Manually re-enrollment in Autopilot from License E3/E5 to P1/P2

Copper Contributor

 

Step 1: Delete stale scheduled tasks

Follow this procedure:

  • Run the Task Scheduler as an administrator.

KonLianos_0-1718712476435.png

 



  • Go to Task Scheduler Library > Microsoft Windows EnterpriseMgmt. Write down the enrollment ID somewhere, you will need it for the cleanup.

KonLianos_1-1718712476437.png

 



  • Delete all the existing tasks in the enrollment folder.

KonLianos_2-1718712476447.png

 



  • Delete the enrollment ID folder.

KonLianos_3-1718712476456.png

 

 

 

 

Step 2

  • Find and store the Object ID from Azure Portal.
  • Find and store a Serial number of the device from the Intune Portal.

KonLianos_4-1718712476465.png

 

 

 

 

  • Retire the device from Intune.

 

Step 3

Check the group tag on the computer's serial number and remove it if it exists.

 

 

Step 4

Delete object IDs from Entra ID. If you can’t delete it from the web interface, then run on your laptop PowerShell connect-azuread and Remove-AzureADDevice -objectid "XXXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"

 

 

Step 5

Run “dsregcmd /status”

Check if the device is not managed in The Entra ID and Intune portal.

In case AzureAdJoined remains YES, run the command “dsregcmd /leave” and delete the device from Intune.

KonLianos_5-1718712476466.png

 

 

KonLianos_6-1718712476466.png

 

 

Step 6

Add “dem_account” user at local admin group on the device (restart is needed)

Login as “dem_account”

Important: Check if the admin access exists until the end of the steps.

 



Step 7: delete stale registry keys

Use the previous enrollment ID to search the registry:

  • Open the Registry Editor as an administrator.

KonLianos_7-1718712476468.png

 



  • Search for the enrollment ID you wrote in the following locations, and if founddelete the key that contains the ID:
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\xxxxxxxxxxxxx
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\Status\xxxxxxxxxxxxx
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseResourceManager\Tracked\xxxxxxxxxxxxx
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\AdmxInstalled\xxxxxxxxxxxxx
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\xxxxxxxxxxxxx
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\xxxxxxxxxxxxx
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Logger\xxxxxxxxxxxxx
    • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\OMADM\Sessions\xxxxxxxxxxxxx

KonLianos_8-1718712476470.png

 



Step 8: delete the Intune enrollment certificate

Follow the procedure:

  • Search for the option “Manage computer certificates” or use the command certlm.msc as an administrator.

KonLianos_9-1718712476471.png

 



  • Go to Personal > Certificates and delete the certificate issued by either “Microsoft Intune MDM Device CA” or “SC_Online_Issuing” (depending on the date of the enrollment).

KonLianos_10-1718712476474.png

 



Step 9: Restart the enrollment process

In case the device is autopilot, we must delete the file c:\windows\servicestate\wmansvc\AutopilotDDSZTDFile.json before we continue.

The enrollment command must be entered in a SYSTEM context to be properly executed. We will use the PSExec tool for that purpose.



  • Use PSExec to launch a Command Prompt as SYSTEM ADMINISTRATOR:

psexec /i /s cmd



  • In the Command Prompt, enter one of the following commands depending on your enrollment type:



Windows 10 / Windows 11 Enterprise (using User Credential)

%windir%\system32\deviceenroller.exe /c /AutoEnrollMDM

 



  • In the computer certificate store, check that a new Intune certificate has been enrolled for the device:

KonLianos_11-1718712476479.png

 



 

  • Execute gpupdate/force.

 

  • Restart the Device.

 

mdm URL  https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc

Important: Check if the admin access on the user “dem_user” exists before enrolling.

 

 

 

KonLianos_12-1718712476481.png

 

 

 

 

 

Step 10

 

  • Download the company portal and log in with the “demmng_Cenergy” user.
  • Check in the Intune portal if the device is managed.

KonLianos_13-1718712476482.png

 

 

 

KonLianos_14-1718712476484.png

 

 

 

**Important info: Remove the old License E3/E5 from the user.

 

 

0 Replies