Intune Help

[newpersn]

Hi,

 

Thought i would start my own topic rather then jumping on someone elses.... (Sorry)....

 

Ive been playing around with this and would like to roll this out after Christmas to some pupil devices that are coming in and back out again...

 

I have managed to setup the basics but need help. (Yes i'm admitting i need help)

 

I have a test laptop next to me that i have been using to test this.

 

I have installed Windows and at the OOBE screen and used the powershell script that joins Autopilot. I have removed the assigned test user from the device and now when starting it asking for Microsoft Account information (with the option to join domain wich i dont want)

 

How do i get past this point?

 

Thanks in advance.

[newpersn]

Thats annoying. I get this in Devices

 

I get this in Autopilot Devices.

 

[snagrat]

I’m working on the theory you have blanked out the serial and it’s not just showing as blank?

[newpersn]

I’m working on the theory you have blanked out the serial and it’s not just showing as blank?

 

Yes - I blanked the Seral Number. Yes its showing there. But not in Devices.

 

- - - Updated - - -

 

If you login to the test laptop with that test user does the device appear in devices rather/as well as Autopilot Devices?

 

Nope, Just showing the Autopilot not Devices...

[newpersn]

In Autopilot what do you see when you view the info panel? (When you click on the device the thing on the right opens)

 

 

That panel?

[newpersn]

That's the one. By the looks of it it doesn't look like its finished/started its enrollment process (See "Enrollment State"). Ours show as "Enrollment state: Enrolled" and have a associated Intune device for comparison.

 

In the Azure Portal, under your org's Azure Active Directory, Devices and then Device Settings (This link may work: https://portal.azure.com/#blade/Microsoft_AAD_Devices/DevicesMenuBlade/DeviceSettings/menuId/) where it says "Users may join devices to Azure AD" which users are listed, is that test user one of them?

 

All is currently selected on that screen. May leave the laptop on for abit and see what happens.

[newpersn]

On this page (https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) (Azure Portal > Azure AD > Mobility (MDM and MAM) > Microsoft Intune) does MDM user scope and MAM user scope show "All"?

 

 

Yep. Both set to All.

 

I did have some with a group created with the laptop in the group.

[newpersn]

Interesting... Looked tonight at Intune, Clicked on the AutoPilot device and clicked on Manage and i get a error at the top right hand corner of the screen?

 

[newpersn]

Is it worth me deleting the device from Intune and Azure and reinstalling Windows?

[newpersn]

From the looks of it your setup seems to be pretty much which we have running here on our test PCs. As you mentioned I'd give deleting every trace of it and re-adding it a go (with a reinstall of windows). If you aren't already try the latest version of Windows, I think they sometimes have AutoPilot improvements in the latest builds

 

Think i have broke it somewhere now....

 

[newpersn]

Think i have broke it somewhere now....

 

[ATTACH=CONFIG]60137[/ATTACH]

 

scrap that.

 

Now getting this message....

 

[newpersn]

I have a USB stick with 2 files, the below and Upload-WindowsAutopilotDeviceInfo.ps1

 

https://pastebin.com/raw/W5yPRqvH

 

Try running the above script and seeing if that enrolls it?

 

I did that already - I can see the laptop back on Autopilot but not having much luck there. I think it may be a TPM issue as its currently running 1.2.

[newpersn]

If I remember correctly you only need TPM 2 or above if you use White Glove deployment, user-driven deployment does not require this?

 

I have just updated the firmware for the TPM to 2 now.

 

Just trying again now..

[computer_expert]

You don't need TPM for autopilot (only white glove as mentioned above). I have several machines without TPM and they work fine when deployed via autopilot.

 

When it fails, hit Shift+F10, type

MDMDiagnosticsTool.exe -area Autopilot;TPM -cab c:\autopilot.cab

and grab the cab file. Some logs are best opened in CMTrace. There's descriptions of the various log files here

 

Do you have any web filters performing HTTPS interception? are you able to try on an unfiltered connection?

[newpersn]

You don't need TPM for autopilot (only white glove as mentioned above). I have several machines without TPM and they work fine when deployed via autopilot.

 

When it fails, hit Shift+F10, type

MDMDiagnosticsTool.exe -area Autopilot;TPM -cab c:\autopilot.cab

and grab the cab file. Some logs are best opened in CMTrace. There's descriptions of the various log files here

 

Do you have any web filters performing HTTPS interception? are you able to try on an unfiltered connection?

 

I have tired over my 4g connection on my phone and I've allowed the IP address out. Still the same issue.

 

I have it set to deploy office 365. Will this effect it?

[computer_expert]

Are you able to try autopilot on a hyper-v vm just out of interest to see if it's an issue with the hardware you are using?

 

Office 365 shouldn't affect the process as it hasn't even got to the installing apps stage yet.

 

 

Have you set up a dynamic azure AD group to target all autopilot devices? https://docs.microsoft.com/en-us/mem/autopilot/enrollment-autopilot#create-an-autopilot-device-group-using-intune

 

Also see the 'Alerts for Windows Autopilot unassigned devices' section on the same page to see if you have assigned an autopilot profile to the device. If you don't have an autopilot profile assigned, create the autopilot group, and finally assign a profile to the new group.

Edited December 10, 2020 by computer_expert

[newpersn]

Are you able to try autopilot on a hyper-v vm just out of interest to see if it's an issue with the hardware you are using?

 

Office 365 shouldn't affect the process as it hasn't even got to the installing apps stage yet.

 

 

Have you set up a dynamic azure AD group to target all autopilot devices? https://docs.microsoft.com/en-us/mem/autopilot/enrollment-autopilot#create-an-autopilot-device-group-using-intune

 

Also see the 'Alerts for Windows Autopilot unassigned devices' section on the same page to see if you have assigned an autopilot profile to the device. If you don't have an autopilot profile assigned, create the autopilot group, and finally assign a profile to the new group.

 

Did that.

 

The laptop shows up in Endpoint Manager > Windows Devices. I've clicked on Autopilot reset and the laptop has started resetting. (Black screen with Resettings this PC ##) so i think its not a network issue.

[newpersn]

Did that.

 

The laptop shows up in Endpoint Manager > Windows Devices. I've clicked on Autopilot reset and the laptop has started resetting. (Black screen with Resettings this PC ##) so i think its not a network issue.

 

Well i left it for half an hour and it seems to have worked. Came back to the login screen.

 

Now to change policy's and start locking it down.

 

Anyone willing to share there policys?

[computer_expert]

The NCSC site is down for maintenance now but there are some reference policies here

 

Set the default domain to save typing the full email address in. Link

 

Not all GPO settings appear in intune so it may be a case of applying the registry value via powershell instead.