Daily Intune News
Aboutmerill.net
Windows Autopilot
Device enrollment

Windows Autopilot Troubleshooting FAQ | Microsoft Learn

30 October 2026Doc update+37 / −37 lines

In brief

The FAQ was refreshed with updated wording, metadata, link formatting, terminology, and Command Prompt instructions. The description and diagnostic-page text were also revised.

What Intune admins need to know

No administrator action is indicated. Administrators may use the updated FAQ as a clearer troubleshooting reference.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Windows Autopilot troubleshootingTroubleshooting FAQ | Microsoft Learn

Applies to:

This article provides troubleshooting for common Windows Autopilot issues.

Troubleshooting Windows Autopilot overview

What concepts should be understoodyou understand when troubleshooting Windows Autopilot?

Windows Autopilot is designed to simplify all parts of the Windows device lifecycle, but there are always situations where issues might arise. When troubleshooting an issue, it's helpful to understand:

  1. The Windows Autopilot profile is downloaded. When a wired connection is used, or a wireless connection is established, the profile downloads from the Windows Autopilot deployment service as soon as the network connection is in place.
  2. User authentication occurs. During a user-driven deployment, the user enters their Microsoft Entra credentials, which is then validated.
  3. Microsoft Entra join occurs. For user-driven deployments, the device is joined to Microsoft Entra ID using the specified user credentials. For self-deploying scenarios, the device is joined without specifying any user credentials.
  4. Automatic mobile device management (MDM) enrollment occurs. As part of the Microsoft Entra join process, the device enrolls in the MDM service configured in Microsoft Entra ID (forID, for example, Microsoft Intune).Intune.
  5. Settings are applied. If the enrollment status page is configured, most settings are applied while the enrollment status page is displayed. If not configured or available, settings will be appliedapply after the user is signed in.

How are Windows Autopilot device profiles downloaded?

When an Internet-connected Windows device boots up,starts, it attempts to connect to the Windows Autopilot service and download a Windows Autopilot profile. The Windows Autopilot profile is downloaded as soon as possible, and again after each reboot.restart.

Note

At this stage, it's important that a Windows Autopilot profile exists in the tenant so that a blank profile isn't cached locally on the device. If necessary, a new Windows Autopilot profile can be retrieved by rebootingrestarting the device.

If a computer needs to be rebootedrestarted during the Windows out-of-box experience (OOBE) to retrieveget a new Windows Autopilot profile:

  1. Select Shift-Shift+F10 to open a command promptCommand Prompt window.

  2. In the command promptCommand Prompt window, enter one of the following two commands:

    • shutdown.exe /r /t 0 to restart immediately.
    • shutdown.exe /s /t 0 to shut down immediately.

How can additional detailed troubleshooting information be enabled?

On Windows 11, the Windows Autopilot diagnostic page can be opened to view additional detailed troubleshooting information about the Windows Autopilot provisioning process. To enable the Windows Autopilot diagnostics page:

  1. Go to the ESP profile where the Windows Autopilot diagnostics page needs to be enabled.
  2. Make sure that Show app and profile configuration progress is selected to Yes.
  3. Make sure that Turn on log collection and diagnostics page for end users is selected to Yes.

To access any diagnostic information once the diagnostic page is enabled, select the View Diagnostics button or enter the keystrokeselect CTRL + SHIFT + D. The diagnostics page is currently supported under the following conditions:

  • Windows 11.

  • Windows Autopilot user-driven mode. To resolve and fix the issue in this scenario and redeploy the device using Windows Autopilot, follow these steps:

    1. Sign into the Microsoft Intune admin center.

    2. In the Home screen, select Devicesin the left hand pane.pane, select Devices.

    3. In the Devices | Overview screen, under By platform, select Windows.

    4. In the Windows | Windows devices screen, under Device onboarding, select Enrollment.

    5. In the Windows | Enrollment screen, under Windows Autopilot, select Devices. To resolve and fix the issue in this scenario and redeploy the device using Windows Autopilot, follow these steps:

    6. Sign into the Microsoft Intune admin center.

    7. In the Home screen, select Devicesin the left hand pane.pane, select Devices.

    8. In the Devices | Overview screen, under By platform, select Windows.

    9. In the Windows | Windows devices screen, under Device onboarding, select Enrollment.

    10. In the Windows | Enrollment screen, under Enrollment options, select Device platform restriction.

    11. Locate Windows (MDM) under the Type column.

    12. Make sure that Windows (MDM) is set to Allow under the Platform column.

    13. If Windows (MDM) is set to Block, change it to Allow.

    14. Select Review + save, and then either Save if a setting was changed, or Cancel if notno settings were changed.

    15. Repeat the above steps for any additional restrictions that might exist in the Enrollment restrictions screen other than All Users. Only restrictions for the Windows platform need to be verified.

    Note

    When multiple restrictions exist, restrictions might exist that only allow certain groups MDM enrollment. Some of the restrictions blocking MDM enrollment might be valid based on what group the restrictions are assigned to. When experiencing this problem, verify that the device isn't a member of one of the groups where there's MDM enrollment is blocked. Alternatively, if applicableapplicable, change the MDM enrollment setting for that restriction to Allow.

In both of these scenarios, in addition to error 0x80180014 occurring, the Event Tracing for Windows (ETW) logs might also show the following mobile device management (MDM) error:

To resolve and fix this issue, the hash needs to be modified. The new value then needs to be tested until PowerShell succeeds in decoding the hash. The result is mostly illegible, which is fine as long as the error Invalid length for a Base-64 char array or string isn't displayed.

To test the base64, use the following PowerShell:PowerShell command:

[System.Text.Encoding]::ascii.getstring( [System.Convert]::FromBase64String("DEVICE HASH"))
[System.Text.Encoding]::ascii.getstring( [System.Convert]::FromBase64String("Q29udG9zbwAAA"))

This particular example isn't a device hash, but it's a misaligned unpadded Base64 so it's good for testing.

Now for the padding rules. The padding character is "=". The padding character can only be at the end of the hash, and there can only be a maximum of two padding characters. Here's the basic logic.logic:

  • Does decoding the hash fail?
    • Yes: Are the last two characters "="?

To resolve and fix this issue, deregister and re-register the device. For more information including how to deregister a device, see the following articles:

Why is the join type for a device showing as "Microsoft Entra registered" instead of "Microsoft Entra joined"?

This issue occurs if the device was previously registered in Microsoft Entra ID before it was joined to Microsoft Entra ID. The device possibly registered in Microsoft Entra ID viaby using something like a Workplace join. If the Microsoft Entra ID registered device isn't deleted from Microsoft Entra ID before the device is joined to Microsoft Entra ID, then the previous trust type is retained in the record. Joining an existing Microsoft Entra registered device to Microsoft Entra ID results in the Windows Autopilot device showing as Microsoft Entra registered instead of Microsoft Entra joined.

To resolve and fix this issue, before registering an existing Microsoft Entra ID registered device as a Windows Autopilot device, the following existing device objects for the device should be deleted:

  • Microsoft Intune.Intune
  • Microsoft Entra ID.ID
  • Windows Autopilot.Autopilot

After all device objects are deleted, re-register the device as a Windows Autopilot device and then re-enroll the device. For more information on properly deleting all of the device objects, see Deregister a device.

To troubleshoot enrollment issues in Microsoft Intune such as the error code 80180018 in the Something went wrong error page, see Troubleshooting Windows device enrollment errors in Intune. Common issues can include:

  • Incorrect or missing licenses assigned to the user.user
  • Too many devices enrolled for the user.user

Why does Windows Autopilot Reset fail immediately with an error?

During the ESP of a Windows Autopilot deployment, why does the Microsoft 365 Click-to-Run version of Office fail to install the Teams Machine-Wide Installer, or cause other Win32 app MSI based installs to fail?

The Teams Machine-Wide Installer component of the Microsoft 365 Click-to-Run version of Office includes an MSI installation. ESP doesn't track the Teams Machine-Wide Installer MSI install. Because ESP doesn't track the Teams Machine-Wide Installer MSI install, it can cause a conflict when other Win32 app MSI based installs attempt to install during ESP. MSIs install viaby using TrustedInstaller which doesn't allow simultaneous installations. This conflict can cause either the Teams Machine-Wide Installer to fail or other MSI based installs to fail during ESP. For more information, see Set up the Enrollment Status Page - Device setup: Apps.

This issue might be random and might not always occur. The issue occurs due to a timing issue between the Teams Machine-Wide Installer MSI install and other Win32 app MSI installs.

This error might occur for several reasons including:

  • The domain has more than one domain controller with a replication latency policy. The MSA was created in one of the domain controllers but the search happened against another domain controller. Wait until replication has completed in accordance with your policy or manually sync. OnceAfter the replication is complete, then open the connector and choose Configure MSA.
  • A group policy is configured that doesn't allow services to be started as a non-privileged account. Make sure the MSA account has Log on as a service privileges granted. For example, see this instance with Operations Manager to Enable service logon.

Why is the error "Microsoft Edge can't read and write to its data directory" occurring?

- [Windows Autopilot requirements - Windows Autopilot Deployment Service](requirements?tabs=networking#windows-autopilot-deployment-service).
- [Intune core service](/en-us/intune/fundamentals/endpoints#endpoints).
- [Windows Autopilot dependencies](/en-us/intune/fundamentals/endpoints#windows-autopilot-dependencies).

  • Server is sending network request viausing TLS 1.0 or 1.1 because PKCS Cryptography is disabled. To resolve the issue, on the server hosting the Intune Connector for Active Directory, delete the registry key value specified in the following command by running the command from an elevated command prompt:

    reg.exe delete "HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS" /v Enabled /f

Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…