Windows Autopilot

New Enrollment Status Page option available

The enrollment status page (ESP) is something I highly recommend you implement, to ensure each device is fully provisioned before the user can get to the desktop.  It makes sure the device is sufficiently configured before the user is able to try to use the device.

That said, there have been some challenges with ESP in some scenarios.  We’re slowly chipping away at those, with one new feature released in the past week addressing one particular scenario with what we call the “Nth user scenario.”  Here’s the basic scenario:

  • You go through the Windows Autopilot deployment process, showing the device ESP and user ESP.  Everything works great.
  • Later, another user account signs into the machine and sees the user ESP appear again.  And it doesn’t work great – it will sit there for a long time, often timing out (based on your ESP settings).

That timeout happens because it’s waiting for another MDM policy sync to figure out what policies need to be tracked for this additional user.  But if this second user signs in more than 2 hours after the device was initially provisioned, that sync might not happen for up to 8 hours.  (We have some additional work on the backlog to take more active control over that MDM policy sync polling process during ESP.)

So, those of you that have run into this have had to work around this issue, usually by turning off user ESP via a custom OMA-URI policy.  (There’s also a scripted option that works, but it’s a little messy.)  Now there’s a better way, a new setting available in the ESP settings:

image

With that set to “Yes,” Intune will take care of turning off the user ESP after the initial Windows Autopilot completes (for the first user).  So if you’ve run into this, modify your ESP settings today.

Categories: Windows Autopilot

3 replies »

  1. Thanks Michael for pointing this out. We changed this, but it seems to have no effect. What are the requirements to have this working? Specific W10 build (used 18362.418 for testing)? Does this work on existing devices or only on new enrolled devices while this setting was enabled?

    Like

    • There is no client-side requirement; this is implemented in Intune. I suspect it will only work for newly-deployed devices, as Intune will send an updated ESP policy after it sees the Autopilot process complete. If the Autopilot process had previously completed before this was implemented, it wouldn’t know to do that.

      Like

  2. Seems to not apply on Hybrid AAD deployments. First enrollment is still stuck in the Account setup page for approx 30 minutes until AAD Connect Sync finishes in the background

    Like

Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s