Autopilot failures surface as a failed step on the Enrollment Status Page (ESP), an event in the Autopilot log or an import error in the Intune admin center. This quick reference collects the codes and messages Microsoft documents for Windows Autopilot, from TPM attestation and enrollment during OOBE to hash import, hybrid join, the Intune Connector for Active Directory, the ESP and Autopilot Reset, each with the usual cause and the first check. Plain MDM enrollment and Entra join codes are in the Windows enrollment error codes quick reference.
Codes in this quick reference
0x800705B4 Securing your hardware (Failed: 0x800705b4): timeout, usually a device without TPM 2.0ESP (Securing your hardware)0x801C03EA Registering your device for mobile management (Failed: 3, 0x801C03EA): TPM attestation failedESP (Registering for mobile management)0x81039001 E_AUTOPILOT_CLIENT_TPM_MAX_ATTESTATION_RETRY_EXCEEDEDESP (Securing your hardware)0x81039023 TPM attestation failure on Windows 11ESP (Securing your hardware)0x81039024 TPM attestation failed: known TPM vulnerabilities detectedESP (Securing your hardware)0x80070490 TPM attestation failure on AMD platforms with ASP firmware TPMESP (Securing your hardware)Something happened, and TPM attestation timed out.ESP (Securing your hardware)Event 171 AutopilotManager failed to set TPM identity confirmed (event 172 follows)Autopilot event log (ModernDeployment)
+ 35 more codes in the tables below.
How to read these codes#
- ESP device preparation. The steps run in order: Securing your hardware (where self-deploying and pre-provisioning do TPM attestation), Joining your organization's network, Registering your device for mobile management, then Preparing your device for mobile management. Fix the first step that shows a code; later ones only say "Previous step failed".
- Autopilot event log. Applications and Services Logs › Microsoft › Windows › ModernDeployment-Diagnostics-Provider › Autopilot records profile download and TPM events.
- Other logs. User Device Registration › Admin (join), DeviceManagement-Enterprise-Diagnostics-Provider › Admin (enrollment and policy), and on the connector server Microsoft › Intune › ODJConnectorService (older builds used a top-level ODJ Connector Service log).
- Intune admin center. Import results and device records live under Devices › Windows › Device onboarding › Enrollment › Windows Autopilot › Devices.
At the failure screen, use Collect logs (if the ESP profile allows it) or press Shift+F10 and run:
Command Prompt
mdmdiagnosticstool.exe -area Autopilot;TPM -cab C:\autopilot.cab
reg query HKLM\SOFTWARE\Microsoft\Provisioning\Diagnostics\AutopilotIn PowerShell, quote the area list ('Autopilot;TPM'). Install-Script -Name Get-AutopilotDiagnostics on another PC, then Get-AutopilotDiagnostics -CABFile C:\autopilot.cab, summarises the cab. In the registry, CloudAssignedTenantDomain is the tenant the device is registered to, TenantMatched 0 means the user signed in from another tenant, and IsAutopilotDisabled 1 means no registration or a failed profile download. On Windows 11 user-driven deployments, Ctrl+Shift+D opens the diagnostics page when the ESP profile enables it. Autopilot device preparation doesn't use the ESP; see the device preparation guide for its failures.
TPM attestation (self-deploying and pre-provisioning)#
| Code | Meaning | Usual cause | First check |
|---|---|---|---|
0x800705B4 | General timeout, shown as "Securing your hardware (Failed: 0x800705b4)" | No physical TPM 2.0: a VM with a virtual TPM, or TPM 1.2 | Get-Tpm and the specification version in tpm.msc; pre-provisioning isn't supported on VMs |
0x801C03EA | TPM attestation failed, so the Entra join with a device token failed: "Registering your device for mobile management (Failed: 3, 0x801C03EA)" | A TPM that supports 2.0 but hasn't been upgraded to it; or the device is in two groups with different Autopilot profiles | TPM firmware; the device's profile assignments |
0x81039001 | E_AUTOPILOT_CLIENT_TPM_MAX_ATTESTATION_RETRY_EXCEEDED, at Securing your hardware | Intermittent attestation failure | Retry; a badly wrong clock also breaks attestation, so run w32tm /resync /force at OOBE |
0x81039023 | TPM attestation failure on Windows 11 | Older Windows 11 builds | For Windows 11 21H2, KB5013943 (May 2022) or later |
0x81039024 | Attestation refused because the TPM has known vulnerabilities | Outdated TPM firmware | TPM firmware update from the PC maker |
0x80070490 | TPM attestation failure on AMD platforms with ASP firmware TPM | Older AMD firmware | Firmware release notes from the device maker |
| "Something happened, and TPM attestation timed out." | Attestation timeout | Infineon SLB9672 TPM with firmware 15.22 and an EK certificate | Firmware update from the OEM |
| Event 171 (then 172) | "AutopilotManager failed to set TPM identity confirmed. HRESULT=…", followed by "failed to set Autopilot profile as available" | A TPM attestation problem in self-deploying mode | The HRESULT in the event; then the rows above |
Joining and enrolling during OOBE#
| Code or message | Meaning | Usual cause | First check |
|---|---|---|---|
0x80180014 | Enrollment refused; ETW shows "Enrollment blocked for AP device by SDM One Time Limit Check" | A reused self-deploying or pre-provisioned device whose Intune record remains; or Windows (MDM) blocked by a platform restriction | Unblock device on the Autopilot device, or delete the Intune record (0x80180014 guide) |
0x80180018 | MENROLL_E_USERLICENSE on the "Something went wrong" page | Missing licence, or too many devices for the user | The user's licences and devices (0x80180018 guide) |
| "Can't connect to the URL of your organization's MDM terms of use." | Usually a licensing problem | User without an Intune, EMS or Microsoft 365 licence | Assign the licence, then restart OOBE |
0x80180022 | "Autopilot device enrollment failed with error HRESULT = 0x80180022" | The device runs Windows Home | Upgrade to Pro or higher |
0xc1036501 | Automatic MDM enrollment impossible: multiple MDM configurations in Microsoft Entra ID | More than one MDM app has the user in scope | Mobility (MDM and MAM) in Microsoft Entra ID: keep only Microsoft Intune in scope |
0x801C03F3 | Pre-provisioning error screen: Entra can't find the device object | The Entra object created at import was deleted manually | Remove the device from Entra ID, Intune and Autopilot, then re-register it |
| "Something went wrong. OOBEIDPS." | The identity provider couldn't be reached | Proxy or firewall blocking sign-in | Autopilot networking requirements; test from Shift+F10 |
| "That username looks like it belongs to another organization. Try signing in again or start over with a different account" | Tenant mismatch | The user's tenant differs from the one the device is registered to | CloudAssignedTenantDomain and TenantMatched in the Autopilot registry key |
| "Preparing your device for mobile management" fails on a VM | VM too small | Fewer than 2 processors or less than 4 GB of memory | The VM's settings |
Profile download and registration (Autopilot event log)#
| Event | Meaning | Usual cause | First check |
|---|---|---|---|
| 100 | "Autopilot policy [name] not found." | Usually temporary while the profile downloads | If it persists, the registration and network access |
| 807 | ZtdDeviceIsNotRegistered | Hash not uploaded, or no profile assigned | Search Autopilot devices by serial number; Profile status |
| 809 | "ZtdDeviceHasNoAssignedProfile - Assigned profile does not exist." | The assigned profile was deleted without cleanup | Assign another profile, then re-enroll |
| 815 | "ZtdDeviceHasNoAssignedProfile - No profile assigned to the device, and no default profile found in the tenant." | No profile targets the device | Profile assignment to a group that contains the device |
| 908 | SerialNumberMismatch / ProductKeyIdMismatch | Serial number or product key in Autopilot doesn't match the hardware | Re-register the device |
| 163 | "AutopilotManager determined download isn't required and the device is already provisioned." | A profile is already on the device (image not generalized) | Reset the device, or capture images with sysprep /generalize |
| "Fix pending" / "Attention required" | Portal status after "We've detected a hardware change on this device." | Hardware change such as a new motherboard | Deregister and re-register the device |
Hardware hash import#
| Code or message | Meaning | Usual cause | First check |
|---|---|---|---|
806 - ZtdDeviceAlreadyAssigned | "Device is already registered to the same Tenant." | The device is already registered, or an Intune record exists | Search by serial number, remove the old record, re-import |
808 - ZtdDeviceAssignedToOtherTenant | Shown with "Internal error" | A registration or Intune record for the device already exists; the name points to another tenant | Search Autopilot Devices by serial number and delete any record. If your tenant has none, ask the previous owner or reseller to deregister it, or open a Microsoft support request with the device CSV, original proof of ownership (no screenshots) and Mdmdiagnosticstool.exe -area Autopilot -cab c:\out.cab |
| "Cannot convert the literal '[DEVICEHASH]' to the expected type 'Edm.Binary'" | HTTP 400 in a network trace when Import does nothing | The hash isn't padded Base64, or the CSV was edited outside Notepad | Test-decode the hash with [System.Convert]::FromBase64String() and fix its = padding as Microsoft's FAQ describes |
Hybrid join and the Intune Connector for Active Directory#
Note: Some rows come from Microsoft's Windows Autopilot known issues page, where statuses change; re-check it before acting. If enrollments started failing with the connector, Microsoft's FAQ says to run version 6.2501.2000.5 or later and make sure the legacy connector isn't still in use.
| Code or message | Meaning | Usual cause | First check |
|---|---|---|---|
0x80070774 | "Something went wrong. Confirm you are using the correct sign-in information…": the domain controller can't be found or reached | Assign user on a hybrid profile; the Autopilot object's Entra device deleted; the connector in a different domain from the targeted one | Unassign the user; re-import the hash; the connector's domain; event 30132 |
0x80004005 | Hybrid join deployments time out (known issue added February 2026) | Devices without the fixing update | KB5065789 (25H2), KB5065426 (24H2) or KB5070312 (23H2) or later (guide) |
0x800706FD | Pre-provisioning fails with MDM PolicyManager: Merge string, Area: (UserRights), Policy: (DenyLocalLogOn), Result: (0x800706FD) The trust relationship between this workstation and the primary domain failed. | A policy needs a domain controller to resolve a conflict during the technician flow (known limitation) | Don't assign such policies to the technician flow, or pre-provision with line of sight to a DC (guide) |
| Event 30132 | "Failed to get the ODJ Blob. The ODJ connector does not have sufficient privileges to complete the operation" | OU permissions not delegated to the connector | Delegate creating and deleting computer objects on the OU |
0x8007202F | "A constraint violation occurred." | The computer account limit for the OU | ODJConnectorUI.log; increase the OU's computer account limit |
| "The MSA account couldn't be granted permission to create computer objects in the following OUs" | Connector setup couldn't delegate the OU | Installing admin lacks permissions, or the OU in ODJConnectorEnrollmentWizard.exe.config doesn't exist | ODJConnectorUI.log under C:\Program Files\Microsoft Intune\ODJConnector\ODJConnectorEnrollmentWizard |
| "Cannot start service ODJConnectorSvc on computer '.'" | The service can't start as the managed service account | DC replication lag after the MSA was created, or a policy blocking Log on as a service | Wait for replication, then Configure MSA (gMSA guide) |
SeLogonAsServicePrivilegeMissing | Pre-check failure with your own gMSA | The privilege hasn't reached the connector host yet | Build 6.2604.2000.3 or later with SkipByoMsaPrivilegeCheck |
| "MSA account <accountName> is not valid" | Connector 6.2501.2000.5 created the MSA but couldn't read it back | DC replication delay, or the user in another domain | Upgrade to build 6.2504.2001.8 or later |
| "Navigation to the webpage was canceled" / "Can't connect securely to this page" | Connector sign-in page failed | Required Intune URLs blocked, or TLS 1.0/1.1 because PKCS is disabled | Required URLs; reg.exe delete "HKLM\System\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\PKCS" /v Enabled /f |
Enrollment Status Page and Autopilot Reset#
| Code or message | Meaning | Usual cause | First check |
|---|---|---|---|
InstallationState = 4 | A Win32 app tracked by the ESP failed, so the ESP stops installing apps | Install command, detection rule or download problem | IME logs; HKLM\SOFTWARE\Microsoft\Windows\Autopilot\EnrollmentStatusTracking (ESP guide) |
| "Another installation is in progress, please try again later" | Two installs collided in TrustedInstaller | Line-of-business MSI and Win32 apps mixed in the ESP, or the Teams Machine-Wide Installer from Microsoft 365 Apps | Deliver ESP apps as Win32 apps only |
| Event 2800 | "The following URI has triggered a reboot: (…)" | A policy forcing a reboot during the ESP | The URI in the DeviceManagement-Enterprise-Diagnostics-Provider log; target that policy to users so it applies later |
0x80070032 | ERROR_NOT_SUPPORTED in the logs: Autopilot Reset stops immediately | Windows Recovery Environment (WinRE) not configured or enabled | reagentc.exe /enable (device actions guide) |
| "Ran into trouble. Please sign in with an administrator account to see why and reset manually." | Autopilot Reset failed immediately | Usually WinRE (see the row above) | Sign in as an administrator; reagentc /info |
| "Autopilot reset ran into trouble. Could not find the recovery environment" | Reset couldn't locate WinRE | A recovery environment problem | reagentc /info; if WinRE is fine, enter administrator credentials to continue |
Autopilot Reset doesn't support Microsoft Entra hybrid joined devices; those need a full wipe.
How to verify a fix#
- Deployment: the ESP completes and the user reaches the desktop; for pre-provisioning, the technician flow ends on the green screen with Reseal.
- Autopilot log: event 153 (ProfileState_Unknown to ProfileState_Available) and 161, with no new 171, 807, 815 or 908.
- Intune: the Autopilot device shows Profile status Assigned, and the Windows Autopilot deployment report shows the run as successful.
- Join:
dsregcmd /statusshowsAzureAdJoined : YES, plusDomainJoined : YESfor hybrid.
PowerShell
Get-WinEvent -LogName 'Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot' -MaxEvents 200 |
Where-Object Id -in 153, 161, 171, 172, 807, 809, 815, 908 | Select-Object TimeCreated, Id, Message
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Provisioning\Diagnostics\Autopilot' |
Select-Object CloudAssignedTenantDomain, TenantMatched, IsAutopilotDisabledReferences#
- Windows Autopilot troubleshooting FAQ (Microsoft Learn): event IDs, 0x80180014, 0x80070774, connector errors
- Windows Autopilot known issues (Microsoft Learn): TPM attestation and hybrid join codes
- Troubleshooting Windows device enrollment errors in Intune (Microsoft Learn): 0x801C03EA, 0x800705b4, OOBEIDPS
- Error 806 or 808 when you import Windows Autopilot device CSV files in Intune (Microsoft Learn)
- Troubleshoot the Enrollment Status Page and Windows Autopilot Reset (Microsoft Learn)
