Windows Autopilot Profile Assignment or OOBE Failure

Windows Autopilot Profile Assignment or OOBE Failure

Microsoft Intune Administration Runbook 03 Audience: Intune administrators, endpoint engineers, MSP administrators, service desk escalation teams, and IT operations leads Severity guide: Sev 1 when broad device enrollment, compliance, app access, endpoint security, or business-critical managed devices are blocked; Sev 2 when a user group, platform, policy, or high-priority device set is impaired with a workaround. Incident objective: Restore Autopilot provisioning by checking hardware hash/import state, group membership, profile assignment, ESP status, app dependency failures, network, and device reset state.

Operator note: Capture who is affected, when it started, exact error text, device/service identifiers, request IDs, screenshots, and before/after evidence. Prefer the smallest reversible change that restores service, then replace emergency access with a durable fix.

Common Symptoms

• Autopilot device does not receive the expected profile.
• OOBE stalls, loops, or fails during Enrollment Status Page.
• Device shows wrong tenant, wrong profile, or no deployment profile.

First 15 Minutes

• Confirm serial number, hardware hash, device import state, and assigned profile.
• Check dynamic group membership and profile assignment timing.
• Review Enrollment Status Page blocking apps, scripts, and policies.
• Confirm network access to required Microsoft endpoints during OOBE.
• Check whether device needs deregistration, reset, or profile reassignment.

Command Starters

Replace placeholders before running. Use the approved admin context and record output in the ticket.

Get-WindowsAutopilotInfo.ps1 -OutputFile C:\Temp\autopilot-hash.csv

mdmdiagnosticstool.exe -area Autopilot;DeviceEnrollment;DeviceProvisioning -cab C:\Temp\autopilot.cab

dsregcmd /status

Decision Path

Remediation Actions

• Confirm hardware hash belongs to the physical device before changes.
• Reduce ESP blocking items to true must-have apps and settings.
• Avoid repeated resets without collecting diagnostics.
• Document profile, group, and deployment timeline.

Validation Checklist

• Device receives intended Autopilot profile.
• OOBE completes to desktop with expected account state.
• ESP failures are resolved or no longer blocking.

Evidence to Attach

• User, device, service, tenant, location, IP/network, timestamps, and exact error text.
• Screenshots, logs, health/status evidence, message traces, policy results, or admin-center audit entries.
• Before/after configuration for identity, licensing, endpoint, network, mailbox, policy, or device changes.
• Approval record for any emergency permission, data restore, policy bypass, account unlock, deletion, rollback, or public exposure.

Customer-Facing Summary Template

What happened: <brief customer-safe description> Impact: <users/services/locations affected and time range> Root cause: <confirmed root cause or current leading cause> Resolution: <fix applied and validation completed> Prevention: <monitoring, guardrail, training, policy, or knowledge-base follow-up>

Reference Anchors

• Windows Autopilot
• Device enrollment guide