Intune hangs logging in

[petben]

I have a test Intune device, it is in a Test Azure group with no Profiles, Powershell scripts or Apps assigned to it. It is simply Windows EDU which has run its autopilot deployment profile.

 

When any user logs in, it goes through the 'setting up your device' business but gets stuck 'identifying Apps' (timing out after 60 minutes and then logging in normally)

 

Any ideas what it is trying to do? I cant see anything in the firewall, filtering, event log etc.

 

[NicholasEsping]

I am not sure what it is trying to do at this point but when we were first starting out with intune we played around with autopilot and found that using the set up schools pc app worked better for us. The main issue we had with autopilot was every user was an administrator on the computer which might not be the case anymore. With set up schools USB sticks only users with administrator rights in Office 365 are admins on the computers. The other big benefit to using Set up schools is when the users get their device they are ready to go the USB stick takes care of enrollment into azure, installing some basic apps, setting backgrounds,etc. After the user logs in the computer will check into intune and pull down any additional profiles that are assigned to the user. Here is a link with some more info on Set up Schools https://docs.microsoft.com/en-us/education/windows/use-set-up-school-pcs-app

[snagrat]

When you do get signed in are all the apps present?

 

We set the bit to not wait for the apps, so you do not see the page you are seeing. Any apps will install once logged in silently.

[ScottStauffer]

I am not sure what it is trying to do at this point but when we were first starting out with intune we played around with autopilot and found that using the set up schools pc app worked better for us. The main issue we had with autopilot was every user was an administrator on the computer which might not be the case anymore. With set up schools USB sticks only users with administrator rights in Office 365 are admins on the computers. The other big benefit to using Set up schools is when the users get their device they are ready to go the USB stick takes care of enrollment into azure, installing some basic apps, setting backgrounds,etc. After the user logs in the computer will check into intune and pull down any additional profiles that are assigned to the user. Here is a link with some more info on Set up Schools https://docs.microsoft.com/en-us/education/windows/use-set-up-school-pcs-app

I had real high hopes for the "Set up school PCs" App (SUSPC), but after a few attempts I see that the newest push from the Microsoft Store now has a lot of limitations. Applying the Provisioning Pack from OOBE seems to always do a reset first... not sure why! so we see 2 hours of waiting. I would much rather see these things being pushed through Intune with a policy so that it is easier to modify... If you determine that you chose poorly when you created the SUSPC config, then you could more easily manage change, it seems. A few months back it allowed you to package up Office Desktop Apps onto the USB too... this was promising... sure, more that 2 GB of a cab file, but this lessened the load of pulling it over the air via WiFi - no longer available. Also I was told that you could import the SUSPC config into Window Configuration Designer... Nope... Import fails. I'm not trying to bad mouth the solution... perhaps I'm wrong about these items... I wish I were... Maybe I'm doing something wrong here... but... I don't think so... If I am in error, please help, if I am not and you agree, please let me know and I will see who I can bring ideas too on the EDU team.

[NicholasEsping]

We do not have these issues with Set up school PCs app. I am guessing you are trying to remove apps pre-installed by the device manufacturer. Enabling that setting increased the set up time by a lot for us. We use the USB stick to set the wifi network, change the pc name, set the Azure domain name, and add backgrounds. This takes approx. 5 minutes. For office we add that to the image using DISM and other apps we deploy though intune.

[ScottStauffer]

Wow, thank you... I think you might have hit the nail on the head... We pushed a clean Windows 10 Edu ISO onto the machine... I think I misunderstood remove unwanted Apps to mean what Windows EDU SKU does already, and that's get rid of the noise, but now I suspect it means as you say, "remove apps pre-installed by the device manufacturer" - thanks! This helps a LOT!

[free780]

I have a test Intune device, it is in a Test Azure group with no Profiles, Powershell scripts or Apps assigned to it. It is simply Windows EDU which has run its autopilot deployment profile.

 

When any user logs in, it goes through the 'setting up your device' business but gets stuck 'identifying Apps' (timing out after 60 minutes and then logging in normally)

 

Any ideas what it is trying to do? I cant see anything in the firewall, filtering, event log etc.

 

[ATTACH=CONFIG]55355[/ATTACH]

I also had this behaviour. I think I hadn't let the autopilot service sync with Intune long enough. I already had profiles configured. I was going to test with a direct to firewall connection to rule out proxies. Michael Nielhaus did a blog post on how he hates proxies so I'm not sure if autopilot struggles when behind a proxy.

[chaplic]

Oh, I can assure you autopilot is a PITA behind a proxy. It DOES work but you need to set it at a system level (netsh winhttp set proxy) I have a step in my task sequence to do it.

 

However, that then causes pain if you want to build in an environment without the proxy

 

Also, I've discovered at that stage the intune managmenet extension is installed and if there is a connection issue, it doesn't try to reinstall it.

 

Finally, it also seems that BITS doesn't try a second proxy server listed in a proxy.pac file if the first one is not responsive....

[free780]

Well I was using a transparent proxy at the gateway level. With AzureAD/Office365 domains whitelisted.

 

 

This has some useful information.

 

https://oofhours.com/2019/08/27/windows-autopilot-and-proxy-servers/

Edited January 24, 2020 by free780

[thesk8rjesus]

Another option for you to look at, which we suffer from is if you have Windows Hello enabled on the users and for us it's waiting for the user to finish that process first before InTune will finish correctly. We have to advise our users to press continue anyway, and then once windows is all happy it opens that screen back up.