Most Autopilot enrollment failures follow a predictable pattern. The device sits at OOBE, throws an error code, and the temptation is to rebuild. Before you do that — this guide walks through every layer systematically, from hardware through to log analysis, so you find the actual root cause rather than masking it with a rebuild.

Everything in this post is verified against Microsoft's official Autopilot documentation. Where error codes and log paths are referenced, they come directly from Microsoft's published troubleshooting guidance.

Start here — collect device state before touching anything

Before stepping through the checklist, run two commands that give you the full picture of the device's current state. These are the commands Microsoft support will ask for first.

1. Hardware hash and Autopilot registration status — requires the Get-WindowsAutopilotInfo script published by Michael Niehaus (Microsoft) on the PowerShell Gallery:

# Install the script from PowerShell Gallery (run as Administrator)
Install-Script -Name Get-WindowsAutopilotInfo -Force

# Export hardware hash to CSV
Get-WindowsAutopilotInfo -OutputFile "C:\AutopilotHash.csv"

2. Device join and MDM enrolment state — built-in Windows command, no installation required:

# Run from command prompt or PowerShell — no elevation needed
dsregcmd /status

Key fields to check in the dsregcmd /status output:

1 Verify hardware requirements

Microsoft requires the following for all Autopilot scenarios. These are non-negotiable — if any are missing, the enrolment will fail regardless of profile or network configuration.

• ✓TPM 2.0 is present and functional. TPM 1.2 is not supported. Confirm in Device Manager → Security Devices, or run Get-Tpm in PowerShell and verify TpmPresent: True and TpmReady: True.
• ✓Secure Boot is enabled. Check in BIOS/UEFI, or run Confirm-SecureBootUEFI in PowerShell — returns True if enabled. Required for User-Driven and Self-Deploying modes.
• ✓Hardware hash imported to Autopilot service. The device's hardware hash (4K hash) must exist in your Autopilot device list before OOBE starts. Devices not in the service will fail with 0x80180014.
• ✓Windows 10 1903 or later (Windows 11 recommended). Autopilot Self-Deploying requires 1903+; Pre-Provisioning requires 1903+. User-Driven supports earlier builds but Microsoft recommends current releases.

# TPM status
Get-Tpm

# Secure Boot status — returns True if enabled, False if disabled, error if Legacy BIOS
Confirm-SecureBootUEFI

# Check Autopilot registry key — populated after successful profile download
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Provisioning\AutoPilot"

2 Confirm device is in the Autopilot service

The device must be registered in your Autopilot tenant before it reaches OOBE. Registration happens via hardware hash import — either manually via CSV, automatically via OEM direct enrolment, or via Configuration Manager co-management.

Check in the Intune admin center: Devices → Enrolment → Windows → Windows Autopilot devices. Search by serial number or hardware hash. The device should appear with a profile status.

If the device is not listed, import the hash. If it is listed but shows Not assigned for the profile, move to Step 3.

3 Verify deployment profile assignment

A device in the Autopilot service still needs a deployment profile assigned before it will receive the Autopilot OOBE experience. Profile assignment in Intune is group-based — the device or user must be a member of a group that the profile targets.

• ✓Profile status must show “Assigned” in the Autopilot device list. “Not assigned” means the device is not in a targeted group, or the group has not yet synced.
• ✓Check group membership. Autopilot profiles target Entra ID groups. Confirm the device object (for device-targeted groups) or the expected user (for user-targeted groups) is in the correct group.
• ✓Dynamic group rules. If using dynamic membership (e.g. device.devicePhysicalIds -any _ -contains "[ZTDId]"), verify the rule has evaluated and the device appears in group membership. Dynamic group evaluation can take up to 24 hours for large tenants.
• ✓OOBE deployment mode matches the profile. A device booted in Self-Deploying mode will fail if the profile is configured for User-Driven, and vice versa.

4 Validate network connectivity

Autopilot requires internet access from the moment OOBE begins. If the device cannot reach Microsoft endpoints, the profile download fails silently and the device falls through to a standard setup experience or throws a network error code.

The following endpoints must be reachable from the device at OOBE — verified against Microsoft's Autopilot networking requirements documentation:

To test connectivity from the OOBE environment (Shift+F10 to open a command prompt at OOBE):

# Test DNS resolution and connectivity to key Autopilot endpoints
ping login.microsoftonline.com
ping ztd.dds.microsoft.com
ping enrollment.manage.microsoft.com

# Check if a proxy is configured at system level
netsh winhttp show proxy

5 OOBE error codes

When Autopilot fails during OOBE, it surfaces a hex error code. The following are the most common codes and their confirmed meanings from Microsoft's OOBE troubleshooting documentation:

6 Log file locations

When error codes alone are not enough, the log files provide the detail. These paths are verified against Microsoft's Autopilot troubleshooting documentation.

Event Viewer path for MDM / Autopilot events:

Applications and Services Logs → Microsoft → Windows → DeviceManagement-Enterprise-Diagnostics-Provider

Filter for Event IDs in the 1000–1999 range for MDM enrolment events, and 70000+ for Autopilot-specific events.

The fastest way to collect all Autopilot diagnostic data in one step:

# Export full Autopilot diagnostics to a CAB file (run as Administrator)
mdmdiagnosticstool.exe -area Autopilot -cab "C:\AutopilotDiag.cab"

# Extract and review
Expand-Archive -Path "C:\AutopilotDiag.cab" -DestinationPath "C:\AutopilotDiag\"

Root cause summary

Troubleshooting checklist

• ✓Run Get-WindowsAutopilotInfo and dsregcmd /status before making any changes
• ✓Confirm TPM 2.0 is present (Get-Tpm) and Secure Boot is enabled (Confirm-SecureBootUEFI)
• ✓Verify device appears in Autopilot service with profile status Assigned
• ✓Confirm device or user is in the group targeted by the Autopilot profile
• ✓Test network connectivity to all required Microsoft endpoints from the device at OOBE (Shift+F10)
• ✓If on a corporate network, confirm SSL inspection is bypassed for Autopilot endpoints
• ✓Note the exact error code shown in OOBE and cross-reference against the table above
• ✓Run mdmdiagnosticstool.exe -area Autopilot for a full diagnostic export
• ✓Review C:\ProgramData\Microsoft\Provisioning\Logs\ for profile download and CSP provisioning detail
• !If clearing the TPM — back up all BitLocker recovery keys to Entra ID or AD first