#\n",[292,402,403,405],{"class":294,"line":355},[292,404,274],{"class":336},[292,406,407],{"class":340},"SYNOPSIS\n",[292,409,410],{"class":294,"line":366},[292,411,412],{"class":399},"    One-screen Autopilot triage on the affected device.\n",[292,414,416,418],{"class":294,"line":415},4,[292,417,274],{"class":336},[292,419,420],{"class":340},"DESCRIPTION\n",[292,422,424],{"class":294,"line":423},5,[292,425,426],{"class":399},"    Reads the Autopilot profile values from\n",[292,428,430],{"class":294,"line":429},6,[292,431,432],{"class":399},"    HKLM:\\SOFTWARE\\Microsoft\\Provisioning\\Diagnostics\\Autopilot, lists the\n",[292,434,436],{"class":294,"line":435},7,[292,437,438],{"class":399},"    documented Autopilot event IDs from the ModernDeployment-Diagnostics-Provider\n",[292,440,442],{"class":294,"line":441},8,[292,443,444],{"class":399},"    log, the latest errors from the DeviceManagement-Enterprise-Diagnostics-Provider\n",[292,446,448],{"class":294,"line":447},9,[292,449,450],{"class":399},"    and User Device Registration admin logs, TPM readiness and the device clock,\n",[292,452,454],{"class":294,"line":453},10,[292,455,456],{"class":399},"    then runs mdmdiagnosticstool to capture an archive for deeper analysis.\n",[292,458,460,462,465],{"class":294,"line":459},11,[292,461,274],{"class":336},[292,463,464],{"class":340},"PARAMETER",[292,466,467],{"class":340}," OutputFolder\n",[292,469,471],{"class":294,"line":470},12,[292,472,473],{"class":399},"    Folder for the diagnostics archive. Defaults to C:\\AutopilotTriage.\n",[292,475,477,479,481],{"class":294,"line":476},13,[292,478,274],{"class":336},[292,480,464],{"class":340},[292,482,483],{"class":340}," MaxEvents\n",[292,485,487],{"class":294,"line":486},14,[292,488,489],{"class":399},"    Number of recent errors to show per log. Defaults to 5.\n",[292,491,493,495],{"class":294,"line":492},15,[292,494,274],{"class":336},[292,496,497],{"class":340},"EXAMPLE\n",[292,499,501],{"class":294,"line":500},16,[292,502,503],{"class":399},"    .\\Get-AutopilotTriage.ps1\n",[292,505,507,509],{"class":294,"line":506},17,[292,508,274],{"class":336},[292,510,511],{"class":340},"NOTES\n",[292,513,515],{"class":294,"line":514},18,[292,516,517],{"class":399},"    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n",[292,519,521],{"class":294,"line":520},19,[292,522,523],{"class":399},"    Version : 1.0 (2026-04-08)\n",[292,525,527],{"class":294,"line":526},20,[292,528,529],{"class":399},"    Requires: Elevated PowerShell on the affected device.\n",[292,531,533],{"class":294,"line":532},21,[292,534,535],{"class":399},"#>\n",[292,537,539],{"class":294,"line":538},22,[292,540,542],{"emptyLinePlaceholder":541},true,"\n",[292,544,546,549,552],{"class":294,"line":545},23,[292,547,548],{"class":344},"[",[292,550,551],{"class":336},"CmdletBinding",[292,553,554],{"class":344},"()]\n",[292,556,558,561],{"class":294,"line":557},24,[292,559,560],{"class":340},"param",[292,562,563],{"class":344}," (\n",[292,565,567,570,573],{"class":294,"line":566},25,[292,568,569],{"class":344},"    [",[292,571,572],{"class":336},"Parameter",[292,574,554],{"class":344},[292,576,578,580,583,586,589,593],{"class":294,"line":577},26,[292,579,569],{"class":344},[292,581,582],{"class":340},"string",[292,584,585],{"class":344},"]$OutputFolder ",[292,587,588],{"class":340},"=",[292,590,592],{"class":591},"sU2Wk"," \"C:\\AutopilotTriage\"",[292,594,595],{"class":340},",\n",[292,597,599],{"class":294,"line":598},27,[292,600,542],{"emptyLinePlaceholder":541},[292,602,604,606,608],{"class":294,"line":603},28,[292,605,569],{"class":344},[292,607,572],{"class":336},[292,609,554],{"class":344},[292,611,613,615,618,621,623],{"class":294,"line":612},29,[292,614,569],{"class":344},[292,616,617],{"class":340},"int",[292,619,620],{"class":344},"]$MaxEvents ",[292,622,588],{"class":340},[292,624,625],{"class":336}," 5\n",[292,627,629],{"class":294,"line":628},30,[292,630,631],{"class":344},")\n",[292,633,635],{"class":294,"line":634},31,[292,636,542],{"emptyLinePlaceholder":541},[292,638,640,643,645,648,651,654,656,659,662],{"class":294,"line":639},32,[292,641,642],{"class":336},"New-Item",[292,644,341],{"class":340},[292,646,647],{"class":344},"Path $OutputFolder ",[292,649,650],{"class":340},"-",[292,652,653],{"class":344},"ItemType Directory ",[292,655,650],{"class":340},[292,657,658],{"class":344},"Force ",[292,660,661],{"class":340},"|",[292,663,664],{"class":336}," Out-Null\n",[292,666,668],{"class":294,"line":667},33,[292,669,542],{"emptyLinePlaceholder":541},[292,671,673],{"class":294,"line":672},34,[292,674,675],{"class":399},"# Profile values Windows received from the Autopilot deployment service.\n",[292,677,679,682,685,687],{"class":294,"line":678},35,[292,680,681],{"class":336},"Write-Host",[292,683,684],{"class":591}," \"== Autopilot profile\"",[292,686,341],{"class":340},[292,688,689],{"class":344},"ForegroundColor Cyan\n",[292,691,693,696,698],{"class":294,"line":692},36,[292,694,695],{"class":344},"$profileKey ",[292,697,588],{"class":340},[292,699,700],{"class":591}," \"HKLM:\\SOFTWARE\\Microsoft\\Provisioning\\Diagnostics\\Autopilot\"\n",[292,702,704,707,709,712,714,717,719],{"class":294,"line":703},37,[292,705,706],{"class":344},"$apProfile ",[292,708,588],{"class":340},[292,710,711],{"class":336}," Get-ItemProperty",[292,713,341],{"class":340},[292,715,716],{"class":344},"Path $profileKey ",[292,718,650],{"class":340},[292,720,721],{"class":344},"ErrorAction SilentlyContinue\n",[292,723,725,728],{"class":294,"line":724},38,[292,726,727],{"class":340},"if",[292,729,730],{"class":344}," ($apProfile) {\n",[292,732,734,737,739,742,744,747,750,753,755,758,760,763,765,768,770],{"class":294,"line":733},39,[292,735,736],{"class":344},"    $apProfile ",[292,738,661],{"class":340},[292,740,741],{"class":336}," Select-Object",[292,743,341],{"class":340},[292,745,746],{"class":344},"Property CloudAssignedTenantDomain",[292,748,749],{"class":340},",",[292,751,752],{"class":344}," CloudAssignedTenantId",[292,754,749],{"class":340},[292,756,757],{"class":344}," IsAutopilotDisabled",[292,759,749],{"class":340},[292,761,762],{"class":344}," TenantMatched",[292,764,749],{"class":340},[292,766,767],{"class":344}," CloudAssignedOobeConfig ",[292,769,661],{"class":340},[292,771,772],{"class":336}," Format-List\n",[292,774,776,779,782],{"class":294,"line":775},40,[292,777,778],{"class":344},"} ",[292,780,781],{"class":340},"else",[292,783,784],{"class":344}," {\n",[292,786,788,791],{"class":294,"line":787},41,[292,789,790],{"class":336},"    Write-Host",[292,792,793],{"class":591}," \"No Autopilot profile values found. The device may not be registered, or the profile download failed.\"\n",[292,795,797],{"class":294,"line":796},42,[292,798,799],{"class":344},"}\n",[292,801,803],{"class":294,"line":802},43,[292,804,542],{"emptyLinePlaceholder":541},[292,806,808],{"class":294,"line":807},44,[292,809,810],{"class":399},"# Documented Autopilot event IDs and what they mean.\n",[292,812,814,817,819,822],{"class":294,"line":813},45,[292,815,816],{"class":344},"$known ",[292,818,588],{"class":340},[292,820,821],{"class":340}," @",[292,823,824],{"class":344},"{\n",[292,826,828,831,833],{"class":294,"line":827},46,[292,829,830],{"class":344},"    100 ",[292,832,588],{"class":340},[292,834,835],{"class":591}," \"Profile not found yet (usually transient)\"\n",[292,837,839,842,844],{"class":294,"line":838},47,[292,840,841],{"class":344},"    153 ",[292,843,588],{"class":340},[292,845,846],{"class":591}," \"Profile state changed (ProfileState_Available = profile downloaded)\"\n",[292,848,850,853,855],{"class":294,"line":849},48,[292,851,852],{"class":344},"    163 ",[292,854,588],{"class":340},[292,856,857],{"class":591}," \"Already provisioned; reset the device to download a new profile\"\n",[292,859,861,864,866],{"class":294,"line":860},49,[292,862,863],{"class":344},"    171 ",[292,865,588],{"class":340},[292,867,868],{"class":591}," \"TPM identity confirmation failed (self-deploying)\"\n",[292,870,872,875,877],{"class":294,"line":871},50,[292,873,874],{"class":344},"    172 ",[292,876,588],{"class":340},[292,878,879],{"class":591}," \"Could not mark profile available (see 171)\"\n",[292,881,883,886,888],{"class":294,"line":882},51,[292,884,885],{"class":344},"    807 ",[292,887,588],{"class":340},[292,889,890],{"class":591}," \"ZtdDeviceIsNotRegistered: hash not uploaded or not assigned\"\n",[292,892,894,897,899],{"class":294,"line":893},52,[292,895,896],{"class":344},"    809 ",[292,898,588],{"class":340},[292,900,901],{"class":591}," \"Assigned profile was deleted\"\n",[292,903,905,908,910],{"class":294,"line":904},53,[292,906,907],{"class":344},"    815 ",[292,909,588],{"class":340},[292,911,912],{"class":591}," \"No profile assigned and no default profile\"\n",[292,914,916,919,921],{"class":294,"line":915},54,[292,917,918],{"class":344},"    908 ",[292,920,588],{"class":340},[292,922,923],{"class":591}," \"Serial number or product key mismatch; re-register\"\n",[292,925,927],{"class":294,"line":926},55,[292,928,799],{"class":344},[292,930,932,934,937,939],{"class":294,"line":931},56,[292,933,681],{"class":336},[292,935,936],{"class":591}," \"== Autopilot events\"",[292,938,341],{"class":340},[292,940,689],{"class":344},[292,942,944,947,949,952,954,957,960,962,965,968,970,973],{"class":294,"line":943},57,[292,945,946],{"class":344},"$apEvents ",[292,948,588],{"class":340},[292,950,951],{"class":336}," Get-WinEvent",[292,953,341],{"class":340},[292,955,956],{"class":344},"LogName ",[292,958,959],{"class":591},"\"Microsoft-Windows-ModernDeployment-Diagnostics-Provider\u002FAutopilot\"",[292,961,341],{"class":340},[292,963,964],{"class":344},"MaxEvents ",[292,966,967],{"class":336},"200",[292,969,341],{"class":340},[292,971,972],{"class":344},"ErrorAction SilentlyContinue ",[292,974,975],{"class":340},"|\n",[292,977,979,982,985,988],{"class":294,"line":978},58,[292,980,981],{"class":336},"    Where-Object",[292,983,984],{"class":344}," { $known.ContainsKey(",[292,986,987],{"class":336},"$_",[292,989,990],{"class":344},".Id) }\n",[292,992,994,996,998,1000,1002,1005,1008,1010,1013,1015,1018,1020,1022,1025,1027,1030,1033,1035,1038,1040,1043,1045,1048,1050],{"class":294,"line":993},59,[292,995,946],{"class":344},[292,997,661],{"class":340},[292,999,741],{"class":336},[292,1001,341],{"class":340},[292,1003,1004],{"class":344},"First ",[292,1006,1007],{"class":336},"15",[292,1009,341],{"class":340},[292,1011,1012],{"class":344},"Property TimeCreated",[292,1014,749],{"class":340},[292,1016,1017],{"class":344}," Id",[292,1019,749],{"class":340},[292,1021,821],{"class":340},[292,1023,1024],{"class":344},"{ Name ",[292,1026,588],{"class":340},[292,1028,1029],{"class":591}," \"Meaning\"",[292,1031,1032],{"class":344},"; Expression ",[292,1034,588],{"class":340},[292,1036,1037],{"class":344}," { $known[",[292,1039,987],{"class":336},[292,1041,1042],{"class":344},".Id] } } ",[292,1044,661],{"class":340},[292,1046,1047],{"class":336}," Format-Table",[292,1049,341],{"class":340},[292,1051,1052],{"class":344},"AutoSize\n",[292,1054,1056],{"class":294,"line":1055},60,[292,1057,542],{"emptyLinePlaceholder":541},[292,1059,1061],{"class":294,"line":1060},61,[292,1062,1063],{"class":399},"# Latest errors from the enrollment and registration logs.\n",[292,1065,1067,1070,1072,1074],{"class":294,"line":1066},62,[292,1068,1069],{"class":344},"$logs ",[292,1071,588],{"class":340},[292,1073,821],{"class":340},[292,1075,1076],{"class":344},"(\n",[292,1078,1080,1083],{"class":294,"line":1079},63,[292,1081,1082],{"class":591},"    \"Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider\u002FAdmin\"",[292,1084,595],{"class":340},[292,1086,1088],{"class":294,"line":1087},64,[292,1089,1090],{"class":591},"    \"Microsoft-Windows-User Device Registration\u002FAdmin\"\n",[292,1092,1094],{"class":294,"line":1093},65,[292,1095,631],{"class":344},[292,1097,1099,1102,1105,1108],{"class":294,"line":1098},66,[292,1100,1101],{"class":340},"foreach",[292,1103,1104],{"class":344}," ($log ",[292,1106,1107],{"class":340},"in",[292,1109,1110],{"class":344}," $logs) {\n",[292,1112,1114,1116,1119,1122,1125,1127],{"class":294,"line":1113},67,[292,1115,790],{"class":336},[292,1117,1118],{"class":591}," \"== Errors: ",[292,1120,1121],{"class":344},"$log",[292,1123,1124],{"class":591},"\"",[292,1126,341],{"class":340},[292,1128,689],{"class":344},[292,1130,1132,1135,1137,1139,1141,1144,1147,1150,1152,1155,1157,1160,1163,1165,1168,1170],{"class":294,"line":1131},68,[292,1133,1134],{"class":344},"    $errors ",[292,1136,588],{"class":340},[292,1138,951],{"class":336},[292,1140,341],{"class":340},[292,1142,1143],{"class":344},"FilterHashtable ",[292,1145,1146],{"class":340},"@",[292,1148,1149],{"class":344},"{ LogName ",[292,1151,588],{"class":340},[292,1153,1154],{"class":344}," $log; Level ",[292,1156,588],{"class":340},[292,1158,1159],{"class":336}," 2",[292,1161,1162],{"class":344}," } ",[292,1164,650],{"class":340},[292,1166,1167],{"class":344},"MaxEvents $MaxEvents ",[292,1169,650],{"class":340},[292,1171,721],{"class":344},[292,1173,1175,1178],{"class":294,"line":1174},69,[292,1176,1177],{"class":340},"    if",[292,1179,1180],{"class":344}," ($errors) {\n",[292,1182,1184,1187,1189,1191,1193,1195,1197,1199,1201,1203,1205,1207,1210,1212,1214,1217,1219,1222,1225,1228,1231,1234,1237,1239,1242,1245,1248,1250,1252,1254,1257,1259],{"class":294,"line":1183},70,[292,1185,1186],{"class":344},"        $errors ",[292,1188,661],{"class":340},[292,1190,741],{"class":336},[292,1192,341],{"class":340},[292,1194,1012],{"class":344},[292,1196,749],{"class":340},[292,1198,1017],{"class":344},[292,1200,749],{"class":340},[292,1202,821],{"class":340},[292,1204,1024],{"class":344},[292,1206,588],{"class":340},[292,1208,1209],{"class":591}," \"Message\"",[292,1211,1032],{"class":344},[292,1213,588],{"class":340},[292,1215,1216],{"class":344}," { (",[292,1218,987],{"class":336},[292,1220,1221],{"class":344},".Message ",[292,1223,1224],{"class":340},"-split",[292,1226,1227],{"class":591}," \"",[292,1229,1230],{"class":336},"`r",[292,1232,1233],{"class":591},"?",[292,1235,1236],{"class":336},"`n",[292,1238,1124],{"class":591},[292,1240,1241],{"class":344},")[",[292,1243,1244],{"class":336},"0",[292,1246,1247],{"class":344},"] } } ",[292,1249,661],{"class":340},[292,1251,1047],{"class":336},[292,1253,341],{"class":340},[292,1255,1256],{"class":344},"AutoSize ",[292,1258,650],{"class":340},[292,1260,1261],{"class":344},"Wrap\n",[292,1263,1265,1268,1270],{"class":294,"line":1264},71,[292,1266,1267],{"class":344},"    } ",[292,1269,781],{"class":340},[292,1271,784],{"class":344},[292,1273,1275,1278],{"class":294,"line":1274},72,[292,1276,1277],{"class":336},"        Write-Host",[292,1279,1280],{"class":591}," \"No errors (or log not present).\"\n",[292,1282,1284],{"class":294,"line":1283},73,[292,1285,1286],{"class":344},"    }\n",[292,1288,1290],{"class":294,"line":1289},74,[292,1291,799],{"class":344},[292,1293,1295],{"class":294,"line":1294},75,[292,1296,542],{"emptyLinePlaceholder":541},[292,1298,1300],{"class":294,"line":1299},76,[292,1301,1302],{"class":399},"# TPM readiness matters for self-deploying and pre-provisioning.\n",[292,1304,1306,1308,1311,1313],{"class":294,"line":1305},77,[292,1307,681],{"class":336},[292,1309,1310],{"class":591}," \"== TPM\"",[292,1312,341],{"class":340},[292,1314,689],{"class":344},[292,1316,1318,1321,1324,1326,1328,1331,1333,1336,1338,1341,1343,1346,1348,1351,1353],{"class":294,"line":1317},78,[292,1319,1320],{"class":336},"Get-Tpm",[292,1322,1323],{"class":340}," |",[292,1325,741],{"class":336},[292,1327,341],{"class":340},[292,1329,1330],{"class":344},"Property TpmPresent",[292,1332,749],{"class":340},[292,1334,1335],{"class":344}," TpmReady",[292,1337,749],{"class":340},[292,1339,1340],{"class":344}," TpmEnabled",[292,1342,749],{"class":340},[292,1344,1345],{"class":344}," TpmActivated",[292,1347,749],{"class":340},[292,1349,1350],{"class":344}," TpmOwned ",[292,1352,661],{"class":340},[292,1354,772],{"class":336},[292,1356,1358],{"class":294,"line":1357},79,[292,1359,542],{"emptyLinePlaceholder":541},[292,1361,1363],{"class":294,"line":1362},80,[292,1364,1365],{"class":399},"# A large clock offset breaks TPM attestation and can cause ESP timeouts.\n",[292,1367,1369,1371,1374,1376],{"class":294,"line":1368},81,[292,1370,681],{"class":336},[292,1372,1373],{"class":591}," \"== Clock\"",[292,1375,341],{"class":340},[292,1377,689],{"class":344},[292,1379,1381,1383,1386,1389,1392,1395,1398,1401,1404],{"class":294,"line":1380},82,[292,1382,681],{"class":336},[292,1384,1385],{"class":591}," \"Device UTC time: ",[292,1387,1388],{"class":340},"$",[292,1390,1391],{"class":591},"((",[292,1393,1394],{"class":336},"Get-Date",[292,1396,1397],{"class":591},").ToUniversalTime().ToString(",[292,1399,1400],{"class":591},"'yyyy-MM-dd HH:mm:ss'",[292,1402,1403],{"class":591},"))",[292,1405,1406],{"class":591},". Compare with a known-good clock.\"\n",[292,1408,1410],{"class":294,"line":1409},83,[292,1411,542],{"emptyLinePlaceholder":541},[292,1413,1415],{"class":294,"line":1414},84,[292,1416,1417],{"class":399},"# Archive for Get-AutopilotDiagnostics or a support case.\n",[292,1419,1421,1424,1426,1429,1431,1433,1435,1438],{"class":294,"line":1420},85,[292,1422,1423],{"class":344},"$cab ",[292,1425,588],{"class":340},[292,1427,1428],{"class":336}," Join-Path",[292,1430,341],{"class":340},[292,1432,647],{"class":344},[292,1434,650],{"class":340},[292,1436,1437],{"class":344},"ChildPath ",[292,1439,1440],{"class":591},"\"autopilot.cab\"\n",[292,1442,1444,1447,1450,1452,1455,1458,1460,1463,1465],{"class":294,"line":1443},86,[292,1445,1446],{"class":340},"&",[292,1448,1449],{"class":336}," mdmdiagnosticstool.exe",[292,1451,341],{"class":340},[292,1453,1454],{"class":344},"area ",[292,1456,1457],{"class":591},"\"Autopilot;TPM\"",[292,1459,341],{"class":340},[292,1461,1462],{"class":344},"cab $cab ",[292,1464,661],{"class":340},[292,1466,664],{"class":336},[292,1468,1470,1472,1475,1478],{"class":294,"line":1469},87,[292,1471,681],{"class":336},[292,1473,1474],{"class":591}," \"Diagnostics archive: ",[292,1476,1477],{"class":344},"$cab",[292,1479,1480],{"class":591},"\"\n",[11,1482,1483,1484,1486],{},"Trimmed output from a device that failed at ",[57,1485,59],{},":",[283,1488,1493],{"className":1489,"code":1491,"language":1492,"meta":288},[1490],"language-text","== Autopilot profile\nCloudAssignedTenantDomain : contoso.onmicrosoft.com\nIsAutopilotDisabled       : 0\nTenantMatched             : 1\n\n== Autopilot events\nTimeCreated          Id Meaning\n-----------          -- -------\n4\u002F8\u002F2026 9:14:02 AM 171 TPM identity confirmation failed (self-deploying)\n4\u002F8\u002F2026 9:11:40 AM 153 Profile state changed (ProfileState_Available = profile downloaded)\n\n== TPM\nTpmPresent : True\nTpmReady   : False\n","text",[50,1494,1491],{"__ignoreMap":288},[11,1496,1497,1498,1501],{},"If the device clock is off by more than a few minutes, Microsoft's documented fix is to go back to the start of OOBE, connect to the network, and run ",[50,1499,1500],{},"w32tm \u002Fresync \u002Fforce"," before trying again.",[15,1503,1505],{"id":1504},"the-enrollment-status-page-tells-you-less-than-you-think","The enrollment status page tells you less than you think",[11,1507,1508,1509,1512,1513,1516,1517,1520,1521,1525],{},"The ESP tracks three phases: ",[57,1510,1511],{},"Device preparation"," (securing the hardware with TPM attestation, joining Entra ID, enrolling in MDM), ",[57,1514,1515],{},"Device setup"," (device-targeted items), and ",[57,1518,1519],{},"Account setup"," (user-targeted items). The phase it's visually stuck on is not always where the real problem is, partly because of what it ",[1522,1523,1524],"em",{},"doesn't"," track. Per Microsoft's ESP documentation:",[188,1527,1528,1531,1534,1537],{},[191,1529,1530],{},"Security policies such as device restrictions aren't tracked at all; they install in the background. The only policies ESP tracks are Microsoft Edge, Assigned Access and Kiosk Browser.",[191,1532,1533],{},"Certificates are tracked only for SCEP profiles, and network connections only for VPN and Wi-Fi profiles.",[191,1535,1536],{},"Device setup tracks device-context apps: per-machine LOB MSI, device-context LOB store apps, Win32 and WinGet apps. Account setup tracks user-assigned apps.",[191,1538,1539],{},"Scripts that run in the user context may not execute during ESP. Microsoft's workaround is to run them as system.",[11,1541,1542,1543,1546],{},"So a device \"stuck on apps\" is often waiting on exactly one Win32 install, and the diagnostics archive shows which. Two of the most common causes are both documented: mixing LOB (MSI) and Win32 apps during ESP (both use TrustedInstaller, so one fails with ",[1522,1544,1545],{},"Another installation is in progress","), and Microsoft 365 Apps deployed with the built-in app type installing while another tracked Win32 app is running. Microsoft recommends packaging Microsoft 365 Apps as Win32 for ESP.",[15,1548,1550],{"id":1549},"timeouts-are-a-policy-design-problem-not-a-network-problem","Timeouts are a policy design problem, not a network problem",[11,1552,1553],{},"A recurring pattern: a machine fails ESP on a slow connection (a home Wi-Fi network, a hotel, a site with a saturated WAN link) and the assumption is \"the network is bad.\" Sometimes it is. More often the ESP timeout is too aggressive for the payload being pushed during provisioning, and a machine on a fast connection would have hit the same wall a few minutes later. The numbers to design around:",[188,1555,1556,1562,1565,1571],{},[191,1557,1558,1561],{},[57,1559,1560],{},"Show an error when installation takes longer than specified number of minutes"," defaults to 60.",[191,1563,1564],{},"Hybrid-joined Autopilot adds 40 minutes on top of whatever you set, to give the connector time to create the device object.",[191,1566,1567,1570],{},[57,1568,1569],{},"Install Windows quality updates"," is on by default for new ESP profiles and, per Microsoft, adds 20 to 40 minutes to provisioning with possible restarts.",[191,1572,1573,1576,1577,1580],{},[57,1574,1575],{},"Block device use until these required apps are installed"," accepts up to 100 selected apps. With ",[57,1578,1579],{},"Selected",", apps not on that list aren't tracked, and in user-driven mode Win32 apps not on the list install after ESP completes.",[11,1582,1583],{},"The fix isn't blaming the network, it's right-sizing what has to finish before the ESP releases the user to the desktop versus what can land afterwards as a background required app. I move anything that isn't strictly needed for day-one login off the blocking list and let it install after ESP.",[15,1585,1587],{"id":1586},"stale-registrations-are-the-silent-repeat-offender","Stale registrations are the silent repeat offender",[11,1589,1590,1591,1594,1595,1598],{},"When the same device fails more than once, the first thing I check is its registration history: a reseller's pre-registration, a previous deployment, a motherboard swap. Microsoft is explicit that large hardware changes such as a motherboard replacement need a new hash, and that a device with a hardware change can show ",[57,1592,1593],{},"Fix pending"," or ",[57,1596,1597],{},"Attention required"," in the Autopilot devices list. This read-only Graph script pulls everything Intune knows about a serial number in one go: the Autopilot identity (with its enrollment state, group tag and linked IDs) and any managed device records carrying the same serial:",[283,1600,1602],{"className":327,"code":1601,"language":329,"meta":288,"style":288},"\u003C#\n.SYNOPSIS\n    Shows the Autopilot and Intune records for one or more serial numbers.\n.DESCRIPTION\n    Read-only. Lists windowsAutopilotDeviceIdentities and managedDevices from\n    Microsoft Graph v1.0 and matches them by serial number, so duplicate or\n    stale records for the same hardware are visible side by side.\n.PARAMETER SerialNumber\n    One or more device serial numbers.\n.EXAMPLE\n    .\\Get-AutopilotRecord.ps1 -SerialNumber \"\u003Cserial-number>\"\n.NOTES\n    Author  : Thomas Lasswell (https:\u002F\u002Fwww.techcolumnist.com)\n    Version : 1.0 (2026-04-08)\n    Requires: Microsoft.Graph.Authentication, Microsoft.Graph.DeviceManagement;\n              DeviceManagementServiceConfig.Read.All,\n              DeviceManagementManagedDevices.Read.All.\n#>\n\n[CmdletBinding()]\nparam (\n    [Parameter(Mandatory = $true)]\n    [string[]]$SerialNumber\n)\n\nConnect-MgGraph -Scopes \"DeviceManagementServiceConfig.Read.All\", \"DeviceManagementManagedDevices.Read.All\" -NoWelcome\n\n# Autopilot identities (v1.0), following paging.\n$uri = \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FdeviceManagement\u002FwindowsAutopilotDeviceIdentities\"\n$identities = @()\nwhile ($uri) {\n    $page = Invoke-MgGraphRequest -Method GET -Uri $uri\n    $identities += $page.value\n    $uri = $page.'@odata.nextLink'\n}\n\n$managed = Get-MgDeviceManagementManagedDevice -All -Property \"id,deviceName,serialNumber,enrolledDateTime,lastSyncDateTime,azureADDeviceId\"\n\nforeach ($serial in $SerialNumber) {\n    Write-Host \"== $serial\" -ForegroundColor Cyan\n    $identities | Where-Object { $_.serialNumber -eq $serial } | ForEach-Object {\n        [PSCustomObject]@{\n            Record                = \"Autopilot\"\n            Id                    = $_.id\n            GroupTag              = $_.groupTag\n            EnrollmentState       = $_.enrollmentState\n            LastContacted         = $_.lastContactedDateTime\n            ManagedDeviceId       = $_.managedDeviceId\n            EntraDeviceId         = $_.azureActiveDirectoryDeviceId\n        }\n    } | Format-List\n    $managed | Where-Object { $_.SerialNumber -eq $serial } | ForEach-Object {\n        [PSCustomObject]@{\n            Record        = \"Intune managed device\"\n            Id            = $_.Id\n            DeviceName    = $_.DeviceName\n            Enrolled      = $_.EnrolledDateTime\n            LastSync      = $_.LastSyncDateTime\n            EntraDeviceId = $_.AzureAdDeviceId\n        }\n    } | Format-List\n}\n",[50,1603,1604,1608,1614,1619,1625,1630,1635,1640,1649,1654,1660,1665,1671,1675,1679,1684,1689,1694,1698,1702,1710,1716,1738,1747,1751,1755,1778,1782,1787,1797,1809,1817,1837,1848,1861,1865,1869,1892,1896,1908,1924,1954,1969,1979,1992,2004,2016,2028,2040,2052,2057,2065,2091,2103,2113,2125,2137,2149,2161,2173,2177,2185],{"__ignoreMap":288},[292,1605,1606],{"class":294,"line":295},[292,1607,400],{"class":399},[292,1609,1610,1612],{"class":294,"line":355},[292,1611,274],{"class":336},[292,1613,407],{"class":340},[292,1615,1616],{"class":294,"line":366},[292,1617,1618],{"class":399},"    Shows the Autopilot and Intune records for one or more serial numbers.\n",[292,1620,1621,1623],{"class":294,"line":415},[292,1622,274],{"class":336},[292,1624,420],{"class":340},[292,1626,1627],{"class":294,"line":423},[292,1628,1629],{"class":399},"    Read-only. Lists windowsAutopilotDeviceIdentities and managedDevices from\n",[292,1631,1632],{"class":294,"line":429},[292,1633,1634],{"class":399},"    Microsoft Graph v1.0 and matches them by serial number, so duplicate or\n",[292,1636,1637],{"class":294,"line":435},[292,1638,1639],{"class":399},"    stale records for the same hardware are visible side by side.\n",[292,1641,1642,1644,1646],{"class":294,"line":441},[292,1643,274],{"class":336},[292,1645,464],{"class":340},[292,1647,1648],{"class":340}," SerialNumber\n",[292,1650,1651],{"class":294,"line":447},[292,1652,1653],{"class":399},"    One or more device serial numbers.\n",[292,1655,1656,1658],{"class":294,"line":453},[292,1657,274],{"class":336},[292,1659,497],{"class":340},[292,1661,1662],{"class":294,"line":459},[292,1663,1664],{"class":399},"    .\\Get-AutopilotRecord.ps1 -SerialNumber \"\u003Cserial-number>\"\n",[292,1666,1667,1669],{"class":294,"line":470},[292,1668,274],{"class":336},[292,1670,511],{"class":340},[292,1672,1673],{"class":294,"line":476},[292,1674,517],{"class":399},[292,1676,1677],{"class":294,"line":486},[292,1678,523],{"class":399},[292,1680,1681],{"class":294,"line":492},[292,1682,1683],{"class":399},"    Requires: Microsoft.Graph.Authentication, Microsoft.Graph.DeviceManagement;\n",[292,1685,1686],{"class":294,"line":500},[292,1687,1688],{"class":399},"              DeviceManagementServiceConfig.Read.All,\n",[292,1690,1691],{"class":294,"line":506},[292,1692,1693],{"class":399},"              DeviceManagementManagedDevices.Read.All.\n",[292,1695,1696],{"class":294,"line":514},[292,1697,535],{"class":399},[292,1699,1700],{"class":294,"line":520},[292,1701,542],{"emptyLinePlaceholder":541},[292,1703,1704,1706,1708],{"class":294,"line":526},[292,1705,548],{"class":344},[292,1707,551],{"class":336},[292,1709,554],{"class":344},[292,1711,1712,1714],{"class":294,"line":532},[292,1713,560],{"class":340},[292,1715,563],{"class":344},[292,1717,1718,1720,1722,1725,1729,1732,1735],{"class":294,"line":538},[292,1719,569],{"class":344},[292,1721,572],{"class":336},[292,1723,1724],{"class":344},"(",[292,1726,1728],{"class":1727},"s9osk","Mandatory",[292,1730,1731],{"class":340}," =",[292,1733,1734],{"class":336}," $true",[292,1736,1737],{"class":344},")]\n",[292,1739,1740,1742,1744],{"class":294,"line":545},[292,1741,569],{"class":344},[292,1743,582],{"class":340},[292,1745,1746],{"class":344},"[]]$SerialNumber\n",[292,1748,1749],{"class":294,"line":557},[292,1750,631],{"class":344},[292,1752,1753],{"class":294,"line":566},[292,1754,542],{"emptyLinePlaceholder":541},[292,1756,1757,1760,1762,1765,1768,1770,1773,1775],{"class":294,"line":577},[292,1758,1759],{"class":336},"Connect-MgGraph",[292,1761,341],{"class":340},[292,1763,1764],{"class":344},"Scopes ",[292,1766,1767],{"class":591},"\"DeviceManagementServiceConfig.Read.All\"",[292,1769,749],{"class":340},[292,1771,1772],{"class":591}," \"DeviceManagementManagedDevices.Read.All\"",[292,1774,341],{"class":340},[292,1776,1777],{"class":344},"NoWelcome\n",[292,1779,1780],{"class":294,"line":598},[292,1781,542],{"emptyLinePlaceholder":541},[292,1783,1784],{"class":294,"line":603},[292,1785,1786],{"class":399},"# Autopilot identities (v1.0), following paging.\n",[292,1788,1789,1792,1794],{"class":294,"line":612},[292,1790,1791],{"class":344},"$uri ",[292,1793,588],{"class":340},[292,1795,1796],{"class":591}," \"https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002FdeviceManagement\u002FwindowsAutopilotDeviceIdentities\"\n",[292,1798,1799,1802,1804,1806],{"class":294,"line":628},[292,1800,1801],{"class":344},"$identities ",[292,1803,588],{"class":340},[292,1805,821],{"class":340},[292,1807,1808],{"class":344},"()\n",[292,1810,1811,1814],{"class":294,"line":634},[292,1812,1813],{"class":340},"while",[292,1815,1816],{"class":344}," ($uri) {\n",[292,1818,1819,1822,1824,1827,1829,1832,1834],{"class":294,"line":639},[292,1820,1821],{"class":344},"    $page ",[292,1823,588],{"class":340},[292,1825,1826],{"class":336}," Invoke-MgGraphRequest",[292,1828,341],{"class":340},[292,1830,1831],{"class":344},"Method GET ",[292,1833,650],{"class":340},[292,1835,1836],{"class":344},"Uri $uri\n",[292,1838,1839,1842,1845],{"class":294,"line":667},[292,1840,1841],{"class":344},"    $identities ",[292,1843,1844],{"class":340},"+=",[292,1846,1847],{"class":344}," $page.value\n",[292,1849,1850,1853,1855,1858],{"class":294,"line":672},[292,1851,1852],{"class":344},"    $uri ",[292,1854,588],{"class":340},[292,1856,1857],{"class":344}," $page.",[292,1859,1860],{"class":591},"'@odata.nextLink'\n",[292,1862,1863],{"class":294,"line":678},[292,1864,799],{"class":344},[292,1866,1867],{"class":294,"line":692},[292,1868,542],{"emptyLinePlaceholder":541},[292,1870,1871,1874,1876,1879,1881,1884,1886,1889],{"class":294,"line":703},[292,1872,1873],{"class":344},"$managed ",[292,1875,588],{"class":340},[292,1877,1878],{"class":336}," Get-MgDeviceManagementManagedDevice",[292,1880,341],{"class":340},[292,1882,1883],{"class":344},"All ",[292,1885,650],{"class":340},[292,1887,1888],{"class":344},"Property ",[292,1890,1891],{"class":591},"\"id,deviceName,serialNumber,enrolledDateTime,lastSyncDateTime,azureADDeviceId\"\n",[292,1893,1894],{"class":294,"line":724},[292,1895,542],{"emptyLinePlaceholder":541},[292,1897,1898,1900,1903,1905],{"class":294,"line":733},[292,1899,1101],{"class":340},[292,1901,1902],{"class":344}," ($serial ",[292,1904,1107],{"class":340},[292,1906,1907],{"class":344}," $SerialNumber) {\n",[292,1909,1910,1912,1915,1918,1920,1922],{"class":294,"line":775},[292,1911,790],{"class":336},[292,1913,1914],{"class":591}," \"== ",[292,1916,1917],{"class":344},"$serial",[292,1919,1124],{"class":591},[292,1921,341],{"class":340},[292,1923,689],{"class":344},[292,1925,1926,1928,1930,1933,1936,1938,1941,1944,1947,1949,1952],{"class":294,"line":787},[292,1927,1841],{"class":344},[292,1929,661],{"class":340},[292,1931,1932],{"class":336}," Where-Object",[292,1934,1935],{"class":344}," { ",[292,1937,987],{"class":336},[292,1939,1940],{"class":344},".serialNumber ",[292,1942,1943],{"class":340},"-eq",[292,1945,1946],{"class":344}," $serial } ",[292,1948,661],{"class":340},[292,1950,1951],{"class":336}," ForEach-Object",[292,1953,784],{"class":344},[292,1955,1956,1959,1962,1965,1967],{"class":294,"line":796},[292,1957,1958],{"class":344},"        [",[292,1960,1961],{"class":340},"PSCustomObject",[292,1963,1964],{"class":344},"]",[292,1966,1146],{"class":340},[292,1968,824],{"class":344},[292,1970,1971,1974,1976],{"class":294,"line":802},[292,1972,1973],{"class":344},"            Record                ",[292,1975,588],{"class":340},[292,1977,1978],{"class":591}," \"Autopilot\"\n",[292,1980,1981,1984,1986,1989],{"class":294,"line":807},[292,1982,1983],{"class":344},"            Id                    ",[292,1985,588],{"class":340},[292,1987,1988],{"class":336}," $_",[292,1990,1991],{"class":344},".id\n",[292,1993,1994,1997,1999,2001],{"class":294,"line":813},[292,1995,1996],{"class":344},"            GroupTag              ",[292,1998,588],{"class":340},[292,2000,1988],{"class":336},[292,2002,2003],{"class":344},".groupTag\n",[292,2005,2006,2009,2011,2013],{"class":294,"line":827},[292,2007,2008],{"class":344},"            EnrollmentState       ",[292,2010,588],{"class":340},[292,2012,1988],{"class":336},[292,2014,2015],{"class":344},".enrollmentState\n",[292,2017,2018,2021,2023,2025],{"class":294,"line":838},[292,2019,2020],{"class":344},"            LastContacted         ",[292,2022,588],{"class":340},[292,2024,1988],{"class":336},[292,2026,2027],{"class":344},".lastContactedDateTime\n",[292,2029,2030,2033,2035,2037],{"class":294,"line":849},[292,2031,2032],{"class":344},"            ManagedDeviceId       ",[292,2034,588],{"class":340},[292,2036,1988],{"class":336},[292,2038,2039],{"class":344},".managedDeviceId\n",[292,2041,2042,2045,2047,2049],{"class":294,"line":860},[292,2043,2044],{"class":344},"            EntraDeviceId         ",[292,2046,588],{"class":340},[292,2048,1988],{"class":336},[292,2050,2051],{"class":344},".azureActiveDirectoryDeviceId\n",[292,2053,2054],{"class":294,"line":871},[292,2055,2056],{"class":344},"        }\n",[292,2058,2059,2061,2063],{"class":294,"line":882},[292,2060,1267],{"class":344},[292,2062,661],{"class":340},[292,2064,772],{"class":336},[292,2066,2067,2070,2072,2074,2076,2078,2081,2083,2085,2087,2089],{"class":294,"line":893},[292,2068,2069],{"class":344},"    $managed ",[292,2071,661],{"class":340},[292,2073,1932],{"class":336},[292,2075,1935],{"class":344},[292,2077,987],{"class":336},[292,2079,2080],{"class":344},".SerialNumber ",[292,2082,1943],{"class":340},[292,2084,1946],{"class":344},[292,2086,661],{"class":340},[292,2088,1951],{"class":336},[292,2090,784],{"class":344},[292,2092,2093,2095,2097,2099,2101],{"class":294,"line":904},[292,2094,1958],{"class":344},[292,2096,1961],{"class":340},[292,2098,1964],{"class":344},[292,2100,1146],{"class":340},[292,2102,824],{"class":344},[292,2104,2105,2108,2110],{"class":294,"line":915},[292,2106,2107],{"class":344},"            Record        ",[292,2109,588],{"class":340},[292,2111,2112],{"class":591}," \"Intune managed device\"\n",[292,2114,2115,2118,2120,2122],{"class":294,"line":926},[292,2116,2117],{"class":344},"            Id            ",[292,2119,588],{"class":340},[292,2121,1988],{"class":336},[292,2123,2124],{"class":344},".Id\n",[292,2126,2127,2130,2132,2134],{"class":294,"line":931},[292,2128,2129],{"class":344},"            DeviceName    ",[292,2131,588],{"class":340},[292,2133,1988],{"class":336},[292,2135,2136],{"class":344},".DeviceName\n",[292,2138,2139,2142,2144,2146],{"class":294,"line":943},[292,2140,2141],{"class":344},"            Enrolled      ",[292,2143,588],{"class":340},[292,2145,1988],{"class":336},[292,2147,2148],{"class":344},".EnrolledDateTime\n",[292,2150,2151,2154,2156,2158],{"class":294,"line":978},[292,2152,2153],{"class":344},"            LastSync      ",[292,2155,588],{"class":340},[292,2157,1988],{"class":336},[292,2159,2160],{"class":344},".LastSyncDateTime\n",[292,2162,2163,2166,2168,2170],{"class":294,"line":993},[292,2164,2165],{"class":344},"            EntraDeviceId ",[292,2167,588],{"class":340},[292,2169,1988],{"class":336},[292,2171,2172],{"class":344},".AzureAdDeviceId\n",[292,2174,2175],{"class":294,"line":1055},[292,2176,2056],{"class":344},[292,2178,2179,2181,2183],{"class":294,"line":1060},[292,2180,1267],{"class":344},[292,2182,661],{"class":340},[292,2184,772],{"class":336},[292,2186,2187],{"class":294,"line":1066},[292,2188,799],{"class":344},[11,2190,2191,2192,2195],{},"Two managed device records for one serial, or an Autopilot identity whose ",[50,2193,2194],{},"managedDeviceId"," points at a record that no longer matches, is the \"works for other devices, fails for this one\" pattern that looks like a hardware fault.",[11,2197,2198,2199,2202,2203,2205],{},"The cleanup order matters, and my earlier advice to just delete the stale Autopilot record was too casual. Microsoft's deregistration procedure is: delete the device from Intune first, then deregister it from Windows Autopilot (unassigning the user if that option is available), then sync. For Entra joined devices, ",[1522,2200,2201],{},"don't"," manually delete the Microsoft Entra device object. The object created at registration is Autopilot's anchor for group membership and profile targeting, and deleting it can cause the join failures above (",[50,2204,144],{}," among them). For hybrid-joined devices, delete the computer object from on-premises AD instead so it doesn't sync back. After that, re-register and redeploy.",[11,2207,2208],{},"It's a five-minute check against an afternoon of chasing ghosts, and it's the same lesson as the rest of this post: the evidence is on the device and in Graph, and it's faster to read it than to reimage and hope.",[15,2210,2212],{"id":2211},"references","References",[188,2214,2215,2224,2231,2238,2245,2252,2259,2266],{},[191,2216,2217],{},[2218,2219,2223],"a",{"href":2220,"rel":2221},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fautopilot\u002Ftroubleshooting-faq",[2222],"nofollow","Windows Autopilot troubleshooting FAQ",[191,2225,2226],{},[2218,2227,2230],{"href":2228,"rel":2229},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fautopilot\u002Fknown-issues",[2222],"Windows Autopilot known issues",[191,2232,2233],{},[2218,2234,2237],{"href":2235,"rel":2236},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fintune\u002Fdevice-enrollment\u002Fwindows\u002Fsetup-status-page",[2222],"Set up the Enrollment Status Page",[191,2239,2240],{},[2218,2241,2244],{"href":2242,"rel":2243},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fintune\u002Fdevice-management\u002Factions\u002Fcollect-diagnostics",[2222],"Device action: Collect diagnostics",[191,2246,2247],{},[2218,2248,2251],{"href":2249,"rel":2250},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fclient-management\u002Fmdm-collect-logs",[2222],"Collect MDM logs",[191,2253,2254],{},[2218,2255,2258],{"href":2256,"rel":2257},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fautopilot\u002Fregistration-overview",[2222],"Windows Autopilot registration overview (deregister a device)",[191,2260,2261],{},[2218,2262,2265],{"href":2263,"rel":2264},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fgraph\u002Fapi\u002Fintune-enrollment-windowsautopilotdeviceidentity-list?view=graph-rest-1.0",[2222],"List windowsAutopilotDeviceIdentities, Graph v1.0",[191,2267,2268],{},[2218,2269,2272],{"href":2270,"rel":2271},"https:\u002F\u002Fwww.powershellgallery.com\u002Fpackages\u002FGet-AutopilotDiagnostics",[2222],"Get-AutopilotDiagnostics (PowerShell Gallery)",[2274,2275,2276],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html pre.shiki code .s95oV, html code.shiki .s95oV{--shiki-default:#E1E4E8}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html pre.shiki code .s9osk, html code.shiki .s9osk{--shiki-default:#FFAB70}",{"title":288,"searchDepth":355,"depth":355,"links":2278},[2279,2280,2281,2282,2283,2284],{"id":17,"depth":355,"text":18},{"id":254,"depth":355,"text":255},{"id":1504,"depth":355,"text":1505},{"id":1549,"depth":355,"text":1550},{"id":1586,"depth":355,"text":1587},{"id":2211,"depth":355,"text":2212},"techcolumnist",[2287],"engineering","2026-04-08T14:00:00Z","Debugging Windows Autopilot failures from the evidence: documented error codes, event IDs, ESP tracking and timeouts, log collection, and triage scripts for device and Graph.","md",false,null,{},"\u002Fblog\u002F2026\u002F04\u002F08\u002Fintune-autopilot-provisioning-failures-and-how-to-actually-debug-them",{"title":6,"description":2289},[2285],"blog\u002F2026\u002F04\u002F08\u002Fintune-autopilot-provisioning-failures-and-how-to-actually-debug-them",[2299,2300],"intune","windows","\u002F2026\u002F04\u002F08\u002Fintune-autopilot-provisioning-failures-and-how-to-actually-debug-them\u002F","c9RpYU-4LLvUd5jvEFSdlBUF--xTB-gJiXxXKTrTmDM",{"title":2304,"description":2305,"date":2306,"url":2307,"categories":2308,"tags":2310,"image":2292,"readingTime":435,"canonical":2285,"sites":2312,"series":2292,"seriesOrder":2292},"Azure: Landing Zone Design for a Mid-Size Company, Three Years In","Three years of running an Azure landing zone: a smaller management group tree, pinned policy versions, and subscription vending, with the Bicep and az CLI to build it.","2026-04-15T14:00:00Z","\u002F2026\u002F04\u002F15\u002Fazure-landing-zone-design-for-a-mid-size-company-three-years-in\u002F",[2287,2309],"strategy",[2311],"azure",[2285],{"title":2314,"description":2315,"date":2316,"url":2317,"categories":2318,"tags":2319,"image":2292,"readingTime":435,"canonical":2285,"sites":2322,"series":2292,"seriesOrder":2292},"Intune: Migrating From Group Policy to Cloud-Native Management","Moving a Windows estate from Group Policy to Intune: GPO inventory script, Group Policy analytics, Settings catalog migration, MDMWinsOverGP and conflict checks.","2026-04-01T14:00:00Z","\u002F2026\u002F04\u002F01\u002Fintune-migrating-from-group-policy-to-cloud-native-endpoint-management\u002F",[2287,2309],[2299,2320,2300,2321],"gpo","active-directory",[2285],[2313,2324,2333],{"title":2325,"description":2326,"date":2327,"url":2328,"categories":2329,"tags":2330,"image":2292,"readingTime":423,"canonical":2285,"sites":2332,"series":2292,"seriesOrder":2292},"Windows Management: A Discovery Inventory Nobody Maintains by Hand","Why a self-refreshing Windows inventory built from AD and CIM discovery outlasts a spreadsheet, with the sweep script, staleness report and schedule.","2026-09-02T14:00:00Z","\u002F2026\u002F09\u002F02\u002Fwindows-management-building-a-discovery-inventory-nobody-has-to-maintain-by-hand\u002F",[2287,2309],[2331,2300,2321],"discovery",[2285],{"title":2334,"description":2335,"date":2336,"url":2337,"categories":2338,"tags":2339,"image":2292,"readingTime":476,"canonical":2285,"sites":2341,"series":2292,"seriesOrder":2292},"Intune: Conditional Access Policies That Don't Lock Out Your Help Desk","Seven concrete Entra ID Conditional Access policies, the Graph JSON and PowerShell to create them in report-only, and the roles and queries your help desk needs.","2026-08-05T14:00:00Z","\u002F2026\u002F08\u002F05\u002Fintune-conditional-access-policies-that-don-t-lock-out-your-help-desk\u002F",[2287],[2299,2340],"entra-id",[2285],{"doc":2292,"posts":2343},[],1790052513895]