Hi @Rudy_Ooms_MVP, Yes, I'm using WUfB but I do target user groups. I have 3 rings configured. Ring 3 is targeting all users and I excluded users from ring 1 and ring 2. The servicing channel is GAC. the only difference in rings is the deferral period.
The ESP is configured like below and targeting a device group:
I did have a look at the event logs and searched for CloudExperienceHostBroker like you mention in your blog. You did some great troubleshooting there! There are also some other events that caught my attention but I still have to look at other logs just to satisfy my curiosity.
Guess I'll have to dig in a little deeper and see if I can solve this like you did in your blog, assuming WufB is the root cause. Event reasons like update/upgrade do make you wonder. Although I thought I was on the latest build before starting pre-provisioning. I'll doublecheck that too.
I re-enrolled the devices without pre-provisioning because that worked before, and after deleting the device record in MEM, I was able to reset the device and enroll again without pre-provisioning. So I'll have to make some config changes in my test tenant and see what works.
Thx again Rudy! I'll try to get back asap 😉
LoL..Everybody knows what opnieuw opstarten means right? 😉
Event 1:
The process C:\Windows\system32\winlogon.exe (DESKTOP-HTHM3BU) has initiated the uitschakelen of computer DESKTOP-HTHM3BU on behalf of user NT AUTHORITY\SYSTEM for the following reason: Er is geen titel voor deze reden gevonden (=there is no title for this event)
Reason Code: 0x500ff
Shutdown Type: uitschakelen (=shutdown)
Comment:
Event 2:
The process C:\Windows\system32\winlogon.exe (MINWINPC) has initiated the opnieuw opstarten of computer WIN-T70I1KVU8HQ on behalf of user NT AUTHORITY\SYSTEM for the following reason: Besturingssysteem: upgrade (gepland)
Reason Code: 0x80020003
Shutdown Type: opnieuw opstarten (=reboot)
Comment:
Event 3:
The process C:\Windows\System32\CloudExperienceHostBroker.exe (WIN-T70I1KVU8HQ) has initiated the opnieuw opstarten of computer DESKTOP-HTHM3BU on behalf of user NT AUTHORITY\SYSTEM for the following reason: Besturingssysteem: nieuwe configuratie (niet gepland)
Reason Code: 0x20004
Shutdown Type: opnieuw opstarten (=reboot)
Comment:
Event 4:
The server could not bind to the transport \Device\NetBT_Tcpip_{} because another computer on the network has the same name. The server could not start.
LoL, I was thinking the same thing and checked the MDE security baseline.
Who said troubleshooting is boring? 😄
As far as I know, there shouldn't be any other policies but I'll check those too.
Haha.. those 2 will/could trigger an unexpected reboot
Wondering what happens when you change that settings/remove that dmaguard setting
@Rudy_Ooms_MVP , @Bruce S So now I have 2 devices to test with. 1 device that is just not able to download a profile what so ever (Windows 11) and another device, that will download a profile but the reseal option is not shown. That is how this threat started. Here's one final update:
The device that could not reseal:
First I tried to set the DMA and credential guard settings in the MDE security baseline to Not Configured on at a time and re-enrolled using pre-provisioning. That did not work. the Reseal option was still not showing. I ended up at the login screen like before. Strange enough though, when I reset the device from Intune, it would end up in the user flow like it would, after resealing.
I ended up with removing every policy assignment I had except for the update rings targeting users and still no reseal option.
Then I deleted the following registry key:
HKLM:\SOFTWARE\Microsoft\Provisioning\SyncML\RebootRequiredURIs\ManagePreviewBuild
started pre-provisioning again, and yes! A nice reseal button!
I'm somewhat disappointed that pre-provisioning is not working out of the box with Windows 11 and hope this will be fixed sometime soon.
Then for the device that can't find/load a profile:
@Rudy_Ooms_MVP I did a fiddler trace and that one gave me a nice 807 - ZtdDeviceIsNotRegistered
The error description: The device being deleted or configured does not exist in the service.
@Michael Niehaus has a nice table on his blog explaining what might be the cause: This would typically only happen if Intune and the Windows Autopilot deployment service are out of sync (e.g. you removed a device from Microsoft Store for Business, and then tried to remove it via Intune before Intune had noticed it disappeared).
Off-course I checked the store, made sure all is in-sync, waited a long long time, deleted every trace I could find for this device, re-installed windows 10, and still no luck here. It really seems like this device is no longer able to pre-provision.
So I'm trying to enroll the device without pre-provisioning and then I see a nice "How would you like to set up?" question.. LoL @Rudy_Ooms_MVP I ended up at your blog again.
Up until now, I uploaded the hash using PowerShell -online from the OOBE. so I decided to give it one last try and upload the CSV manually. Still no luck... I did manage to collect the logs from the device again and will try to dive in again, but for today, I'm feeling beet-up by Autopilot 😄