This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(198.4, 17%, 29%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBH%3C/text%3E%3C/svg%3E)
Hello, posting for the first time here, hoping it will reach the right audience.
When we enroll a (for example 1909) system, during the ‘Setting up your device for work’, when it moves from Device Setup to Account setup the system is rebooted.
It ends up at a login screen where the user has to fill in their username and password, and after that has to confirm identity with MFA.
Trying to figure out how to troubleshoot what is casing this reboot.
In the System log I can see.
The process C:\Windows\System32\CloudExperienceHostBroker.exe (DESKTOP-2AB16JF) has initiated the restart of computer DESKTOP-2AB16JF on behalf of user NT AUTHORITY\SYSTEM for the following reason: Operating System: Reconfiguration (Unplanned)
Reason Code: 0x20004
Shutdown Type: restart
Comment:
Digging a bit further in the Shell-Core - Operational log at the same time
CloudExperienceHost Web App Activity started. CXID: 'Reboot'.
A second earlier in the Shell-Core - Operational log
CloudExperienceHost Web App Event 1. Name: 'Autopilot device rename completed'.
Checked all possible other event logs but nothing is jumping out.
Also nothing in the IntuneManagementExtension.log
These event details don't get me many results on the WWW, besides CloudExperienceHostBroker.exe reboots is causing the same for others, no resolution though.
Any help would be appriciated.
Bas Hoog
Thanks both of you. I will get the ticket raised now :)
Turned out to be caused by assigning the Windows 10 update rings policy to a device group. Don't think Microsoft has published this, but this is a known issue internally. We are advice to assign it to All Users instead. We have to redesign our setup now before we will be able to do this.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 30%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
@Bas Hoog , Thanks for sharing the cause and workaround here. I appreciate it . It can help others who has the same issue. Thanks again for your time and have a nice day!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(124.80000000000001, 24%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EGA%3C/text%3E%3C/svg%3E)
Question for you did you have to exclude to feature updates profile? Or only the Update rings profiles? Currently we're seeing this exact same thing and are just opened a support case with Microsoft on this.
Thank you for posting the details on steps you took and the issue.
I was hoping Microsoft had resolved this by now. We have different 'Update rings for Windows 10 and later' policies and assigned them to a combination of All users and User based groups. We can still add devices to 'Feature updates for Windows 10 and later (Preview)' assigned groups in order to target Feature or Win11 upgrades. I don't think that when a device is in a Feature or Win11 upgrade targeted group it will cause enrollment issues, but I will test and confirm that later on...
They might have fixed this one actually was not able to reproduce with update rings policy removed however, we're still getting reboots. Seems related to Device Guard settings, DMA guard, or potentially the local policy settings listed in the following URL.
https://learn.microsoft.com/en-us/mem/autopilot/policy-conflicts
We're reaching out to Microsoft to try to find the root cause. I'll try to update this post with any updated information since, this was one of the few consistent topics I saw for this type of issue.