Cannot Reseal Windows 11 device while pre-provisioning

[Oktay Sari]

Before I reinvent the wheel, I thought I’ll post the issue here. I have a AP profile configured as below.

Deployment mode                               User-Driven

Join to Azure AD as                              Azure AD joined

Language (Region)                               Dutch (Netherlands)

Automatically configure keyboard   Yes ( In know.. please read on)

Microsoft Software License Terms        Hide

Privacy settings                                     Hide

Hide change account options               Hide

User account type                                 Standard

Allow pre-provisioned deployment  Yes

Apply device name template                Yes

Enter a name                                         XXXX-%SERIAL%

I know I’ve set the auto keyboard to yes, but here me out. As far as I understood the previously known issue is fixed in Windows 11. Windows Autopilot for pre-provisioned deployment | Microsoft Docs

In Windows 10, version 2004 and later, if the Autopilot deployment profile Language/Region setting is not set to User Select, then OOBE will progress past the language/region/keyboard selection screens. This causes the pre-provisioning technician to arrive at the Azure AD login page, which is too late to enter pre-provisioning. This issue is fixed in Windows 11.

For the pre-provisioning part:

On Windows 10 21H2 (10.0.19044.1645) I can pre-provision the device successfully. The technician flow completes and I have a green screen giving me the option to reseal. After reboot, the normal user flow follows, and the device is ready to go before you know. AAD joined and MDM enrolled with user affinity.

However, on Windows 11 (10.0.22000.675) the technician flow starts OK. I’m presented with the AP profile that is selected, and I can continue pre-provisioning. But it never shows me the green screen and I’m not able to reseal the device. It also does not show any errors what so ever during pre-provisioning. The device simply reboots and ends up at the login screen. The user flow does not seem to start and from the login screen, I’m also not able to sign-in with any account.

At this stage, I checked the device in the AP portal. The interesting thing is, that the device seems to be AAD joined and MDM enrolled. And as expected, there is no primary user yet in Intune.

So I looked up the device in Azure AD and confirmed it is AAD joined. Although I don’t believe the info presented. I also looked up the device in MEM/Intune and collected the diagnostics logs from the device.

Still in the process of diving into the logfiles but here are some of my findings:

intunemanagementextension.log shows some interesting things:

• GetAADJoinInfo - Failed to get Azure AD Join information using NetGetAadJoinInformation
• ![LOG[AAD User check using device check in app is failed, now fallback to the Graph audience. ex = Intune Management Extension Error.Exception: Microsoft.Management.Services.IntuneWindowsAgent.AgentCommon.TokenAquireException: Attempt to get token, but failed.

The User Device Registration event log is playing tricks on me. Here are some of the events from the log

• The get jAccount S-1-12-1-xxx-xxx was added to group Administrators.oin response operation callback was successful.
• The post join tasks for the AAD Authentication Package completed successfully.
• The registration status has been successfully flushed to disk.
  • Join type: 11 (DEVICE_AUTO_DDID)
• The complete join response operation was successful.
• The task \Microsoft\Windows\Workplace Join\Device-Sync was successfully enabled.
• The initialization of the join request was successful. Inputs:
  •  JoinRequest: 8 (DEVICE_UNJOIN)
•             Domain:xxx.onmicrosoft.com

If I had to guess, I’d say the device is AAD joined and MDM enrolled at first, but for some reason, it unjoins the device in AAD which explains the fact that I cannot sign-in with a AAD User account. The device however remains MDM enrolled.

What is going on here?

I will test the same setup with auto configure keyboards set to No and see what happens. But the fact that I can get to the pre-provisioning screen, see the selected AP profile and reseal the device with W10 tells me (or at least it looks like) this should work. 

Anyone else having the same experience with Windows 11?

Hope this makes some sense. Thx in advance!

Oktay

[#2]

@Rudy_Ooms_MVP I tested by removing the regkey ./Device/Vendor/MSFT/Policy/Config/DmaGuard/DeviceEnumerationPolicy and have succesfully arrived at reseal screen. Obviously this is not a full time solution, but an easy workaround. I have updated my Microsoft Case # with this information. Thank you for your blog on that. 

[#3]

Today I saw a bitlocker recovery on a Surface Latop 4 (AMD). There was a event id 4122: "The following DMA capable devices are not declared as protected from external acces,, which can block features such as BitLocker automatic drive encryption:..."
And only the Surfaces 4 (AMD) had the Pre Prov issues.

[#4]

@BH

Hi,

We are facing same problems.

How can you remove that regkey from the client machine?

When I'm opening regedit in client machine (before going to pre-provisioning) i cannot remove or edit anything under HKLM\Software\Microsoft\Provisioning\SyncML\RebootRequiredURIs 

[#5]

before you install the image, You will need to mount your image file with Dism and then load the registry hive and take ownership of the permissions. Rudy has a very good step by step explanation in his blog: https://call4cloud.nl/2022/04/dont-be-a-menace-to-autopilot-while-configuring-your-wufb-in-the-hood/

[#6]

Wooop Wooop :)

[#7]

Update on this saga. I successfully resealed a couple of Windows 11 devices, but now the issue has returned - same thing -  device reboots and does not return to reseal screen, Very weird.

Microsoft have notified me that they are still reviewing the diag logs I sent them.

What I dont understand is how come Microsoft have not announced a "Health notification - under investigation" on this issue as they usually do in ther service alerts. Are we in this forum the only few actually pre-provisioning Windows 11?

[#8]

Another Update. Microsoft got back to me and are achiving my support ticket. This issue is under "High Level" investigation by MS Engineers and as soon as a solution is available, I will be notified. In the meanwhile there are no further troubleshooting options available and either I autopilot enroll windows 11 devices without pre-provisioning or go back to Windows 10. My query as to why this is not noted as an "outage" on the admin portal, was not answered.

[#9]

Did some testing today with the new OS build released on the 9th of August (22000.856). I repeatedly did pre-provision a device successful without removing the DMA Guard required reboot registry key. I'm consequently getting the reseal button. Tomorow I will test it a couple of time more, I will keep you posted about the results.

[#10]

I believe that is teh same version that I tested (21h2.9). (Nope - I just checked I have 22000.795, unless yours updated with latest CU Update as my primary laptop is on the .895 version as well). I will downlaod again next week and check again.

Strange thing is on certain CPU model devices (Lenovo X1 9th gen), it works fine, other models (Lenovo T14 / P14s / X1 6th gen) it fails. Are your devices Intel or AMD?

[#11]

@BH all Intel devices here, will check the generation tomorrow! 

[#12]

Just checked the CPU generation, all devices are 11th generation.

[#13]

Any updates on this issue? My Microsoft support ticket was archived and was told that Microsoft is aware and working on the issue, but in the meanwhile I cannot pre-provision Windows 11. 

[#14]

Just switch to user targetting instead of devices… (as example the wufb) but also other policies could reboot the device during prepro… just wondering but did you also tested an insider preview build?

[#15]

I have not tested any insider build yet. I did test excluding a group of dynamic devices from some of the policies, including wufb. It works once and then starts failing again. I was on a meeting this morning with our TAM and raised this again. Will see if that takes us anywhere.

I see tthere is now an updated Windows 11 ( August 2022, 21h2.10) version. I am downlaoding the ISO now and will test and report.

[#16]

In the past I heard a alot of issues when using a dynamic device group... could you test the same flow with a static group or a group based on users?

[#17]

Just completed a succesful pre-provision using the latest ISO 22000.856 as also mentioned by @jebuz.
I will do some other device testing in the office tomorrow - just received a new batch of 30 devices, so have some work to do.

[#18]

Currently there are mysterious Win32 app install errors during Pre Prov:
Error downloading content. (0x87D30068)

[#19]

@BH After seeing this post I updated my Windows 11 deployments to 22000.856 and have a 100% success rate of pre-provisioning and resealing since. Thanks!

[#20]

I can confirm that this latest ISO is now completing pre-provisioning on all my device models with 100% reseal functionality.

[#21]

It is... as mentioned in part 8 of the WUFB blog

https://call4cloud.nl/2022/04/dont-be-a-menace-to-autopilot-while-configuring-your-wufb-in-the-hood/...