Windows 11 Fresh Start Problems on Intune

[talksr]

Not sure if anyone else has had this issue, but if I Fresh Start an Intune Windows 11 system, it resets, asks if it is ok to clear the TPM, then asks user to log in as usual (we use user-driven Entra Hybrid join), it has a think, and then shows the following error: 

Quote
Something went wrong.
Confirm you are using the correct sign in information and that your organization uses this feature. You can try to do this again or contact your system administrator with the error code 80070774.
 

If I run CMD, I can see it is able to ping, so it has a connection to the internet. 
There is a great Test Device Connectivity PS script online. I have tried this and can see everything worked as expected so I know 100% there are no connectivity issues: 

 

 
If I run, dsregcmd.exe /status, I see the following, where it is clear it hasn't joined Azure. 

 

 

I have attempted this on a few systems, and I am getting the same problem. If I try and re-join the system to the tenancy using ps and get-windowsautopilotinfo.ps1 -online, it comes back saying error 806 ZtDeviceAlreadyAssigned.

Does anyone know what could be causing this? We are cloud only, nothing on prem here.

[foofighterjim]

I may have misunderstood, but if you are cloud only, why are you using user-driven Entra Hybrid join? This implies that there is a local AD for the device to connect to, unless you have also selected to skip AD connectivity check as part of the deployment profile (not sure why you would do that though)?

[talksr]

1 hour ago, foofighterjim said:

I may have misunderstood, but if you are cloud only, why are you using user-driven Entra Hybrid join? This implies that there is a local AD for the device to connect to, unless you have also selected to skip AD connectivity check as part of the deployment profile (not sure why you would do that though)?

 

No, you’re right. We were planning to have an on-prem server but this site uses LGfL which then syncs USOs to Microsoft. The on prem server had it’s own AD with a lot of users, we were quite concerned that adding an on-prem could have caused a lot of sync issues for accounts, so we left the server and it is just servicing DNS and DHCP now. In the last holiday, we converted the final bulk set of systems from AD to Cloud, we have just three systems left using AD so the plan now is to just stick with cloud. I didn’t think that leaving hybrid enabled would cause any issues as this has been in place since the tenancy was first set up. 

 

I think I better check if it is skipping the local AD connectivity check in the deployment but I would assume so as if it is a fresh system without a hash pre-loaded, we have never encountered any issues with opening PowerShell on setup screen and joining it to tenancy, then signing in on the setup screen. It only seems to be an issue if you have already done that and then at a later date do a Fresh Start. 

[foofighterjim]

On 19/05/2025 at 10:35, talksr said:

I think I better check if it is skipping the local AD connectivity check in the deployment but I would assume so as if it is a fresh system without a hash pre-loaded, we have never encountered any issues with opening PowerShell on setup screen and joining it to tenancy, then signing in on the setup screen. It only seems to be an issue if you have already done that and then at a later date do a Fresh Start. 

 

Did you get anywhere with this? the quote above would make me question if the hybrid join was a red herring.

[talksr]

50 minutes ago, foofighterjim said:

 

Did you get anywhere with this? the quote above would make me question if the hybrid join was a red herring.

 

I am afraid no progress this end. I am making sure I don't do any further Fresh Starts on any systems as this issue seems to happen on any system if it has a Fresh Start. 

The only solution I would expect at the moment, is to find the system in Entra, totally get rid of it, then re-join it to the tenancy which is a real pain and not got the time for that. 

[foofighterjim]

Have you tried one of the other methods that are also supposed to keep the enrollment i.e. Autopilot Reset instead?