How to prevent my Windows 10 Home computers being remotely provisoned as Azure Active Directory (AAD) joined device via Remote Desktop (RDP)

Sarah Bucklew 1

My Windows 10 Home computers are constantly being remotely provisioned as Azure Active Directory (AAD) joined device via Remote Desktop (RDP). This much i know for sure. I am looking for a way to remove and/or disable WBEM, Windows Server, AAD, RDP, MDM, domain GPO, provisioning, enterprise, etc. I spend endless hours researching my issue every single day, although i have learned a lot, I am not able to get my computers to a point where this complete takeover of my Windows 10 Home computer(s) finally ceases.
I install Windows 10 Home iso on any given day, on any given computer. Immediately, my Windows 10 computers become provisioned adding settings and controls that can only be installed on enterprise editions and that i, have zero control over. In server config there is a Verizon Wireless server listed, which i am able to remove after the provisioning is completed, yet it makes no difference, as the damage to my OS has been done. It is always the same Verizon Wireless server each and every time.
I have tried to install Windows 10 Home, then immediately, while going through OOBE setup, tried to provision my own settings using a USB flash drive that i had created in Windows Configuration Designer and Windows System Image Manager. The conflicting provisioning settings that i am trying to force are overridden and my attempt to provision my own computer ends with errors due to the conflicting settings, that i have no choice but to ignore and proceed to setting up my machine after the fresh install with the unauthorized provisioning in place. I have narrowed down the version being provisioned onto my Windows 10 Home ISO is Windows 10 1903 Enterprise, along with Windows Server 2016/2019, which in and of itself is ridiculous to me and so endlessly frustrating.
Microsoft has so many in-depth explanations, tutorials, in-depth answers provided to so many consumers questions how to configure GPO, provisioning of devices, security policies for employees, mobile device management, enrolling client machines into everything possible, but i have never once been able to find a way to remove unauthorized provisioning by a third party to someone's computer and undoing all of the above. In each of these answers provided by Microsoft employee/volunteer/etc, every single one of those answers are so kind and polite ensuring the person asking the question was able to accomplish exactly what was being asked on the forum.
I am looking for someone to help me or point me in the right direction, please.

scavenger 1 Reputation point

2022-11-25T16:22:04.337+00:00

comments below are either misguided or trolling. There is no setting that would be deployed with a product key alone. Unless this person refers to a provisioning package containing a key, but that would be so far off from OP's post, but would at least be somewhat plausible.

I would download a new iso and reinstall personally. if you want to verify that this is what's happening -> go to settings > accounts > access work or school. if you are in a domain it will show the name and "Connected to blah blah domain" To see how this happened, export the management logs using the button directly below. Then check the add or remove provisioning package just below that. If there is one listed here, i would remove it, this will likely require a reboot and may reset your computer depending on what's in it.

If you are being joined to an AAD domain without your knowledge i would report the domain listed to Microsoft as well.

And again, there is no such thing as a product key that does anything more than activate your computer. An enterprise KMS key doesnt come embedded with connection information for the domain controller that is supposed to activate it. I would disregard the below.

1 answer

Limitless Technology 39,336 Reputation points

2021-12-31T12:19:08.67+00:00

Hello @Sarah Bucklew

In this case, it seems very possible that the issue is not the system that you are installing but the kind of activation that you are providing to these machines. In specific, if you are activating the product using a digital license provided by an organization, or provided by a reseller, it may come with a specific association to an Enterprise organization, thus all the "additional" settings you are receiving. These settings are applied to the license itself, and no matter what product you deploy it will activate with such extension, rules, configurations, etc...

Hope this helps with your query,

--If the reply is helpful, please Upvote and Accept as answer--
Please sign in to rate this answer.
sarah bucklew 1 Reputation point

2022-01-02T19:17:05.467+00:00

Thank you for your answer. However, this is not the case. I have tried to install OEM using the original product key on the machine(s). Again these are multiple machines, not just one. I have tried to provide another Windows 10 Home product key, clearly and obviously not associated with an enterprise organization. No matter what i try, the exact same settings re-appear, again not only on one machine, on every single machine. It is not a coincidence. It is not the digital product key i am using to active, it is something being provisioned to each of my computers, which again is highly unauthorized.
Such as -
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\ServerConfig\com.vzwdmserver
AlertData Y2hlY2tDb25maWd1cmF0aW9u
AlertDataType 6
AlertSourceUri ./Device/CheckConfiguration
AlertType org.openmobilealliance.dm.firmwareupdate.userrequest

AgilityProductName - Windows.Autopilot.amd64
ConciergeMsaTicketUri - https://dds.microsoft.com
ConciergeUri - https://cs.dds.microsoft.com/command/device/PersonalDeviceBootstrapPolicies
DdsZtdMsaTicketUri - https://ztd.dds.microsoft.com
DdsZtdUri - https://ztd.dds.microsoft.com/ztd/device/AutopilotDeviceBootstrapPolicies
TpmAikTaskMaxTimeoutMilliseconds - ea60
TpmNgcWaitDelayMilliseconds - 3e8
3b9dbf69-e9f0-5389-d054-a94bc30e33f7 Microsoft.Windows.Security.NGC.Local
470baa67-2d7f-4c9c-8bf4-b1b3226f7b17 TpmProvisioningTask
6D7051A0-9C83-5E52-CF8F-0ECAF5D5F6FD CryptCng

I need to be able to remove all the settings from and then make it permanent.
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RADAR\HeapLeakDetection\
(cont)

sarah bucklew 1 Reputation point

2022-01-02T19:17:51.623+00:00

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
DigitalProductId a4 00 00 00 03 00 00 00 30 30 33 32 36 2d 31 30 30 30 30 2d 30 30 30 30 30 2d 41 41 32 36 33 00 bd 0c 00 00 5b 54 48 5d 58 31 39 2d 39 38 38 36 38 00 00 00 bd 0c 00 0....
DigitalProductId4 F8 04 00 00 04 00 00 00 30 00 33 00 36 00 31 00 32 00 2D 00 300 33 00 32 00 36 00 31 00 2D 00 30 00 30 00 30 00 30 00 30 00 30 00 2D 00 30 00 30 00 30 00 00 2d 00 30 00...
EditionID Core
CurrentBuild 19044
CurrentBuildNumber 19044
InstallationType Client
Installation type is client, meaning i am a business user when i am not. I cannot opt out of the insider build. I cannot use settings on my computer. I cannot activate windows, even with a newly purchased activation key from Microsoft. I cannot use Microsoft Store. I cannot control the settings and rules windows firewall, even though it appears i can through MMC dialog. However there are many hidden firewall rules in windows registry, which explains all of the unauthorized network to my computer. If i am able to install program such as Wireshark, Malwarebytes, Glasswire, Zonelaram, etc, these programs are reconfigured remotely due to the developmental components on my computer, meaning they no longer work as intended. I can clearly observe this occurring in real time on network monitor and programs just like it. I cannot install at all programs like Tinywall or use Process Monitor from SysInternals, etc...

sarah bucklew 1 Reputation point

2022-01-02T19:27:46.9+00:00

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion
DigitalProductId a4 00 00 00 03 00 00 00 30 30 33 32 36 2d 31 30 30 30 30 2d 30 30 30 30 30 2d 41 41 32 36 33 00 bd 0c 00 00 5b 54 48 5d 58 31 39 2d 39 38 38 36 38 00 00 00 bd 0c 00 0....
DigitalProductId4 F8 04 00 00 04 00 00 00 30 00 33 00 36 00 31 00 32 00 2D 00 300 33 00 32 00 36 00 31 00 2D 00 30 00 30 00 30 00 30 00 30 00 30 00 2D 00 30 00 30 00 30 00 00 2d 00 30 00...
EditionID Core
CurrentBuild 19044
CurrentBuildNumber 19044
InstallationType Client
Installation type is client, meaning i am a business user when i am not. I cannot opt out of the insider build. I cannot use settings on my computer. I cannot activate windows, even with a newly purchased activation key from Microsoft. I cannot use Microsoft Store. I cannot control the settings and rules windows firewall, even though it appears i can through MMC dialog. However there are many hidden firewall rules in windows registry, which explains all of the unauthorized network to my computer. If i am able to install program such as Wireshark, Malwarebytes, Glasswire, Zonelaram, etc, these programs are reconfigured remotely due to the developmental components on my computer, meaning they no longer work as intended. I can clearly observe this occurring in real time on network monitor and programs just like it. I cannot install at all programs like Tinywall or use Process Monitor from SysInternals, etc...
Sign in to comment