Join Log in
Score:0
metrotyranno avatar Server

Autopilot Self-Provisioning fail

jp flag
metrotyranno

I'm working on an intune environment. Devices are able to successfully join in user attended mode. However when I set it to self-deploy devices fail on securing hardware with the following code: 0x800705b4. This code seems related to the TPM timing out. Autopilot passes this stage instantly in the user attended mode.

I prepare the devices using a PXE WinPE setup and copying the autopilot configuration json to the device. This pairs it to intune during OOBE, I do not add the hash to intune, it does it for me during setup. The PXE script I'm using also upgrades the bios and TPM firmware before it installs windows. So the bios & TPM firmware are up-to-date during OOBE.

I have tried the following:

Ensure the time on the device is correct by setting up an NTP server on the mikrotik router and passing the NTP servers option in DHCP.

Disabled all firewall rules in the Mikrotik, it is only providing natting.

I tried multiple models of devices (HP Elitebook 850 G3, HP Elitebook 840 G3, HP Elitebook 840 G4, HP Elitedesk 800 G2, HP Prodesk 400 G3) All have the same issue.

I'm using unattend.xml to ensure the EULA is accepted.

Intune device licenses are available and assigned to the security group these devices are dynamically put into.

I have checked to ensure BIOS and TPM firmware are on the latest version available.

I'm aware that the feature is in preview state, but it beats having to manually enter credentials into 200 devices during setup. (After that the devices go into kiosk mode, no login necessary)

Can anyone give me some pointers on what I might try next?

Cheers!

-Metro

461
0 + 0
Score:0
avatar Server
tr flag
Nathan Hartley

The TPM environment on many HPs require a certificate to be installed. This normally happens during the default HP Out-Of-Box-Experience.

We have switched to purchasing "Autopilot Ready" Dells, but my notes show that we have solved this problem with these HPs in 3 ways:

  1. Boot into the stock (bloatware) copy of Windows from HP and waited for the HP updates to apply. Once applied, it is safe to lay down a clean copy of Windows.
  2. Boot into a clean copy of Windows, install and run HP Support Assistant. Then reset the PC.
  3. From the OOBE Shift-F10 command prompt, run the HP BIOS Update tool and HP TPM Configuration tool.
0 + 0
metrotyranno avatar
jp flag
metrotyranno
Hi, Thanks for your reply. I've tried installing the hp support assistant prior to the securing hardware stage to no avail, it still times out. The bios and tpm firmware are on the latest version. In the user driven mode the laptop is able to join, in self-provision it is not.
0
Reply
tr flag
Nathan Hartley
See if the TPM statuses are "Ready" in Windows, or, at the start of OOBE; Shift-F10, Powershell, Get-Tpm
0
Reply
tr flag
Nathan Hartley
Also see https://docs.microsoft.com/en-us/mem/autopilot/known-issues and https://oofhours.com/2019/07/09/tpm-attestation-what-can-possibly-go-wrong/
0
Reply
tr flag
Nathan Hartley
TPM attestation will also fail due to the time being too far off on the PC. w32tm /resync /force to sync
0
Reply
metrotyranno avatar
jp flag
metrotyranno
Tpm is not ready for attestation, tpm is not capable for attestation. When I do a clean install using a win10 usb & manually progress through the installer both values are true. When I install it using my pxe server with dism /applyimage /applylocation both are false.
0
Reply
tr flag
Nathan Hartley
Sidebar: If you are using Autopilot, it is meant to start from a clean copy of Windows 10/11, installed with the default drive partitions. We are moving away from ConfigMgr. When we first started with Intune, we used USB drives, created with the Windows Media Creation Tool, until I figured out how to make a Task Sequence that creates the proper partitions, removes the AutoAttend.xml and does NOT install the ConfigMgr client.
0
Reply
metrotyranno avatar
jp flag
metrotyranno
I'm not using the config manager. I'm also using a clean copy during install. I've changed the attend.xml file so that it creates the partitions instead of my winpe script, maybe that'll have some effect. I think it might be related to the EULA. I join the devices to intune by writing the autopilotconfigfile.json to the device after clean installation from winpe
0
Reply
tr flag
Nathan Hartley
You will have problems with Self-Deployment, until you can make the TPM happy. ... I've never had to work with attend.xml files and WinePE. We just install a clean copy of Windows, after deleting previous partitions and let to go. The EULA is configurable via the Autopilot Deployement Profile. https://docs.microsoft.com/en-us/mem/autopilot/profiles#create-an-autopilot-deployment-profile Note, hiding the privacy settings causes Windows to act like the user did not agree to share anything.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.