Replacement Hardware Bound to Windows Autopilot

Have you recently had a motherboard replacement or a computer exchange? Did you receive a unit that does not sign into your Azure Active Directory (AD) tenant? The computer may be registered to another Azure AD domain. In this case, you are prompted to enter your credentials, but you are welcomed to the incorrect Azure AD domain name.

Once the repaired computer goes through the Out of Box experience (OOBE), it checks for an Internet connection. It checks the ID of the motherboard against the Autopilot cloud. It finds an organization that it is registered with and then tries to join that Azure AD tenant. This is shown in Figure 1 below using Microsoft’s generic test tenant name.

Figure 1

This is an ecosystem-wide issue as key components of a motherboard are used to identify a device in the Microsoft cloud. An organization may release a device or motherboard and do not deregister the device prior to returning or servicing it. Microsoft maintains the association to the original Azure AD tenant if that happens and then presents the log-in screen from that organization.

Back to Top

Auto-Remediation

Dell supports the automatic re-enrollment of an Autopilot device after a motherboard replacement as of November 2022:

• Updates to the Windows Autopilot Sign-in and Deployment Experience - Microsoft Community Hub

This brings significant relief to customers but may not solve all deployment scenarios after a motherboard replacement.

Auto-Remediation Requirements

• Operating System Version: 19042.2075 or Higher (KB5017380)
• Intune (2209) or Higher
• Do not reset Windows during and after the motherboard replacement
• Intune attempts to register the device automatically in Intune, and Windows present the correct login screen

Troubleshooting Re-Enrollment

If Auto-remediation Fails:

• Confirm that the Operating System Version is 19042.2075 or higher.
• If the Operating System Version is lower, add the below LCU and reboot the device.
  • Windows 10: 2022-10 Cumulative Update for Windows 10 Version 21H2 for x64-based Systems (KB5018410 )
  • Windows 11: 2022-10 Cumulative Update for Windows 11 for x64-based Systems (KB5020387 )

Manual Enrollment:
You receive an error when attempting to upload the HW Hash.

Error 806 - ZtdDeviceAlreadyAssigned

• The device already exists in your tenant.
• Delete the device object from Intune (Device Enrollment -> Windows Enrollment -> Windows Autopilot Devices) and click the Sync button to expedite the synchronization with the Windows Store for Business.
• You can check the device object in WSfB: https://businessstore.microsoft.com/en-us/manage/devices/all (ignore the banner stating that the store is paused, the device list is still available)

Error 808 - ZtdDeviceAssignedToOtherTenant

• The device is registered to another tenant.
• This requires manual deregistration by Microsoft. (Dell cannot perform the deregistration on the Customer's behalf.)
• Submit a trouble ticket in Intune.
  • Navigate to the Intune admin center: https://intune.microsoft.com
  • Go to Troubleshooting + support -> Help and support.
  • Click Intune.
  • Under How can we help copy/paste Autopilot - ZtdDeviceAssignedToOtherTenant and click the arrow, then click Contact support.
  • Click New Service request.
  • Fill out the form and attach a copy of the invoice for the computer (Microsoft does ask for proof of ownership and only accepts the original invoice).
  • Click Contact Me.
  • You see confirmation for the service request, and a Microsoft engineer contacts you. The SLA depends on your support agreement with Microsoft.
  • You can submit multiple devices under the same incident.
• Devices remain in "Fix" pending status.
  This indicates that the auto-remediation service failed and requires manual intervention.
  Click Sync to ensure that the device view is updated (Figure 2). If the device remains in "Fix" pending, submit a trouble ticket in Intune for manual de-registration/re-registration.
  
  Figure 2

Back to Top

Can Dell Deregister on My Behalf?

Unfortunately, Dell cannot deregister the device. Microsoft does ask for proof of ownership and physical possession of the device.

Back to Top

Is this a Dell specific problem?

No, the behavior occurs ecosystem-wide and impacts all OEMs. The resolution path is the same for all device manufacturers where the customer submits the de-registration request through their Intune portal.

Back to Top

How Can I Deregister without Intune?

Engage with Microsoft Tech Support directly through their support portal/chat session.

Microsoft requires device identifiers and proof of purchase to deregister the device.

Obtain a copy of the invoice.

• Get a copy of the computer invoice from Dell Order History -> Click Sign In and type in the email address and password for your Dell account.
• Click View Order History and select the order for your computer -> Save a copy of the invoice to your Documents folder and name it invoice.pdf.

Start the support session with Microsoft:

• Navigate to: Support.Microsoft.com/contactus
• Sign in with your Microsoft Account (MSA).
• Click the Windows icon -> Select Home Support.
• Type "Autopilot device deregistration" into the issue description field -> click Get Help.
• Click Contact Support at the bottom of the page.
• Select product and support category: Windows, Technical Support
• Click Confirm.
• Click Chat with a support agent.
• Upload the copy of the invoice -> click Confirm.
• The chat session is initiated.

Back to Top

Can Dell Send Me Another Motherboard?

Dell does not have access to Autopilot registration history across the ecosystem. Sending another motherboard is likely to result in the same experience and prolong the resolution.

What Are Dell and Microsoft Doing To Address This Issue?

Microsoft is actively working with the Original Equipment Manufacturers (OEMs) on re-architecting the Autopilot experience to allow the OEMs to manage device ownership. There is currently no delivery date that we can share.

Back to Top

How Do I Deregister My Computers So That I Do Not Add To This Problem?

Follow Microsoft’s instructions to Deregister Systems from Autopilot using the Intune console. Following the process removes the device from Intune, removes the Azure AD object, and deregisters it from Autopilot.

Customers can deregister any Autopilot registered computer in their tenant using Intune. This is irrespective of whether an OEM or Microsoft Cloud Service Provider (perhaps a reseller) registered the device for them. While Microsoft is working to make it easier for OEMs to be able to deregister computers that they manufactured, this deregistration only removes the Autopilot registration. It does not unenroll the device from Intune or removes the device object from Azure AD, which would leave orphan records for you to clean up.

When the computer is repaired, these records are re-created. You can do this by registering the device with the hardware hash and using Autopilot to enroll the device with its new identity.

Back to Top

How Do I Register This New Motherboard for Use with Windows Autopilot?

Follow Microsoft’s instructions to Register the Repair Board for Their System with its Correct Identity using the Intune console. This process requires resetting the operating system and capturing the hardware hash using the PowerShell script. The Dell warranty repair engineers cannot capture the hardware hash for you.

Registration with the hardware hash is best achieved in this instance by importing the hardware hash using your Intune console.

Back to Top

Recommended Articles

Here are some recommended articles related to this topic that might be of interest to you.

• Windows Autopilot - Preparing Your Computer for Service
• Windows Autopilot - Invite Dell as an OEM Partner