Intune (new school)

[Simcfc73]

Hi,

 

I've just started a new job which has all its intunes setup already by an external company. I'm slowly getting my head round it but the laptops we've had delivered are all failing when it gets to the device setup security policy phase.. they just pause permanently until I kill it. I've tri e to find some audit logs but alcant find any. The continue anyway button is there but if I click it then they go straight to a username and password prompt which I don't know what it is.

 

Long shot but anyone got any ideas?

 

They are setup to autoenrol... They are on intune in autopilot and the device is listed (they were prepped off site).

 

 

[Alex0x7F]

Hi @Simcfc73 it’s your Enrollment Status Page (ESP) getting stuck on a required policy or application during the Device setup phase. When I had this issue it was the enforced BitLocker policy that kept failing to apply, but it could also be a different security baseline for yourself. To find the error, while it’s on the hanging screen press Shift + F10 to open Command Prompt, then run mdmdiagnosticstool.exe -out C:\logs\ and export the logs to a USB drive. You could also create a temporary ESP profile that doesn’t block device use and assign it to a test build machine; if that build completes, you’ll know one of your required items is failing. In my case, I removed BitLocker as a required item for Autopilot and set up an Entra group that enforces BitLocker encryption, and add the device in after it's built. That “login anyway” prompt you see after clicking Continue means the device is only half-provisioned. it’s Azure AD joined, but user setup failed/didn't complete so there’s no profile to log into. This prompt can also be disabled so the device is forced to fully provision, or will time out if there's still an issue. 

Hopefully the logs will point you to the root cause of the issue, let us know how it goes!

[nicholab]

Also, is your web filtering or DNS security stopping the laptop from connecting to the internet?  Are they pure entra or hybrid joined?

[Simcfc73]

13 hours ago, essential_alex said:

Hi @Simcfc73 it’s your Enrollment Status Page (ESP) getting stuck on a required policy or application during the Device setup phase. When I had this issue it was the enforced BitLocker policy that kept failing to apply, but it could also be a different security baseline for yourself. To find the error, while it’s on the hanging screen press Shift + F10 to open Command Prompt, then run mdmdiagnosticstool.exe -out C:\logs\ and export the logs to a USB drive. You could also create a temporary ESP profile that doesn’t block device use and assign it to a test build machine; if that build completes, you’ll know one of your required items is failing. In my case, I removed BitLocker as a required item for Autopilot and set up an Entra group that enforces BitLocker encryption, and add the device in after it's built. That “login anyway” prompt you see after clicking Continue means the device is only half-provisioned. it’s Azure AD joined, but user setup failed/didn't complete so there’s no profile to log into. This prompt can also be disabled so the device is forced to fully provision, or will time out if there's still an issue. 

Hopefully the logs will point you to the root cause of the issue, let us know how it goes!

 

Thanks for this. Bitlocker it might be. I removed the group from policy and have tried 3x but its still failing. Might not have waited long enough

 

 

BitLocker CSP: TPM not used for protection of OS Drives, but is required by policy. FveStatus 0x3006421

 

These were setup externally so I am doing a OOBE run but the event logs date back to them

Edited August 27, 2025 by Simcfc73

[Simcfc73]

Stuck at this step again.