AdminPackStudio

Posted on Oct 13

Autopilot ESP Stuck at Account Setup: Read-Only Triage

#microsoft #intune #sysadmin #windows

Device setup finished and the user signed in. Now the Enrollment Status Page (ESP) sits on Account setup until it times out. That's a different problem from a device stuck in device setup, because this phase tracks user-targeted items. Here's a read-only order to work through: collect, read, then decide.

TL;DR

Account setup tracks user-targeted security policies, certificates (SCEP), Wi-Fi profiles and apps.
Reboots aren't supported during account setup. An app that reboots itself is a prime suspect.
The default ESP time-out is 60 minutes. Too many required apps for the time-out is the usual cause of app-phase time-outs.
Collect logs with mdmdiagnosticstool.exe (Shift+F10 at OOBE) and read EnrollmentStatusTracking in the registry dump.

What does the ESP track during account setup?

The ESP has three phases: Device preparation, Device setup and Account setup. In account setup it tracks items targeted at users:

Security policies. It doesn't track security policies like device restrictions, which install in the background. It does track Microsoft Edge, Assigned Access and Kiosk Browser policies.
Certificates: SCEP certificate profiles assigned to users.
Network connections: Wi-Fi profiles assigned to users.
Apps: apps assigned to the user. That includes Win32 apps (Windows 10 version 1903 and later) and LoB MSI and store apps assigned to all devices, all users, or a group containing the enrolling user.

On Microsoft Entra hybrid join, Win32 and UWP apps assigned to the device with user installation context aren't tracked during provisioning.

So the first question is: what is assigned to this user as Required? That's the list account setup is waiting on.

Is an app reboot breaking account setup?

Microsoft documents that reboots are supported during device setup but not during account setup. Its ESP known issues also say:

Reboots packaged inside an app deployed during ESP can make ESP hang and fail. Specify reboot behavior in Intune instead.
A reboot during device setup makes the user enter credentials again before account setup. Credentials aren't kept across the reboot.

If the device restarts unexpectedly, the RebootRequiredURI event in the MDM diagnostics channel tells you which policy URI triggered it.

Is it just a time-out?

In the ESP profile, Show an error when installation takes longer than specified number of minutes defaults to 60. Microsoft says ESP time-outs during app deployment usually happen because the time-out isn't long enough for all the required apps. Its example is a five-minute time-out with more than 15 apps.

Two more documented time-out quirks:

Hybrid Entra Autopilot runs 40 minutes longer than the profile value, which gives the on-premises connector time to create the device record.
On Windows 10 1903 and earlier, ESP always times out for devices enrolled through Add work and school account.

Check the profile's Block device use until these required apps are installed setting too. All means every assigned app has to finish. Selected limits the blocking list to the apps you choose, up to 100.

How do I collect ESP logs without changing anything?

At OOBE on a non-S mode device, press Shift+F10 and run:

mdmdiagnosticstool.exe -area Autopilot -cab <path>

That's for user-driven mode. For self-deploying and pre-provisioning on physical devices, use -area Autopilot;TPM. If the ESP profile allows it, users can also select Collect logs after a time-out.

To summarise the CAB, Microsoft points to the Get-AutopilotDiagnostics script:

Install-Script -Name Get-AutopilotDiagnostics -Force
Get-AutopilotDiagnostics -CABFile <pathToOutputCabFile>

Which registry keys show what account setup is waiting for?

In the CAB, open MDMDiagReport_RegistryDump.Reg.

ESP settings: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\{EnrollmentGUID}\FirstSync
Tracking: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Autopilot\EnrollmentStatusTracking

Under EnrollmentStatusTracking, the subkey named after the user's SID belongs to account setup. It holds the install state of user-context Win32 apps and the tracking-policy status for the phase. Microsoft notes this subkey isn't created if device setup failed. If it's missing, your problem started earlier than account setup.

For Win32 apps, InstallationState values are 1 (NotInstalled), 2 (InProgress), 3 (Completed) and 4 (Error). If any app is at 4, ESP stops installing apps. Check the Intune Management Extension log for that app.

ESPTrackingInfo\Diagnostics holds per-item status with timestamps, including user-context store apps under {User_SID}\ExpectedModernAppPackages.

What if account setup is skipped or shouldn't run?

If the account setup phase is skipped unexpectedly, check FirstSync for SkipUserStatusPage set to 0xffffffff. That's set through a custom CSP. Microsoft documents the OMA-URI ./Vendor/MSFT/DMClient/Provider/MS DM Server/FirstSyncStatus/SkipUserStatusPage for organisations that deliberately disable the user ESP. That's a design decision, not a fix. Read what's blocking first.

Also note: disabling an ESP profile doesn't remove ESP policy from devices that already have it.

FAQ

Why does ESP get stuck at account setup but not device setup?
Account setup tracks user-targeted policies, certificates, Wi-Fi and apps. Reboots aren't supported in this phase. A self-rebooting user app or too many required apps for the time-out are the documented suspects.

What is the default ESP time-out?
60 minutes. Hybrid Entra Autopilot adds 40 minutes on top of the profile value.

How do I get Autopilot logs during OOBE?
Press Shift+F10 and run mdmdiagnosticstool.exe -area Autopilot -cab <path>, or use Collect logs if the profile allows it.

What does InstallationState 4 mean?
Error. ESP stops installing apps, so check the Intune Management Extension log for that app.

Want the full runbook?

The Intune & M365 Admin Starter Pack includes enrollment hygiene with a triage map, break/fix cards and read-only PowerShell scripts, including a local enrollment snapshot. The scripts only read.

👉 https://cashflow4375.gumroad.com/l/joonf?utm_source=devto

Admin Pack Studio; not affiliated with Microsoft.

DEV Community