Auto-Pilot Reset - wrong local administrator

Question

Situation:

A user gives away his Microsoft Surface Pro 7.
This device (Azure joined) we want to Auto-pilot reset for another user.
After the reset, the new user is signed in with the M365 credentials and the device gets the profiles and apps from Intune.

Problem:

The old user is in the local user administration in the "Administrators" group.
Furthermore, I can't install any software with a global administrator because my administrator is not accepted in the login query.

Sure I could re-install this device, but this will not solve the problem for future devices.

Maybe you also got a problem like this?

Thanks for any input!

Greetings
Lucca

Answer 1

The old user is in the local user administration in the "Administrators" group.

This is expected and normal. If you want to add a new user as a local admin, you can use the local admin group management functionality in Intune: https://techcommunity.microsoft.com/t5/intune-customer-success/new-settings-available-to-configure-local-user-group-membership/ba-p/3093207

I strongly suggest you reconsider giving users local admin rights though as this is a vector that "bad guys" routinely exploit. Software installation should be a centrally managed function which is the entire point of having Intune and its software deployment capabilities.

because my administrator is not accepted in the login

Not sure what this means. As long as it's the same AAD tenant that the device is joined to, using your GA account will work assuming there is connectivity and no other policies in place restricting logins. You may need to login as a local admin or get the previous user to login and create a local admin account so that you can troubleshoot this further.

Sure I could re-install this device, but this will not solve the problem for future devices.

While technically correct, using AP reset is our generally recommended path when a non-shared device changes owners for whatever reason.