Autopilot Reset, Wipe, or Fresh Start: Which One Actually Does What You Want

A device needs to go back to a clean state for the next user. Intune offers you Autopilot Reset, Wipe, and Fresh Start. They sound interchangeable, they are not, and picking the wrong one either leaves data behind or costs you a day of redeployment time. There is also a limitation that catches a lot of hybrid environments completely off guard - and it is the reason this post exists.

The problem: three actions that all sound the same

The symptoms of choosing wrong are predictable and annoying:

• You run Autopilot Reset on a hybrid joined device and it fails, or behaves unexpectedly - because it is not supported there at all.
• You run Autopilot Reset and it fails immediately with 0x80070032, which is ERROR_NOT_SUPPORTED and actually means WinRE is not enabled.
• You expect the local CTRL + WIN + R reset to work and nothing happens, because it is disabled by default and needs a policy.
• You wipe a hybrid device for a same-day redeployment and discover it may take up to 24 hours before it can be deployed again.
• You use Fresh Start expecting a clean device and the user's Home folder is still there, because the retain-data option was left on.

Why it happens: they operate at different layers

Each action is doing a genuinely different job.

Autopilot Reset is designed for device turnover inside a managed estate. It removes personal files, apps and settings, reapplies the device's original configuration, and resets region, language and keyboard to their original values. What it deliberately keeps is the expensive stuff to rebuild: the Entra identity connection, the Intune management connection, Wi-Fi connection details, previously applied provisioning packages, Entra device membership, MDM enrollment information and SCEP certificates. It also blocks the user from reaching the desktop until that information has been restored and an MDM sync has completed - so the device that appears is genuinely ready, not half-configured.

Wipe is a factory reset. Everything goes, including the management relationship.

Fresh Start sits in between - it removes apps and settings, with an option to retain the contents of the user's Home folder. Without retaining data, the device returns to a state equivalent to a completed out-of-box experience, keeping the built-in administrator account.

How to verify: check the prerequisites before you commit

Two checks, both quick, both worth doing before you trigger anything. First, is WinRE actually enabled? If not, Autopilot Reset fails immediately:

Second, what is the join type? This decides whether Autopilot Reset is even an option:

The fix: choose deliberately, using a decision table

Context: the right action depends on what you need to survive the reset and how fast you need the device back.

To trigger a remote Autopilot Reset from Intune:

1. Sign in to intune.microsoft.com with a role that permits it - the Intune Service Administrator role is required for remote Autopilot Reset.
2. Go to Devices › All devices and select the target device or devices.
3. Select More to reveal the device actions.
4. Choose Autopilot Reset. The device must be MDM managed and Entra joined.

To enable local Autopilot Reset (the CTRL + WIN + R path from the lock screen), which is disabled by default:

1. In Intune, go to Devices › Configuration › Create › New policy.
2. Set Platform to Windows 10 and later and Profile type to Device restrictions.
3. Under the General category, set Autopilot Reset to Allow.
4. Assign the profile to the devices where local reset should be permitted.
5. On the device: from the lock screen press CTRL + WIN + R, then sign in with an account holding local administrator credentials to authorise the reset.

Under the hood that policy is the CredentialProviders/DisableAutomaticReDeploymentCredentials CSP setting - 0 allows local reset. It can also be set via Windows Configuration Designer under Runtime settings › Policies › CredentialProviders › DisableAutomaticReDeploymentCredentials.

Prerequisites and policy reference

Proof it worked: a real device that cannot use Autopilot Reset

A genuine run of Get-AutopilotResetReadiness.ps1 from this series. This is the useful case - a device that looks perfectly healthy and still cannot use Autopilot Reset:

Read what that actually demonstrates. WinRE is enabled, so the most common blocker is not present. The device is fully managed and healthy. And it still cannot use Autopilot Reset - purely because it is Entra hybrid joined, which the script determines from AzureAdJoined: YES combined with DomainJoined: YES.

That is exactly the scenario the gotcha above warns about, caught in a single command before anyone triggered the wrong action. It also correctly notes that local reset is not configured on this device - which is the default, not a fault - while pointing out that remote reset from Intune would be unaffected by that particular setting.

References

• Microsoft Learn - Windows Autopilot Reset - what is preserved, the hybrid limitation, the WinRE requirement and 0x80070032
• Microsoft Learn - Device action: Wipe
• Microsoft Learn - Device action: Fresh Start
• Microsoft Learn - CredentialProviders CSP (DisableAutomaticReDeploymentCredentials)

Microsoft MVP community deep-dives

Verified and genuinely on-topic - the URL was fetched and confirmed before being cited here, not copied on trust: