Tech Trends and Insights

Guide: Preventing the Windows OOBE Update Loop Caused by ESP and Update Rings in Microsoft Intune Overview Microsoft recently enabled a new behavior in Windows Autopilot where devices may attempt to install Windows Updates during OOBE (Out-of-Box Experience). This is controlled by the ESP (Enrollment Status Page) setting: Install Windows updates (might restart the device) If this setting is enabled , and the device is also targeted by a Windows Update Ring , the two systems may conflict. This often results in an OOBE update loop , where the device repeatedly restarts during setup and displays messages like the screen below: Why was my PC restarted? This loop continues indefinitely unless configuration is corrected. Symptoms Devices show the following behavior during Autopilot enrollment: Windows attempts to install updates during OOBE (triggered by ESP). The Update Ring simultaneously enforces updates. The device restarts unexpectedly. OOBE fails to continue because updates are pendin...

This guide explains how to diagnose Intune MDM issues on a Windows device by using two key locations: Task Scheduler → EnterpriseMgmt Registry → HKLM\SOFTWARE\Microsoft\Enrollments These two locations always contain matching GUID folders , and together they show the full state of the device’s MDM enrollment. 📌 Introduction: Why do these GUID folders exist? When a Windows device enrolls into Intune (MDM) , Windows generates a unique GUID folder for that enrollment. That GUID is used in two places: 🔹 1. Task Scheduler Task Scheduler → Microsoft → Windows → EnterpriseMgmt → {GUID} This folder contains scheduled jobs that handle: MDM sync certificate renewal policy retrieval push notification handling 🔹 2. Registry HKLM\SOFTWARE\Microsoft\Enrollments\{GUID} This folder contains detailed information: tenant ID enrollment type certificate thumbprints renewal status MDM server URLs device identity 👉 Both folders describe the same en...