Limitations/Things to consider for Overseas Hybrid AAD Autopilot?

Question

Limitations/Things to consider for Overseas Hybrid AAD Autopilot?

Leonard Gilbert 146

I ran into an issue over the past day where I was not able to use user-driven hybrid autopilot for an overseas located device. Backstory is this was an existing corporate device. Autopilot has been set up completely and in a ready state since January as we are planning to use it for our next device refresh starting in June so now it's just documentation for end-users and planning but the technical is done i.e. knowledge about hash upload, device configuration and domain join profile, esp, deployment options, testing multiple different devices stateside without a corporate connection, etc. Our vpn is deployed during AP and the AD connectivity check is skipped. All users have an Intune license.

The user had some system corruption so I decided to not have the service desk try and ship him a device from the states so that I can try out this cool service I've been implementing for the past 4 months. The device was on Win 10 1809, so I wanted to run AP, since it still works with 1809, and then upgrade him to Win 10 21H2 afterward until it's his time for a device refresh with Win 11. I see that the HAAD device names that were in Intune for the device were added in AD as expected from the domain join profile. So the issue is the user received 80004005 error. Only differences that I can think of is time zone/being in China. He added a second keyboard layout I saw from the screenshot but the OS default is still English-US. After about 20 minutes, he said he received the 80004005 error, he then reset the device twice same thing. To get around it, I created an AAD join deployment profile and targeted that but I had to switch that for all devices so luckily the service is not in use yet or that's not an option.

I'm just looking for things to consider that would have caused this. Naturally, I can't submit the logs and I'm definitely not trying to have the user go through AP again as this is his work computer. Eventually I'll need to ship him and potentially other international users a new device with plans to use user-driven hybrid aad join. We have users in China, Brazil, India, and various EU countries.

1 answer

Your answer

Answer 1

Crystal-MSFT 53,991 Microsoft External Staff

@Leonard Gilbert , For the error code, it seems to be with Offline Domain join issues. From your description, I know we are using Windows 10 1809. Based as I know, for User-driven mode for hybrid Azure Active Directory join with VPN support , the device needs to be with the following supported version.

https://learn.microsoft.com/en-us/mem/autopilot/user-driven#user-driven-mode-for-hybrid-azure-active-directory-join-with-vpn-support-preview

Given the situation, we suggest to upgrade the device to the supported version for our scenario and see if it can work.

Hope it can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2022-04-13T02:29:22.66+00:00

@Leonard Gilbert Hope things are going well. I am writing to see if we have the opportunity to upgrade. If there's any update, feel free to let us know.

Have a nice day!
Leonard Gilbert 146 Reputation points

2022-04-15T13:17:40.54+00:00

The reason I was running Autopilot was in fact to upgrade the user later since this device failed to upgrade to 21H2 from our task sequence due to system corruption. Since he's in China we did not want to ship and swap as we usually would. However, the requirements posted is not making sense because I did infact use Autopilot with the device. To be clear, Autopilot AADJ still works for 1809 but not HAADJ? Also, in your opinion, location played no part in the failure? Just want to confirm that for future reference we start using AP for our deployments. I am going to upgrade it but not to run AP again. I've already worked to domain join it and installed a VPN on the day the issue occurred so that is not step we need to take.
Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2022-04-18T01:50:34.633+00:00

@Leonard Gilbert , For user drivern for hybrid Azure Active Directory join, windows 10 1809 is supported. But if we need user-driven mode for hybrid Azure Active Directory join with VPN support, windows 1809 is not supported.
https://learn.microsoft.com/en-us/mem/autopilot/user-driven#user-driven-mode-for-hybrid-azure-active-directory-join

For location, I didn't met the issue with it. But the one reason I can think is we need to make the time on the device the same as the one on the Domain controller. For these devices, as they are not upgraded yet, Maybe you can consider GPO enroll as instead.
https://learn.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy

Hope it can help.
Crystal-MSFT 53,991 Reputation points Microsoft External Staff

2022-04-20T05:03:27.12+00:00

@Leonard Gilbert , How's everything going. if there's still anything unclear, feel free to let us know.

Share via

Limitations/Things to consider for Overseas Hybrid AAD Autopilot?

1 answer

Your answer