Many persistent errors in Event Viewer after Windows 11 build 22598.ni_release.220408-1503: "Autopilot.dll wil error was reported"

Question

I used to be part of the the Windows 11 Insider Beta channel. After updating to build 22598.ni_release.220408-1503 I began to see the same error in Event Viewer extremely frequently:

The errors are all the same and read as follows:

Autopilot.dll WIL error was reported.

HRESULT: 0x80070491

File: onecoreuap\admin\moderndeployment\autopilot\dll\dllmain.cpp, line 128

Message: NULL

I have never used any program called Autopilot or Modern Deployment. After seeing this problem I immediately left the insider program and am now queued for enrollment. However no new Windows update has happened and these errors persist. How do I prevent these errors?

Answer 1

So I did some digging in the system and it appears that smoehow Autopilot is not completely disabled on Windows Home editions even though it should be. Using perfview and going through some etl logs I found out that the autopilot gets the error when it cannot assign a cloud (admin) defined timezone and language (like it does on organization computers). I;m leaving the digging for some software engineers smarter than me but this issue seems to impossible to resolve on our own since it involves sysadmin work. I even tried to activate MS-Graph and retrieve the AutopilotConifigurationFile.json (which is not present by deafault on win home pcs) however this requires and organization microsoft account to connect to the MS Endopint services for sysadmins.

Edit:

if anyone wants to dig on their own: use perfview (a legacy tool to be downloaded from microsft sites to view .etl logs) to check logs in C:\ProgramData\Microsoft\DiagnosticLogCSP\Collectors

This and other directories are defined by registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MdmDiagnostics\Area\DeviceProvisioning\FileEntry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MdmDiagnostics\Area\Autopilot

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning Autopilot-labelled folders

Logs point to MDM Diagnostics Provider service but it obviously is not present in the services manager (since its either hidden or does not exist on windows home editions)

Answer 2

Please don't try this at home. I am not responsible for anything you break or data you lose. If you do not know what you are doing, you can wreck your system. This is just what I have attempted thus far beyond my original post. I will see if I can get 72 hours stable, and then I will undo these changes one at a time to hopefully find the "root" cause.

I went for a bit of the spray and pray option this morning, and a little shy of 12 hours later, the device is still up and running. My best assumption at this point in time is the OOBE (Out Of Box Experience) uses pieces of Autopilot. It seems that it doesn't "release" your device, and keeps trying to apply a policy that will never exist. Piotr, I don't remember if Group Policy is an option on the Home edition, or if it was a watered down version, but this is where MDM can be disabled (see below). In looking at the event logs from just prior to my PC crashing this morning I noticed the following, however they were not listed as Critical or Error, but I believe in the informational section. I'd be interested to know if anyone else sees the below errors before their devices crashes. Also I've seen two posts thus far about AMD processors, which I am running as well. Does anyone with this issue have an Intel CPU?

Event logs I thought were "odd" before the crash:

• Session "EventLog-Microsoft-Windows-CodeIntegrity-Verbose" stopped due to the following error: 0xC0000188
• The maximum file size for session "EventLog-Microsoft-Windows-CodeIntegrity-Verbose" has been reached. As a result, events might be lost (not logged) to file "C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CodeIntegrity0x8800081Verbose.etl". The maximum files size is currently set to 1048576 bytes.
• NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x9'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
• The driver \Driver\WudfRd failed to load for the device HID\VID_B58E&PID_9E84&MI_03&Col02\8&22f5777d&0&0001.
• The driver \Driver\WudfRd failed to load for the device ROOT\WINDOWSHELLOFACESOFTWAREDRIVER\0000.
• Windows Hello for Business provisioning will not be launched.

I didn't record the event IDs because I was just frustrated to have my device reboot on me in the middle of a conference call. So after hastily switching devices, I just went looking at logs.

Additional Services I disabled:

• Windows Biometric Service
• Windows Camera Frame Server
• Windows Camera Frame Server Monitor

Since it is attempting to call a Hello Face driver, I just dropped any Service that appeared to be from Microsoft regarding my Webcam or any biometric sensors.

Registry Changes:

I changed my registry from time.microsoft.com to time.cloudflare.com. I did not change the hexadecimal numbers on the two entries. I only changed time.microsoft.com to time.cloudflare.com.

• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\Parameters\NtpServer
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\TimeProviders\NtpClient\SpecialPollTimeRemaining

After making those changes using the command prompt type w32tm /config /update to update your time service config. You may require an elevated command prompt.

Local Group Policy Changes:

As I said I went with the spray and pray. I disabled anything I could find regarding Biometrics, Microsoft Accounts, MDM, and Windows Hello for Business. The screenshot below is everything I changed from Not Configured to Disabled.

Event viewer changes:

To hopefully free up the file too large error I updated the event viewer log to be a maximum of 726400 KB.

Event viewer -> Application and Services Logs -> Microsoft -> Windows -> CodeIntegrity -> on the right hand side of the screen press properties and adjust the size. It can only contain values based on 64KB, so you can use mine or just press up until you get the size you'd like.

Reboot and hopefully profit.

Answer 3

Glad we're making some progress on this, I have an Intel CPU and I have also seen the windows hello event logged in the event viewer. I am only wondering whether your method won't disable all biometrics or face unlock services on devices (it's still the best deal trade off so far)

Answer 4

I do not think well of these "Work Arounds". They often cause some unexpected further problems in my experience. I repeat: MS fix it fast. It is MS's problem since it clearly says "..... in Line:128".

Answer 5

The guy who is in charge of line 128 is currently out on PTO :).

On a serious note, I have not experience a crash as of yet, after my deluge of changes. My luck it will crash 10 minutes when my next call starts, but everyone keep on hitting that like and subscribe button.