Autopilot failed at device setup

Question

Autopilot failed at device setup

TechUST 606

Hi Expert,

I am setting up a device with autopilot intune on Hyper VM, but getting error on device setup (ESP assigne getting failed while identifying). can you please help. i have run Autopilot diagnostic but everything appeears good.

Rudy Ooms 701 Reputation points MVP

2023-03-14T06:07:58.09+00:00

Hi... I assume you have run that autopilot diagnostic with the online switch? It should show you which app is stuck in progress. What kinda error are you getting? Could be useful :)
TechUST 606 Reputation points

2023-03-14T08:09:53.6866667+00:00

@Rudy Ooms i have run diagnostic but there not appear any error.
Rudy Ooms 701 Reputation points MVP

2023-03-14T08:13:47.1433333+00:00

Hi... I noticed the screenshot and msft telling you to check the security policies.. sfaik, those sec policies arent tracked by the esp (fake policy 1 of one)..

https://call4cloud.nl/2021/06/those-magnificent-drivers-in-their-flying-microsoft-store-or-how-i-flew-from-the-enrolment-status-page-to-paris-in-25-hours-11-minutes/#part2

Just wondering but the step before "The device preparation phase" does that even succeed?

Haadj or aadj? Is the device even registered in MDM/Intune. By the looks of it ... not :)
TechUST 606 Reputation points

2023-03-14T08:18:44.8433333+00:00

Hi- Device preparation steps already succeed.also device is registered in intune. We do have hybrid azure AD join.
TechUST 606 Reputation points

2023-03-14T08:20:30.41+00:00

Also let me tell you, autopilot working on physical device so is it possible that policy can create problems on VM.
Rudy Ooms 701 Reputation points MVP

2023-03-14T08:21:17.0233333+00:00

Ahhh using sccm? changed workloads?
TechUST 606 Reputation points

2023-03-14T08:23:36.1366667+00:00

Yes, workloads already changed
Rudy Ooms 701 Reputation points MVP

2023-03-14T08:26:27.0566667+00:00

and only virtual machines are giving you those issues? does it break immediately after the device preparation step or does it take some additional time?

I assume there are no additional hardware firewall/proxy deployed to those vms? Could you share some logs? more information?
TechUST 606 Reputation points

2023-03-14T08:31:23.9433333+00:00

Yes only issue with VM, I have VDI environment where i have configured hyper VM with default switch. After device preparation Its take long time to identify ESP (network, policy, app) then after occur error.
Stephannn 11 Reputation points

2023-07-27T14:13:38.2066667+00:00
Hi,

I have the same issue on my VMware workstation this week (its AMD powered). I am also pretty sure last week it was working but my brain might be lying to me. My Device Setup phase is like this:

Device Setup Working on it... Security policies (identifying) certificates (identifying) network connection (identifying) apps (identifying)

Even if apps are installed, it is not writing down any left over numbers. After a while cloudexperiencehostbroker.exe calls a reboot and it goes straight to the blue screen saying "why did my pc restart".

On a real hardware model it works - Autopilot AAD User Driven installation.

Maybe tomorrow I will try this tipp, recreate the ESP: https://learn.microsoft.com/en-us/answers/questions/126121/autopilot-troubleshooting-reboots-during-device-en

Edit:
I'd like to add that I also set up on the same machine Hyper-V and it worked as expected. At the same time I installed on an old Lenovo T570 (not win11 supported because of Intel CPU) VMware Workstation but it seems that the performance is not good enough and sooner or later it will timeout.

A site note. We have en ESXi 7 Server also on AMD CPU. With the latest hardware model I cannot do a inplace upgrade of Windows 10. It will cause a bluescreen. If we move the same machine to a Intel powered ESX it works. Workaround is to downgrade the HW version to 16.

2 answers

Your answer

Rudy Ooms 701 Reputation points MVP

2023-03-14T06:07:58.09+00:00

Hi... I assume you have run that autopilot diagnostic with the online switch? It should show you which app is stuck in progress. What kinda error are you getting? Could be useful :)
TechUST 606 Reputation points

2023-03-14T08:09:53.6866667+00:00

@Rudy Ooms i have run diagnostic but there not appear any error.
Rudy Ooms 701 Reputation points MVP

2023-03-14T08:13:47.1433333+00:00

Hi... I noticed the screenshot and msft telling you to check the security policies.. sfaik, those sec policies arent tracked by the esp (fake policy 1 of one)..

https://call4cloud.nl/2021/06/those-magnificent-drivers-in-their-flying-microsoft-store-or-how-i-flew-from-the-enrolment-status-page-to-paris-in-25-hours-11-minutes/#part2

Just wondering but the step before "The device preparation phase" does that even succeed?

Haadj or aadj? Is the device even registered in MDM/Intune. By the looks of it ... not :)
TechUST 606 Reputation points

2023-03-14T08:18:44.8433333+00:00

Hi- Device preparation steps already succeed.also device is registered in intune. We do have hybrid azure AD join.
TechUST 606 Reputation points

2023-03-14T08:20:30.41+00:00

Also let me tell you, autopilot working on physical device so is it possible that policy can create problems on VM.
Rudy Ooms 701 Reputation points MVP

2023-03-14T08:21:17.0233333+00:00

Ahhh using sccm? changed workloads?
TechUST 606 Reputation points

2023-03-14T08:23:36.1366667+00:00

Yes, workloads already changed
Rudy Ooms 701 Reputation points MVP

2023-03-14T08:26:27.0566667+00:00

and only virtual machines are giving you those issues? does it break immediately after the device preparation step or does it take some additional time?

I assume there are no additional hardware firewall/proxy deployed to those vms? Could you share some logs? more information?
TechUST 606 Reputation points

2023-03-14T08:31:23.9433333+00:00

Yes only issue with VM, I have VDI environment where i have configured hyper VM with default switch. After device preparation Its take long time to identify ESP (network, policy, app) then after occur error.
Stephannn 11 Reputation points

2023-07-27T14:13:38.2066667+00:00

Hi,

I have the same issue on my VMware workstation this week (its AMD powered). I am also pretty sure last week it was working but my brain might be lying to me. My Device Setup phase is like this:

Device Setup Working on it... Security policies (identifying) certificates (identifying) network connection (identifying) apps (identifying)

Even if apps are installed, it is not writing down any left over numbers. After a while cloudexperiencehostbroker.exe calls a reboot and it goes straight to the blue screen saying "why did my pc restart".

On a real hardware model it works - Autopilot AAD User Driven installation.

Maybe tomorrow I will try this tipp, recreate the ESP: https://learn.microsoft.com/en-us/answers/questions/126121/autopilot-troubleshooting-reboots-during-device-en

Edit:
I'd like to add that I also set up on the same machine Hyper-V and it worked as expected. At the same time I installed on an old Lenovo T570 (not win11 supported because of Intel CPU) VMware Workstation but it seems that the performance is not good enough and sooner or later it will timeout.

A site note. We have en ESXi 7 Server also on AMD CPU. With the latest hardware model I cannot do a inplace upgrade of Windows 10. It will cause a bluescreen. If we move the same machine to a Intel powered ESX it works. Workaround is to downgrade the HW version to 16.

Answer 1

Crystal-MSFT 53,991 Microsoft External Staff

@Techkant, Thanks for posting in Q&A.

For the error, please get a screen shot to know more details.

Meanwhile, you can refer to the following link to do troubleshooting to see if we can get more information:

https://oofhours.com/2020/07/19/troubleshooting-windows-autopilot-hybrid-azure-ad-join/

Note: Non-Microsoft link, just for the reference.

Hope it can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

TechUST 606 Reputation points

2023-03-14T02:44:17.85+00:00

Screenshot_2023-03-14-08-13-51-68_be80aec1db9a2b53c9d399db0c602181.jpgPlease see error picture
Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2023-03-14T05:23:27.5433333+00:00

@Techkant, Thanks for the reply. From the pictures, it seems the security policies targeted to the devices are failed to deploy. Please firstly unassigned the policies to the device and see if the phase can be passed.

https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-status#device-setup
TechUST 606 Reputation points

2023-03-14T08:08:43.03+00:00

@Crystal-MSFT thanks for replying, please let me know how to unassigned policy from device.
Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2023-03-14T09:25:23.22+00:00

@Techkant, Thanks for the reply. You can check which group the device belongs to and check if any security policies in the following link assigned to this group. If yes, remove the group from the policy assignment and see if it works.

https://learn.microsoft.com/en-us/mem/intune/protect/endpoint-security-policy
Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2023-03-16T03:55:10.8066667+00:00

@Techkant, How are things going? If there's any update, feel free to let us know.

Answer 2

Zeeshan Nasir Bajwa 656 Student Ambassador

There are several possible reasons for the error you are experiencing during the device setup process. Here are a few things you can try:

Check your Intune configuration: Make sure that your Intune configuration is correct and up-to-date. You can do this by checking the Intune dashboard and verifying that all settings are correct.
Check your device configuration: Verify that the device is properly configured and meets the requirements for Autopilot. Ensure that the device is running a supported version of Windows 10 and that it has the necessary network connectivity to communicate with your Intune environment.
Check your network configuration: Ensure that your network is properly configured to allow communication between the device and your Intune environment. This includes verifying that firewalls and other security measures are properly configured to allow the necessary traffic.
Check your Azure AD configuration: Make sure that your Azure AD configuration is correct and up-to-date. This includes verifying that all users and devices are properly registered in Azure AD.
Check your enrollment profile: Verify that your enrollment profile is properly configured and assigned to the device. Ensure that the profile includes all necessary settings and that it is assigned to the correct group or user.

TechUST 606 Reputation points

2023-03-14T09:11:27.24+00:00

Hi Zeeshan, Thanks for replying. 1- configuration is ok because autopilot working on physical device. 2- I have prepared VM with two processor and 4 gb RAM as per recommended by Microsoft. 3- i have checked that required urls are accessible from device. 4- yes azure AD configuration is update to date. 5- yes because on same enrollment profile working and assigned to correct group, VM hostname also getting enrolled in intune.
Zeeshan Nasir Bajwa 656 Reputation points Student Ambassador

2023-03-14T09:16:41.5833333+00:00
Hi,

It's great to hear that you have already verified some of the possible causes of the issue you are experiencing. Here are some additional steps you can take to troubleshoot the error:

Check the event logs: The event logs on the device can provide valuable information about the error you are experiencing. Look for any events related to Autopilot, Intune, or device enrollment, and see if there are any error messages or warnings that can provide clues about the issue.

Verify the device identity: Make sure that the device identity is properly registered in Azure AD. You can do this by checking the device details in the Azure portal and verifying that the device ID matches the ID of the device you are trying to enroll.

Check the device profile settings: Verify that the device profile settings are correct and that they are applied to the device. This includes checking the profile settings for the device group or user to which the device is assigned.

Verify the ESP settings: Verify that the ESP (Enrollment Status Page) settings are correct and that the ESP has been properly configured. This includes checking the ESP settings in the device profile and ensuring that the ESP URL is accessible from the device.

Try a different device: If all else fails, try enrolling a different device to see if the issue is specific to the device you are trying to enroll. This can help you determine whether the issue is related to the device or the Intune environment.

I hope these suggestions help you resolve the issue. If you continue to experience problems, I would recommend reaching out to Microsoft support for further assistance.

Share via

Autopilot failed at device setup

2 answers

Your answer