Win32 Apps Don't Deploy When User Enrollment Status Page Doesn't Complete

By -

Autopilot Configuration Summary

  • Hybrid Autopilot
  • User Driven
  • VPN Deployed (user SAML connection at Win10 login screen)

The Issue

I recently came across an issue where applicable Win32 apps were not being deployed after an Autopilot build was completed. The 3 apps I set as required in the ESP profile were deployed correctly during the Device ESP stage but no further applications were deployed once the user had reached the desktop.

Rebooting several times, trying multiple syncs and waiting several hours made no difference. MS Store apps were being deployed to the devices fine, and Win32 application available for installs initiated from the Company Portal were deployed correctly.

In the Intune/MEM portal, the in scope applications would shows as 'Waiting for install status'.  That message could be for a multiple of reasons. The MEM portal isn't immediately up to date, so it's not the best reference to real-time behaviour. 

I had the necessary parts in place to make the HAADJ process as quick as possible via thanks to blogs from Michael Niehaus and script work from Steve Prentice. Because this was a user driven Autopilot deployment, using a user initiated VPN at the Windows 10 logon screen, I used the script provided by Steve Prentice to run as a scheduled task as Windows 10 login to complete the HAADJ process asap.

The Cause

On further investigation, I found that the user hadn't completed to the User ESP part of the Autopilot process which should complete the Hybrid Azure AD Join process. This didn't appear to be an issue at first, as the devices were showing as HAADJ and enrolled correctly in MEM.

As a side note, if the user doesn't complete the User ESP process, it's not a show stopper.  The device eventually becomes HAADJ.

I recreated the issue on several machines by bombing out at the User ESP part of the Autopilot process. In practice, there could be a few reasons why an end user encounters this:

  • The laptop dies due to low battery
  • The process times out due to the ESP period set
  • The user shuts down or restarts the device as they believe the process is stuck/hung

The the Intune Management Extension log was a hint to the problem:

![LOG[[Win32App] GetHasProvisioningCompleted failed with ex: System.Management.ManagementException: Access denied

<![LOG[[Win32App] ESP got userHasProvisioningCompletedValueString False]LOG]!><time="03:59:49.9492494" date="3-28-2021" component="IntuneManagementExtension" context="" type="1" thread="4" file="">

Because the User ESP process hadn't completed gracefully, it appears that further Win32 apps would not deploy. Because the User ESP screen doesn't appear for the users next login, I added the SkipUserESP registry key.  You can also deploy this via an OMA URI in MEM. This provided the means for the User ESP completion check to be skipped.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\{EnrollmentGUID}\FirstSync\
SkipUserStatusPage = 1

Note, when doing it manually, there will be multiple GUID’s listed in the Enrolments registry key branch. You can determine the relevant registry key by checking the UPN registry value in the {EnrollmentGUID} keys relates to the end user e.g.

After making the change, I restarted the Intune Management Extension service and within 1 minute, the Win32 apps start to install.

Conclusion

One option is to set the User ESP screen to be skipped altogether, but I prefer to have the HAADJ process completed when the user hits the desktop for the first time. I would add the registry workaround as and when it's required.


Comments

  1. Unknown19 July 2021 at 20:00

    Wow, thank you. I have been researching this solution for several months, and couldn't find a solution anywhere. Finally, this fixed my issue.

    ReplyDelete
  2. Ash1 February 2022 at 22:45

    I would like to set this using OMA-URI, can you provide your settings for that?

    ReplyDelete
  3. Ash3 February 2022 at 17:24

    I would like to publish this as a OMA-URI, can you provide the settings? I've tried setting it like this but it doesn't appear to work properly.

    Name: SkipUserStatusPage
    OMA-URI: ./Vendor/MSFT/Policy/Config/FirstSync/SkipUserStatusPage
    Data Type : Integer
    Value: 1

    ReplyDelete
    Replies
    1. Ben Owens8 February 2022 at 09:24

      Name - SkipUserStatusPage
      Description - SkipUserStatusPage
      OMA-URI - ./Vendor/MSFT/DMClient/Provider/MS DM Server/FirstSyncStatus/SkipUserStatusPage

      Data Type - Boolean

      Value - True

      Delete

Post a Comment

Popular posts from this blog

Assigning Windows 10/11 Enterprise Subscription Activation Licences to Hybrid Azure AD Joined Devices

By -
Image
Introduction Starting with Windows 10, version 1703, Windows 10 Pro supports the Subscription Activation feature, enabling users to “step-up” from Windows 10 Pro to Windows 10 Enterprise automatically if they are subscribed to Windows 10 Enterprise E3 or E5. The Subscription Activation feature eliminates the need to manually deploy Windows 10 Enterprise or Education images on each target device, then later standing up on-prem key management services such as KMS or MAK based activation, entering GVLKs, and subsequently rebooting client devices. It’s important to note that the Windows 10 Enterprise subscription activation is designed to “step-up” a device from Windows 10 Pro to Windows 10 Enterprise. Therefore, your device is required to have a Windows 10 Pro license activated as a baseline. For Windows 10 Enterprise Subscription Activation to function, there a several prerequisites which need to be in place. This blog is aimed for organisations which have Active Directory on premises an...
Read more

Power Automate: Get first item in output

By -
Image
One of the most annoying things about Power Automate for me is when I am trying to use the output of a previous action and as soon as I click that dynamic content button, it pops my new action into a For Each loop. It does this because the previous action could have more than 1 item returned and this would clearly fail unless it was in a loop. But if you have used the Row Count or Top option in the proceeding action, or you know full well that only 1 item will return, it is nice to avoid bloating the flow with an unnecessary loop. There are a couple of way to do this: First function You can craft your filter expression so that the output is wrapped in the First function. This will tell Power Automate to only look at the first item. First(variables('Array')) Calling Index You can edit your filter expression to tell it which item from the source you want. Zero being the first item e.g. variables('Array')[0] Which one to use? I use the index and the main reason is due to...
Read more

De-selectable radio buttons - Power Apps

By -
Image
Introduction When creating a Canvas Power App you can choose from a large number of controls and specifically input controls designed to get information from the user. One of these controls is the humble radio button. This is a good control which provides possible options without requiring a user action. In comparison a dropdown would require the user to click to expand all of the possible options. Example radio button input One of problems with this control is the fact you cannot de-select it. Once an option has been chosen, you can change it but you cannot undo it. The post shows a way to make de-selecting possible in a Canvas Power App. One simple way to achieve this is to have a button or icon next to the radio button and its OnSelect property to be Reset(rdoButton). This is easy, but if there are many radio button controls, it could result in lots more controls on a screen or in an app. Power Apps recommends keeping under 500 for an app and 300 maximum per page. The followi...
Read more