Guide: Preventing the Windows OOBE Update Loop Caused by ESP and Update Rings in Microsoft Intune

Guide: Preventing the Windows OOBE Update Loop Caused by ESP and Update Rings in Microsoft Intune

Overview

Microsoft recently enabled a new behavior in Windows Autopilot where devices may attempt to install Windows Updates during OOBE (Out-of-Box Experience). This is controlled by the ESP (Enrollment Status Page) setting:

Install Windows updates (might restart the device)

If this setting is enabled, and the device is also targeted by a Windows Update Ring, the two systems may conflict.
This often results in an OOBE update loop, where the device repeatedly restarts during setup and displays messages like the screen below:

Why was my PC restarted?

This loop continues indefinitely unless configuration is corrected.

---

Symptoms

Devices show the following behavior during Autopilot enrollment:

• Windows attempts to install updates during OOBE (triggered by ESP).
• The Update Ring simultaneously enforces updates.
• The device restarts unexpectedly.
• OOBE fails to continue because updates are pending.
• The device becomes stuck in a restart → update → OOBE → restart cycle.

This creates a blocking condition that prevents successful device provisioning.

---

Cause

The issue is caused by overlapping update policies:

1. ESP setting "Install Windows updates" = Yes

This forces devices to check for and install Windows Updates during OOBE.

2. Update Rings assigned via dynamic device groups
If you have created dynamic Update Rings groups that automatically include devices, the Update Rings will be applied immediately during Autopilot enrollment unless they are explicitly delayed or excluded.

3. Device joins both policies too early

Because Autopilot assigns device group memberships before ESP completes, the Update Ring can take over and enforce updates at the same time ESP tries to do the same.

---

Solution Summary

To stop the update loop, you must:

✅ 1. Disable “Install Windows updates” in ESP

Set ESP → Install Windows updates = NO

✅ 2. Exclude Autopilot devices from Update Rings during OOBE

Exclude your Autopilot security group from all Update Rings.

✅ 3.  Create a dedicated "Post‑Enrollment Update Ring"

Assign it only after ESP is completed.

---

Step-by-Step Guide

---

Step 1: Disable Windows Update installation in ESP

1. Go to Microsoft Intune admin center
   Devices → Windows → Enrollment → Enrollment Status Page (ESP)

2. Edit your main ESP profile used for Autopilot.

3. Locate the setting:
   Install Windows updates (might restart the device)

4. Set it to:
   ❌ NO

5. Save & assign the updated ESP.

   
   
   

Result:
Devices will no longer try to install updates during OOBE, preventing conflict with Update Rings.

---

Step 2: Exclude Autopilot Devices from Existing Update Rings

If your Update Rings target “All Devices” or similar broad scopes, you need to exclude your Autopilot device group.

1. Go to:
   Devices → Windows → Update Rings

2. Open the Update Ring profile(s) currently in use.

3. Go to Assignments.

4. Under Exclusions, add:
   ➤ Autopilot Devices
   (your dynamic group used for Autopilot provisioning)

This prevents Windows Update Rings from applying updates during OOBE.

---

Step 3 (Optional, Recommended): Create a Post‑Enrollment Update Ring

To ensure updates apply after ESP, you can create a new Update Ring that only targets completed devices.

Steps:

1. Create a new Update Ring.
2. Assign it to security grupp that you have created

This staged approach prevents OOBE interruptions while keeping devices fully updated afterward.

---

Best Practices

✔ Always exclude Autopilot devices from Update Rings

During OOBE, devices should only receive:

• ESP
• Required configuration profiles
• Required apps

✔ Keep “Install Windows updates” disabled in ESP

This removes unnecessary reboots and significantly speeds Autopilot deployment.

✔ Use Dedicated Assignment Groups

Example setup:

• Autopilot-Devices → ESP + baseline configuration only
• Production-Devices → Update Rings, Feature Updates, Q\&A updates

✔ Monitor devices in the Autopilot Deployment Report

Check for devices stuck in:

• Device Preparation: Updates
• Device Setup: Updates

---

Keywords for Search & Documentation

• Autopilot Update Loop
• ESP Windows Updates setting
• Intune OOBE forced update
• Update Ring conflict Autopilot
• Windows Autopilot restart loop
• Enrollment Status Page configuration
• OOBE update failure
• Intune device provisioning troubleshooting
• Disable updates during OOBE

---

Conclusion

This issue is caused by Microsoft enabling a new ESP update behavior that conflicts with Update Rings.
By disabling updates in ESP and excluding Autopilot devices from Update Rings, the OOBE loop is completely resolved.

If you want, I can also create:

✅ a PDF version of this guide
✅ a PowerPoint you can share with your team
✅ a shorter quick‑guide version for technicians

Would you like any of those?