0

I'm working on an intune environment. Devices are able to successfully join in user attended mode. However when I set it to self-deploy devices fail on securing hardware with the following code: 0x800705b4. This code seems related to the TPM timing out. Autopilot passes this stage instantly in the user attended mode.

I prepare the devices using a PXE WinPE setup and copying the autopilot configuration json to the device. This pairs it to intune during OOBE, I do not add the hash to intune, it does it for me during setup. The PXE script I'm using also upgrades the bios and TPM firmware before it installs windows. So the bios & TPM firmware are up-to-date during OOBE.

I have tried the following:

Ensure the time on the device is correct by setting up an NTP server on the mikrotik router and passing the NTP servers option in DHCP.

Disabled all firewall rules in the Mikrotik, it is only providing natting.

I tried multiple models of devices (HP Elitebook 850 G3, HP Elitebook 840 G3, HP Elitebook 840 G4, HP Elitedesk 800 G2, HP Prodesk 400 G3) All have the same issue.

I'm using unattend.xml to ensure the EULA is accepted.

Intune device licenses are available and assigned to the security group these devices are dynamically put into.

I have checked to ensure BIOS and TPM firmware are on the latest version available.

I'm aware that the feature is in preview state, but it beats having to manually enter credentials into 200 devices during setup. (After that the devices go into kiosk mode, no login necessary)

Can anyone give me some pointers on what I might try next?

Cheers!

-Metro

1 Answer 1

0

The TPM environment on many HPs require a certificate to be installed. This normally happens during the default HP Out-Of-Box-Experience.

We have switched to purchasing "Autopilot Ready" Dells, but my notes show that we have solved this problem with these HPs in 3 ways:

  1. Boot into the stock (bloatware) copy of Windows from HP and waited for the HP updates to apply. Once applied, it is safe to lay down a clean copy of Windows.
  2. Boot into a clean copy of Windows, install and run HP Support Assistant. Then reset the PC.
  3. From the OOBE Shift-F10 command prompt, run the HP BIOS Update tool and HP TPM Configuration tool.
8
  • Hi, Thanks for your reply. I've tried installing the hp support assistant prior to the securing hardware stage to no avail, it still times out. The bios and tpm firmware are on the latest version. In the user driven mode the laptop is able to join, in self-provision it is not. Nov 10, 2021 at 14:32
  • See if the TPM statuses are "Ready" in Windows, or, at the start of OOBE; Shift-F10, Powershell, Get-Tpm Nov 10, 2021 at 21:29
  • TPM attestation will also fail due to the time being too far off on the PC. w32tm /resync /force to sync Nov 10, 2021 at 21:32
  • Tpm is not ready for attestation, tpm is not capable for attestation. When I do a clean install using a win10 usb & manually progress through the installer both values are true. When I install it using my pxe server with dism /applyimage /applylocation both are false. Nov 10, 2021 at 22:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .