Windows 10: Autopilot failing at Enrollment Status page- error 0x81036502

Steven Kraft · Aug 24, 2022

We have been using Autopilot deployments for a few months without issue. Lately, however, Autopilot setups have been failing while on Ethernet during the enrollment status page under Device Setup - Apps. Generating error code 0x81036502If I hit "Continue Anyway" the laptop will load to desktop and everything appears to work fine, but I would like to find out what is causing the ESP to error out, as it is preventing pre-provisioning from working as well.The Enrollment profile I am using has "Block device until all apps and profiles are installed" set to No. Also I have checked the apps that d

:)

RonBarker · Aug 24, 2022

Autopilot/LTSC

Hi Mat, I have no idea what LTSC means? Anyhow, have a look at this article: Overview of Windows Autopilot | Microsoft Docs

PS: Windows Autopilot documentation | Microsoft Docs

PPS: I now know what LTSC means. 'Long-Term Servicing Channel (LTSC)'

Enrolling Windows Modern Devices using Autopilot and Azure Join (soti.net) "The following Microsoft Windows 10 editions are supported for Windows Autopilot:

Windows 10 Pro

Windows 10 Pro Education

Windows 10 Pro for Workstations

Windows 10 Enterprise

Windows 10 Education

Windows 10 Enterprise 2019 LTSC"

Brink · Aug 24, 2022

What’s new and what’s next for Windows Autopilot in Windows 10

With Windows 10, we are focused on delivering a simpler, more powerful and intelligent IT experience by deepening integration across Microsoft’s products, creating a unified Microsoft 365 solution. Windows Autopilot simplifies the deployment of new Windows 10 devices in your organization by eliminating the need for IT to create, maintain and apply custom images, dramatically reducing the cost and complexity involved with custom imaging. You can now deliver new Windows 10 devices directly to your users without IT having to touch the device. With just a few simple clicks, your users can get up and running. With Windows Autopilot, the experience of deploying new Windows 10 devices is simple for end users and zero touch for IT—seamlessly integrated across Windows 10, Microsoft Intune, and Azure AD.

This post outlines the latest enhancements to Windows Autopilot in Windows 10, version 1803, specifically:

Enrollment status

OEM and hardware vendor supply chain integration

BitLocker integration

Automatic Windows Autopilot profile assignment

Device deletion with Microsoft Intune

I’m also excited to share the Public Preview of two new and exciting capabilities available to test through the Windows Insider Program and Windows Insider Program for Business:

Windows Autopilot Self-Deploying mode

Windows Autopilot Reset

Read on for details and, to see these capabilities in action, check out this new video from Microsoft Mechanics:

Don’t have time to watch this video now? .

Windows Autopilot: What’s new in Windows 10, version 1803

Enrollment status

We’ve received extensive requests from customers for the ability to prevent users from accessing the desktop on a Windows 10 device until that device has been provisioned with IT-specified policies and configurations. With Windows 10, version 1803, we’ve addressed this feedback with a feature called enrollment status, which shows the status of a device’s configuration in the Windows 10 Out of Box Experience (OOBE) and gives IT the ability to hold the device in that state until all policies and configuration have been provisioned via MDM.

Figure 1. The enrollment status page.

This feature is now available as a preview with Microsoft Intune with Windows 10, version 1803. To turn on the enrollment status page, go to the Enrollment Status Page (Preview) section under Device enrollment > Windows enrollment in Microsoft Intune. Select the desired profile and click Settings to configure enrollment status page options for that profile. These options include the ability to:

Block the device in Windows 10 OOBE until all apps and profiles are installed on the device.

Choose the actions that users are allowed to perform in case of unexpected failures.

Specify how long the device should wait for enrollment status to complete before showing an error.

Specify a custom message in case of errors.

Currently, the enrollment status page can only be configured for the “All Users” group, which would apply to all devices and users in your organization. We are working on extending this capability to support additional groups in a future Microsoft Intune release.

Known issues

To take advantage of the enrollment status page, ensure that you have pre-installed Windows 10, version 1803 including the latest updates.

Certain policies (e.g. Windows Defender Application Guard) may trigger a reboot while Windows 10 is on the enrollment status page. This may cause the enrollment status to be interrupted and cause Windows Autopilot to fail. The device may prompt for built-in OOBE account (default0) credentials. This issue will be addressed in an upcoming update to Windows 10, version 1803, and we will update this blog post at that time with the details.

OEM and hardware vendor supply chain integration with Windows Autopilot

We’ve enabled OEMs and hardware vendors to integrate their supply chain and fulfillment systems with Windows Autopilot programmatically. This enables your hardware vendor to automatically register devices into Windows Autopilot as part of your Windows 10 device order fulfillment. With this automation, there is no action required from IT to register newly purchased Windows 10 devices into Windows Autopilot.

Lenovo and Surface have already automated their supply chain into Windows Autopilot, and we’re actively working with Dell, HP and other OEM partners to deliver this simplicity in coming months.

BitLocker updates for Windows Autopilot

With Windows 10, version 1803, we’ve made it possible for automatic BitLocker encryption to work with standard user accounts configured using Windows Autopilot. Please note, however, that automatic BitLocker encryption requires HSTI or InstantGo devices. For hardware that doesn’t support automatic BitLocker encryption, to turn on BitLocker with standard accounts using Microsoft Intune, you may find this blog post helpful.

Automatic Windows Autopilot profile assignment

Today, every time you register a new device with Windows Autopilot, you need to explicitly assign a Windows Autopilot profile to the device. Based on your feedback, we’ve integrated Azure AD groups with Windows Autopilot profile assignment through Microsoft Intune, enabling automatic assignment of a Windows Autopilot profile to Windows Autopilot registered devices. With this capability, you no longer need to manually select Windows Autopilot registered devices and assign them a profile on an ongoing basis. You can use this same Azure AD group for assignment of other Intune policies like apps and configurations, enabling complete automation for IT.

To enable the automatic assignment of the same profile to all Windows Autopilot registered devices, we tag every registered device with a tag called “ZTDID.” That means all you need to do is create an Azure AD group with a dynamic membership rule looking for the ZTDID and assign a Windows Autopilot profile to that group.

Figure 2. Creating a dynamic membership rule that looks for the ZTDID tag.

With this capability, all Windows Autopilot registered devices, regardless of when they were registered (in the past or in the future), will automatically be assigned the Windows Autopilot profile you specified. Please note: dynamic Azure AD group rules can take a few hours to process so it make take a little while for your Windows Autopilot profile assignments to show up. Alternatively, you can choose to sync on demand from the Windows Autopilot devices blade in Microsoft Intune. For more information on how to create Azure AD dynamic groups for Windows Autopilot, see Create an Autopilot device group.

In a future release, we’ll make it possible for you to specify a custom tag when you order devices from your OEM or hardware vendor to enable the creation of dynamic rules for Windows Autopilot profile assignment based on the tags you specify.

Windows Autopilot device deletion with Microsoft Intune

Based on your feedback, we’ve now made it possible to delete devices from Windows Autopilot using Microsoft Intune. If the devices are enrolled in Intune, you must first delete them from the Azure AD portal. Then, in the Windows Autopilot devices blade, simply select the devices you want to delete and choose Delete. We’re working on simplifying this experience further in a future Microsoft Intune release.

Figure 3. Deleting a device from Windows Autopilot using Microsoft Intune.

Windows Autopilot: What’s new in the Windows Insider Program

We’re taking zero touch to an entirely new level with the latest Windows Autopilot innovations:

Extending the zero-touch Windows 10 deployment experience with Self-Deploying mode.

Extending the zero-touch experience for resetting and redeploying Windows 10 devices with Windows Autopilot Reset.

These new capabilities will revolutionize how Windows 10 devices are deployed and reset—and are available to test now with Windows 10 Insider Preview Build 17672 (and later) and the Microsoft Intune preview.

Windows Autopilot Self-Deploying mode (preview)

We want the experience of deploying a new Windows 10 device to be zero touch, not only for IT, but also for the user. With a new Windows Autopilot capability called Self-Deploying mode, a new Windows 10 device can be fully business-ready by simply powering on the device. All the user needs to do is plug in the device to a network, power it on, and watch Windows Autopilot do its magic. With Self-Deploying mode, a normal off-the-shelf Windows 10 PC transforms into an intelligent device that knows how to deploy itself. Windows 10 will join your organization’s Azure AD tenant, enroll the device into Microsoft Intune (using automatic MDM enrollment), and ensure that all policies, applications, certificates, and networking profiles are provisioned on the device (using the enrollment status page).

Windows Autopilot’s Self-Deploying mode also enables you to effortlessly deploy Windows 10 as a kiosk, digital signage device, or shared productivity device. For example, if you leverage the new Kiosk Browser—an app that leverages Microsoft Edge to create a tailored and managed browsing experience—and Microsoft Intune policies to create a local automatic logon account, you can transform an off-the-shelf Windows 10 device into a browser kiosk– all that it would take is power on the device and walk away. Windows Autopilot’s Self-Deploying mode will automatically get the device joined to Azure AD, enroll into Microsoft Intune and Microsoft Intune will configure the device, deploy the app, configuration and policies, create an autologon account and transform the device into a locked down browser kiosk. No need to touch the device after power on, its as simple as that. For more information, see Simplifying kiosk management for IT with Windows 10.

With the introduction of Self-Deploying mode, we’ve made it possible for you to specify language, region, and keyboard settings for the Windows Autopilot profile. If a device has network connectivity (via an ethernet cable) when it is powered on, Windows Autopilot will automatically configure these settings without requiring any action from the end user.

Figure 4. Configuring OOBE language and keyboard settings

You can use Self-Deploying mode with a Wi-Fi network; however, the user will need to navigate through the Windows 10 OOBE until they reach the Wi-Fi connection step, at which point Self-Deploying mode will kick in. Because Self-Deploying mode doesn’t require a user to enter their organization credentials, it is important that you physically secure possession of your devices before assigning a Windows Autopilot profile, and Self-Deploying mode, to the device.

Note: Self-Deploying mode requires a device with TPM 2.0 used to authenticate the device into your organization’s Azure AD tenant.

Windows Autopilot Self-Deploying mode is available with Windows 10 Insider Preview Build 17672 and later. When configuring an Windows Autopilot profile in Microsoft Intune, you’ll see a new drop-down menu that asks for the deployment mode. In that menu, select Self-Deploying (preview) and apply that profile to the devices you’d like to validate.

Known issues

In the current Windows 10 Insider Preview build, Self-Deploying mode requires the user to interact and click on two pages in the Windows 10 OOBE:

The user must select the “Next” button on a “Welcome” page. (This page will automatically progress in a future Windows 10 Insider Preview build.)

All Windows Autopilot scenarios (including Self-Deploying mode) require the user to interact with the Activities page in the OOBE. (This page will be skipped in all Windows Autopilot scenarios in a future Windows 10 Insider Preview build.)

Remote Windows Autopilot Reset (preview)

Resetting and repurposing Windows 10 devices is a common occurrence for many of our customers. For example, academic institutions often need to reset devices at the end of the academic year and redeploy those devices for the next group of students. With Windows Autopilot Reset, all it takes to reset and deploy a device into a fully business-ready state is click of a single button in Microsoft Intune.

You may recall that we introduced a similar capability with Windows 10, version 1709 called Windows Automatic Redeployment. Windows Automatic Redeployment required a keyboard shortcut and admin credentials to trigger a reset and redeploy a device. This scenario is still available, but with the addition of the ability to trigger the reset remotely via Microsoft Intune, we are renaming this feature Windows Autopilot Reset.

As mentioned above, Windows Autopilot Reset is available with Windows 10 Insider Preview Build 17672 and later. Windows Autopilot Reset removes personal files, apps, and settings, resetting Windows 10 while still maintaining Azure AD Join and Microsoft Intune enrollment. Enrollment status must be configured for a device to trigger Windows Autopilot Reset as this allows you to ensure that a device goes back into a fully business-ready state, updated with the latest policies, settings, and apps from Microsoft Intune.

Once either a local or remote Windows Autopilot Reset is complete, the device will automatically:

Retain the region, language, and keyboard settings as configured prior to the reset.

Connect to Wi-Fi using the network credentials provisioned to the device prior to the reset.

Apply a new provisioning package (if a provisioning package is inserted via USB when Windows Autopilot Reset is triggered), or reapply the original provisioning package cached locally on the device.

Retain Azure AD Join and Microsoft Intune enrollment.

Return to a known, good, managed and synchronized state.

Whether a device is being transferred from one user to another, or you’re trying to fix a malfunctioning device (e.g. digital signage), Windows Autopilot Reset enables you to reset and automatically redeploy Windows 10 without physically accessing a device. This makes the IT experience to reset and redeploy hundreds and thousands of devices trivially simple; it just takes the click of a button in Microsoft Intune.

To trigger a remote Windows Autopilot Reset, follow these steps:

Navigate to Devices tab in the Microsoft Intune console.

In the All devices view, select the target devices and then click More to view device actions.

Select Autopilot Reset to kick-off the reset task.

Known issue

In the current Windows 10 Insider Preview build, if you set up a kiosk device with an auto-logon local account and issue a Windows Autopilot Reset to that device, after finishing Windows Autopilot Reset, Windows 10 will prompt you to enter the password for the local auto-logon account. You can leave the password blank and select enter to logon manually. This issue will be addressed in a future Windows 10 Insider Preview build so that it will not prompt for logon if an auto-logon local account is configured.

Summary

We hope you are as excited about these new capabilities as we are. Windows Autopilot is an absolute game changer, and we will continue to make investments to simplify Windows 10 deployment and management–powered by Microsoft 365.

Please try out these new capabilities and provide feedback and suggestions via the Feedback Hub. We look forward to hearing your thoughts on new capabilities and features.
Click to expand...

Source: Windows Autopilot: What's new and what's next

See also: Simplifying IT with the latest updates from Windows Autopilot - Microsoft 365 Blog

Brink · Aug 24, 2022

Windows Autopilot for HoloLens 2 general availability

Today, we are thrilled to announce the general availability of Windows Autopilot for HoloLens 2! IT administrators around the world can now use Microsoft Endpoint Manager to efficiently set up their fleet of HoloLens 2 devices and effectively deploy them to their production environments.

Traditionally, IT pros spend significant hands-on time configuring and setting up devices that will later be used by end users. With Windows Autopilot for HoloLens, we are simplifying this process. IT admins can pre-configure devices with a few simple operations, and end users can set-up the devices with little to no interaction by connecting to a network and verifying credentials.

Everything beyond that is automated.

Thanks to the valuable feedback you provide during the preview period, we have made continued improvements—to Windows Autopilot self-deploying mode in particular. With self-deploying mode, you can easily:

Join a device to Azure Active Directory (Azure AD).

Enroll the device in MDM using Azure AD automatic enrollment.

Provision policies, applications, certificates, and networking profiles.

Use the Enrollment Status Page (ESP) to prevent access to corporate resources until a device is fully provisioned.

Set up Windows Autopilot for HoloLens in 6 simple steps

Setting up your environment to support HoloLens deployment with Windows Autopilot is straightforward. Simply:

Enable Automatic MDM Enrollment.

Register devices in Windows Autopilot.

Create a device group.

Create a deployment profile.

Verify the ESP configuration.

Verify the profile status of the HoloLens device(s).

For more HoloLens-specific Windows Autopilot information, see our official Windows Autopilot for HoloLens 2 documentation or read our documentation about Windows Autopilot Self-Deploying mode.

Useful information

For device registration to Windows Autopilot, we recommend that you work with your reseller. Microsoft Cloud Solution Providers can assist you in that process. For more general information, see Adding devices to Windows Autopilot.

Windows Holographic, version 2004 (released May 2020) or newer is required to use Windows Autopilot. Windows Holographic, version 2004 (build 19041.1103) only supports Windows Autopilot over ethernet connection. Windows Holographic, version 20H2 (build 19041.1128) or later adds support for Windows Autopilot over Wi-Fi, in addition to the use of an ethernet connection.

Support paths

For support on device registration and shipments, please contact your reseller.

For general support inquiries about Windows Autopilot or for issues like profile assignments, group creation or Microsoft Endpoint Manager admin center controls, please contact Microsoft Endpoint Manager support.

If your device is registered in the Windows Autopilot service, and the profile is assigned on the Microsoft Endpoint Manager admin center, but you are still facing issues, please contact HoloLens support.

Click to expand...

Source: https://techcommunity.microsoft.com/...y/ba-p/2596348

Windows 10: Autopilot failing at Enrollment Status page- error 0x81036502

Autopilot failing at Enrollment Status page- error 0x81036502

Autopilot failing at Enrollment Status page- error 0x81036502

Autopilot failing at Enrollment Status page- error 0x81036502

Autopilot failing at Enrollment Status page- error 0x81036502 - Similar Threads - Autopilot failing Enrollment

Error Code 0x800705b4 on Enrollment Status Page During "Preparing Your Device for Mobile...

Error Code 0x800705b4 on Enrollment Status Page During "Preparing Your Device for Mobile...

Intune - Enrollment status page Black Screen when applying Account Setup during Autopilot

Intune - Enrollment status page Black Screen when applying Account Setup during Autopilot

Autopilot Error: We couldn't finish MDM enrollment. Error: 0x8018000

Autopilot Error: We couldn't finish MDM enrollment. Error: 0x8018000

Autopilot failing at Enrollment Status page- error 0x81036502

Autopilot failing at Enrollment Status page- error 0x81036502

AutoPilot for Existing Devices - MDM Enrollment