How to Fix Intune Policies Causing Unexpected Reboots During Windows Autopilot OOBE

After an unexpected reboot during Autopilot OOBE, log into the affected device with the auto-created local admin account. The first step is identifying which policies triggered the coalesced reboot.

Open Event Viewer and navigate to the Intune-specific logs:

eventvwr.msc

Navigate to: Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin

Filter for Event ID 2800 which indicates a coalesced reboot. Look for entries containing policy URIs like:

• ./Device/Vendor/MSFT/Policy/Config/DeviceGuard/EnableVirtualizationBasedSecurity
• ./Device/Vendor/MSFT/Policy/Config/CredentialGuard/ConfigureSystemGuard
• ./Device/Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules

Also check the System log for CloudExperienceHostBroker.exe errors and examine Intune Management Extension logs:

Get-ChildItem "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs" | Sort-Object LastWriteTime -Descending | Select-Object -First 5

Cross-reference the Event Viewer findings with the registry to identify exactly which policies are causing reboots. Open Registry Editor and examine the reboot tracking keys:

regedit

Navigate to: HKLM\SOFTWARE\Microsoft\Provisioning\SyncML\RebootRequiredURIs

Document all URIs listed here. Then run this PowerShell script to compare against current device policies:

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All"

# Collect RebootRequiredURIs from registry
$rebootURIs = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Provisioning\SyncML\RebootRequiredURIs" -ErrorAction SilentlyContinue

# Get current device policies
$policyURIs = Get-ChildItem "HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device" | ForEach-Object { $_.PSChildName }

# Compare and identify problematic policies
$problematicPolicies = Compare-Object $rebootURIs.PSObject.Properties.Name $policyURIs | Where-Object SideIndicator -eq "<="

Write-Host "Policies causing reboots:" -ForegroundColor Red
$problematicPolicies | ForEach-Object { Write-Host $_.InputObject -ForegroundColor Yellow }

The most effective solution is moving problematic security policies from device group assignments to user group assignments. This delays policy application until after the Enrollment Status Page completes.

In the Microsoft Intune admin center, navigate to Endpoint security and review these policy types:

• Device Guard policies
• Credential Guard policies
• Virtualization-Based Security (VBS)
• Attack Surface Reduction rules

For each problematic policy identified in previous steps:

1. Click on the policy name
2. Go to Assignments
3. Remove any Device groups (especially Autopilot device groups)
4. Add equivalent User groups instead
5. Click Save

Use this PowerShell script to audit current assignments:

# Get all device configuration policies
$policies = Get-MgDeviceManagementDeviceConfiguration

foreach ($policy in $policies) {
    $assignments = Get-MgDeviceManagementDeviceConfigurationAssignment -DeviceConfigurationId $policy.Id
    
    foreach ($assignment in $assignments) {
        if ($assignment.Target.AdditionalProperties["@odata.type"] -eq "#microsoft.graph.groupAssignmentTarget") {
            $group = Get-MgGroup -GroupId $assignment.Target.AdditionalProperties.groupId
            Write-Host "Policy: $($policy.DisplayName)" -ForegroundColor Cyan
            Write-Host "Assigned to group: $($group.DisplayName)" -ForegroundColor Yellow
            Write-Host "Group type: $($group.GroupTypes)" -ForegroundColor White
            Write-Host "---"
        }
    }
}

Windows Update rings with preview build settings can trigger unexpected reboots during Autopilot. This is a known issue that persists even after Microsoft's 2111 service update.

Navigate to Devices > Windows > Windows Update rings in the Intune admin center. For each update ring assigned to Autopilot devices:

1. Click on the update ring name
2. Go to Settings
3. Find Enable pre-release builds
4. Change it to Enabled
5. Click Save
6. Wait 5 minutes, then change it back to Not Configured
7. Click Save again

This toggle sequence clears the problematic ./Device/Vendor/MSFT/Policy/Config/Update/ManagePreviewBuilds setting that causes reboots during ESP.

Alternatively, use PowerShell to check and fix update rings:

# Get all Windows Update rings
$updateRings = Get-MgDeviceManagementDeviceConfiguration | Where-Object { $_.AdditionalProperties["@odata.type"] -eq "#microsoft.graph.windowsUpdateForBusinessConfiguration" }

foreach ($ring in $updateRings) {
    Write-Host "Update Ring: $($ring.DisplayName)" -ForegroundColor Cyan
    
    # Check preview build setting
    $previewSetting = $ring.AdditionalProperties.previewBuildSetting
    if ($previewSetting -ne "notConfigured") {
        Write-Host "Preview builds setting: $previewSetting - NEEDS FIX" -ForegroundColor Red
    } else {
        Write-Host "Preview builds setting: Not Configured - OK" -ForegroundColor Green
    }
}

Deploy a custom configuration profile that prevents automatic reboots during the OOBE phase. This profile sets active hours and disables auto-restart notifications.

Use this PowerShell script to create the prevention profile via Microsoft Graph:

# Ensure you're connected to Graph with proper permissions
Connect-MgGraph -Scopes "DeviceManagementConfiguration.ReadWrite.All"

# Define the OOBE Reboot Prevention profile
$oobeProfile = @{
    "@odata.type" = "#microsoft.graph.windows10CustomConfiguration"
    displayName = "OOBE Reboot Prevention - Autopilot"
    description = "Prevents unexpected reboots during Windows OOBE and Autopilot enrollment"
    omaSettings = @(
        @{ 
            "@odata.type" = "#microsoft.graph.omaSettingString"
            displayName = "Disable Auto Restart Required Notification"
            omaUri = "./Device/Vendor/MSFT/Policy/Config/Update/AutoRestartRequiredNotificationDismissal"
            value = "1"
        },
        @{ 
            "@odata.type" = "#microsoft.graph.omaSettingString"
            displayName = "Set Active Hours Start"
            omaUri = "./Device/Vendor/MSFT/Policy/Config/Update/ActiveHoursStart"
            value = "8"
        },
        @{ 
            "@odata.type" = "#microsoft.graph.omaSettingString"
            displayName = "Set Active Hours End"
            omaUri = "./Device/Vendor/MSFT/Policy/Config/Update/ActiveHoursEnd"
            value = "18"
        },
        @{ 
            "@odata.type" = "#microsoft.graph.omaSettingString"
            displayName = "Configure Restart Notifications"
            omaUri = "./Device/Vendor/MSFT/Policy/Config/Update/ScheduleRestartWarning"
            value = "4"
        }
    )
}

# Create the profile
$newProfile = New-MgDeviceManagementDeviceConfiguration -BodyParameter $oobeProfile
Write-Host "Created profile with ID: $($newProfile.Id)" -ForegroundColor Green

After creating the profile, assign it to your Autopilot device group with high priority (order 1).

Win32 applications deployed during Autopilot can trigger unexpected reboots if not properly configured. Modify your Win32 app packages to suppress reboot prompts and handle restart requirements gracefully.

For each Win32 app that might require a reboot:

1. Navigate to Apps > Windows apps in Intune
2. Select your Win32 app
3. Go to Program settings
4. Modify the Install command to include reboot suppression parameters

Common reboot suppression parameters:

# For MSI installers
msiexec /i "package.msi" /quiet /norestart REBOOT=ReallySuppress

# For EXE installers (varies by vendor)
setup.exe /S /norestart
setup.exe /quiet /noreboot
setup.exe /silent /suppressmsgboxes

Configure return codes to handle reboot requirements:

1. In the app's Program settings
2. Set Return codes:
3. Add return code 3010 with type Soft reboot
4. Add return code 1641 with type Hard reboot
5. Set Device restart behavior to Determine behavior based on return codes

Use this PowerShell script to audit Win32 app configurations:

# Get all Win32 apps
$win32Apps = Get-MgDeviceAppManagementMobileApp | Where-Object { $_.AdditionalProperties["@odata.type"] -eq "#microsoft.graph.win32LobApp" }

foreach ($app in $win32Apps) {
    Write-Host "App: $($app.DisplayName)" -ForegroundColor Cyan
    
    # Get detailed app info
    $appDetails = Get-MgDeviceAppManagementMobileApp -MobileAppId $app.Id
    $installCommand = $appDetails.AdditionalProperties.installCommandLine
    
    Write-Host "Install Command: $installCommand" -ForegroundColor Yellow
    
    # Check for reboot suppression parameters
    if ($installCommand -match "/norestart|/noreboot|REBOOT=ReallySuppress") {
        Write-Host "Reboot suppression: CONFIGURED" -ForegroundColor Green
    } else {
        Write-Host "Reboot suppression: MISSING - NEEDS FIX" -ForegroundColor Red
    }
    Write-Host "---"
}

After implementing the fixes, thoroughly test the Autopilot experience to ensure no unexpected reboots occur. Reset a test device and monitor the entire OOBE process.

Reset the test device to factory settings:

1. Go to Settings > Update & Security > Recovery
2. Click Get started under Reset this PC
3. Choose Remove everything
4. Select Remove files and clean the drive

During the Autopilot process, monitor for issues using these techniques:

Real-time monitoring with PowerShell:

# Monitor Autopilot progress (run on the device during OOBE)
$autopilotLog = "C:\Windows\Logs\Autopilot\AutopilotDiagnostics.log"
if (Test-Path $autopilotLog) {
    Get-Content $autopilotLog -Tail 10 -Wait
}

# Monitor Intune Management Extension
$imeLog = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log"
if (Test-Path $imeLog) {
    Get-Content $imeLog -Tail 5 -Wait | Where-Object { $_ -match "reboot|restart" }
}

Generate comprehensive diagnostics after completion:

# Generate MDM diagnostics report
mdmdiagnosticstool.exe -out C:\temp\AutopilotDiagnostics

# Collect Autopilot logs
Get-AutopilotDiagnostics -OutputPath C:\temp\AutopilotLogs

# Check for any remaining reboot-required URIs
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Provisioning\SyncML\RebootRequiredURIs" -ErrorAction SilentlyContinue

Document the complete Autopilot timeline:

• OOBE start time
• ESP device setup phase completion
• User sign-in
• ESP user setup phase completion
• Desktop presentation
• Any unexpected interruptions or reboots

Establish monitoring processes to prevent future Autopilot reboot issues. Create automated checks and alerts for problematic policy assignments.

Create a PowerShell script for regular policy auditing:

# Autopilot Policy Audit Script
# Run weekly to check for problematic assignments

Connect-MgGraph -Scopes "DeviceManagementConfiguration.Read.All", "Group.Read.All"

# Define problematic policy types
$problematicPolicyTypes = @(
    "#microsoft.graph.windows10EndpointProtectionConfiguration",
    "#microsoft.graph.windowsDefenderAdvancedThreatProtectionConfiguration",
    "#microsoft.graph.windows10CustomConfiguration"
)

# Get Autopilot device groups
$autopilotGroups = Get-MgGroup | Where-Object { $_.DisplayName -like "*Autopilot*" -or $_.DisplayName -like "*OOBE*" }

Write-Host "Checking for problematic policy assignments..." -ForegroundColor Cyan

foreach ($policyType in $problematicPolicyTypes) {
    $policies = Get-MgDeviceManagementDeviceConfiguration | Where-Object { $_.AdditionalProperties["@odata.type"] -eq $policyType }
    
    foreach ($policy in $policies) {
        $assignments = Get-MgDeviceManagementDeviceConfigurationAssignment -DeviceConfigurationId $policy.Id
        
        foreach ($assignment in $assignments) {
            if ($assignment.Target.AdditionalProperties["@odata.type"] -eq "#microsoft.graph.groupAssignmentTarget") {
                $groupId = $assignment.Target.AdditionalProperties.groupId
                
                if ($groupId -in $autopilotGroups.Id) {
                    Write-Host "WARNING: Policy '$($policy.DisplayName)' assigned to Autopilot device group" -ForegroundColor Red
                    Write-Host "Group: $($autopilotGroups | Where-Object Id -eq $groupId | Select-Object -ExpandProperty DisplayName)" -ForegroundColor Yellow
                    Write-Host "Recommendation: Move to user group assignment" -ForegroundColor Green
                    Write-Host "---"
                }
            }
        }
    }
}

Write-Host "Audit complete." -ForegroundColor Green

Set up automated alerting using Azure Logic Apps or Power Automate:

1. Create a Logic App with a recurrence trigger (weekly)
2. Add an HTTP action to call Microsoft Graph API
3. Query for device configuration assignments
4. Filter for device group assignments to security policies
5. Send email alerts when problematic assignments are detected

Create documentation for your team:

# Autopilot Policy Assignment Guidelines

## NEVER assign to device groups:
- Device Guard policies
- Credential Guard policies  
- Attack Surface Reduction rules
- VBS/HVCI policies
- Windows Update rings with preview builds

## ALWAYS assign to user groups:
- All Endpoint Security policies
- Compliance policies (when possible)
- App protection policies

## Safe for device groups:
- Wi-Fi profiles
- Certificate profiles
- VPN profiles (non-security related)
- Basic device restrictions