Autopilot and Intune errors: symptom, cause, fix

Twenty-two things that went wrong across one Autopilot and Intune deployment, in the order you tend to meet them. Every one of them was observed on a real device — none are hypothetical, and several announce themselves as something other than what they are.

Importing the hardware hash

PowerShell returns to the prompt with no output after signing in The script now uses the Graph SDK, and on Windows 11 the WAM broker handles authentication. In the OOBE context the session is defaultuser0, where the interactive flow cannot complete — and it fails without printing anything. → Authenticate first with Connect-MgGraph -UseDeviceAuthentication.

AADSTS530035 after the password and MFA were both accepted Not an identity failure. The authentication succeeded; what was refused was issuing a token to that flow. Security Defaults block the device code flow outright. → Entra → Properties → Manage security defaults → Disabled. Then replace them with Conditional Access, in the same session.

serialNumber is null · 0 devices imported successfully Virtual machines often have no SMBIOS serial, and Autopilot requires one. → Proxmox: VM off → Options → SMBIOS settings (type1) → Serial.

“running scripts is disabled on this system” Set-ExecutionPolicy -Scope Process applies to that PowerShell window only. A new window loses it. → Repeat it in every session. Note that the script never loads at all, so this is not a credentials problem even though it happens where you would expect one.

The device shows Enabled: No in Entra after the import Normal. It is an Autopilot placeholder, and it enables itself when the device completes the Entra join. → Do nothing. Do not force it with a script or a remediation.

During OOBE

OOBE asks whether the setup is personal or for work That question means the Autopilot profile was not applied. A device with a profile goes straight to “Let’s set things up for your work or school”. → Usually the hash has not finished syncing. Wait ten to fifteen minutes after the import and restart. If OOBE was never completed, shutdown /r /t 0 from Shift+F10 is enough — wpeutil does not exist in OOBE, it belongs to WinPE.

No company branding on the first screen Expected. The logo appears on the password page, not the first screen.

The logo will not upload The banner logo must be 245×36 and no larger than 10 KB.

US keyboard despite the profile saying Italian The Autopilot profile requests a language, it does not install one. An en-US image has no Italian pack, so OOBE falls back entirely to en-US. → A platform script for keyboard and formats. Run using logged-on credentials — language settings are per-user.

The device name is truncated Windows computer names are limited to 15 characters, and the template is cut silently. WA-%SERIAL% on serial W11-AUTOPILOT-001 produced WA-AUTOPILOT001. → Use WA-%RAND:6%. Predictable length, no collisions — and the RDP chapter explains why a predictable name matters later.

BitLocker

Protection Off and Key Protectors: None Found on a volume that is 100% encrypted Not a contradiction. This is pre-provisioning: Windows encrypted the volume during setup with a clear key and is waiting for a policy to add a TPM protector and a recovery key. → The policy is not arriving. See the next two entries.

Event 853: “Failed to enable Silent Encryption. TPM is not available.” The first line is wrong — Get-Tpm will report the TPM present and ready. The second line of the same event carries the real cause: bootable media detected. The Windows and virtio ISOs were still mounted in the VM. → Proxmox → Hardware → each CD/DVD drive → Do not use any media → reboot.

Settings in Conflict, and nothing applied When a security baseline and a dedicated policy configure the same setting differently, Intune applies neither. There is no error anywhere — the device silently keeps the Windows default. → Devices → [device] → Device configuration → [policy] shows the state per setting with the source profiles. Removing the entries from the baseline may not be enough; deleting the baseline was what worked.

XTS-AES 128 instead of 256 A consequence of the conflict above. Cipher and encryption type are chosen when encryption starts and cannot be changed while it runs. → Resolve the conflict, then manage-bde -off C:, reboot, and let the policy re-encrypt. Note that this generates a new recovery key — the old one in Entra becomes useless.

OSEncryptionType = 1 in the registry but still Used Space Only Not a misconfiguration. MDM-driven silent encryption always uses used-space-only by design. The ADMX setting governs encryptions started manually. → Nothing to fix. On a new disk it makes no practical difference; Full matters on reused disks.

A BitLocker policy that seems not to have arrived The three contested settings are ADMX-backed and do not appear under PolicyManager\current\device\BitLocker. → Look in HKLM:\SOFTWARE\Policies\Microsoft\FVE instead.

OneDrive and apps

Known Folder Move never happens, and nothing reports a problem The Tenant ID field is wrong, empty, or contains the tenant name. The policy shows as applied, silent sign-in works, Files On-Demand works, and the folders simply stay on the local disk. → Check on the device: OneDrive settings → Backup. The three folders should be listed and not switchable off.

Remote Desktop

RDP enabled by policy, but every connection times out Enabling the service does not open the firewall. That is a separate policy. → Endpoint security → Firewall → Windows Firewall Rules, inbound TCP 3389.

Remote Desktop Users appears empty net localgroup does not display Entra members. The policy probably worked. → Get-LocalGroupMember "Remote Desktop Users" — Entra members appear as SIDs beginning S-1-12-1-.

Credentials refused with AzureAD\user@domain NLA cannot validate cloud credentials when client and target share no domain or tenant. → mstsc → Show options → Advanced → “Use a web account to sign in to the remote computer”.

“Using an IP address is not supported” The web-account flow issues a token for a device, and a device is identified by name. → Connect by name.

AADSTS293004: The target-device identifier was not found in the tenant Entra looks for the exact string you connected to among the tenant’s devices. WA-AUTOPILOT001.home.arpa is not WA-AUTOPILOT001. → Use the bare name. Internal suffixes — .home.arpa, .lan, .local — break the lookup.

Intune, generally

A policy that is never applied to anything, with no error In the Firewall section Intune distinguishes Windows from Windows (ConfigMgr). The second is for co-management with Configuration Manager. Choose it by mistake and the policy is created, looks correct, and does nothing.

A device is non-compliant the moment it enrols No grace period. It is marked non-compliant before any policy has had time to arrive — and if Conditional Access already requires a compliant device, that locks out the user you just onboarded. → Set a grace period under Actions for noncompliance.

A script that will not run again after you fixed it Intune platform scripts execute once per device. There is no re-run. → Delete the assignment and recreate it.

Forcing a policy sync returns access denied The EnterpriseMgmt scheduled tasks run as SYSTEM and are protected. → Settings → Accounts → Access work or school → Info → Sync, which is only visible in the Entra user’s session — not from a local account. Otherwise wait for the automatic check-in.

---

The pattern worth noticing

Look at how many of these announce themselves as something else.

An event log blaming the TPM for a mounted ISO. A conflict that produces no error and simply leaves the Windows default in place. A group that looks empty because the tool cannot describe its members. A token refused with a message about Conditional Access when no Conditional Access policy exists yet.

The habit that shortens all of them is the same: verify the end state on the device, not the deployment status in the portal. A dashboard reports whether a policy was delivered. It does not report whether the thing you wanted actually happened.