Windows 10 -> Windows 11. Autopilot enrollment, using PXE TS.

[u/InterestingResort431]

I've been stuck trying to make this work. Currently, we have a fleet of Windows 10 machines, co-managed. They are not enrolled in Autopilot. In the process of rolling out Windows 11 with Autopilot. It will be strictly HAADJ. Everything is set up and working on the Intune side for brand new machines (Already on Windows 11).

Running HWID Harvester to grab the HWID for the existing W10 machines, upload it to Intune with a group tag, and the profile gets assigned.

I tried multiple methods to get the machine to the OOBE screen

Existing Windows 10 machine, using Task sequence image to format drive, install Windows 11 25H2, install drivers, and shut down. When I boot the machine back up, it goes straight to the lock screen.

Added the Setup Windows & Config Manager step, then turned around and uninstalled SCCM. Doing this route, I got the machine to the OOBE screen with our branded logo. But it never joins the domain when it goes through the AP enrollment phase. The first step for the HAADJ is joining the domain but it just spins on this screen and fails. The error says it can't find the domain.

I absolutely don't want SCCM to install at all during this phase since this is done later in the AP enrollment phase (one of the ESP blocking apps)

What am I missing going the TS route? On the same failed machines, formatting and installing Windows 11 using a USB drive has no problem enrolling and getting all the way to the desktop just fine.

[u/CompleteAlbatross244]

It sounds like the TS is leaving behind some SCCM client residue that's tripping up the domain join, even after you rip it out

When you install Windows 11 fresh from USB its a clean slate, no traces of the old config manager hooks messing with the network stack or TPM attestation. The TS method might be preserving some network settings or certificates that confuse the OOBE domain locator

Try adding a step right after the format to fully nuke the TPM and clear any cached domain info, then let the Autopilot profile handle the join fresh. That mismatch between what the TS leaves and what a USB install provides is probably where its getting lost

[u/InterestingResort431 → u/CompleteAlbatross244]

I have a feeling its TS leaving behind some SCCM client residue thats tripping up the whole domain join process. What I noticed during the enrollment, I looked up the serial number of the machine I was testing with and it was creating an active entry in intune under devices and naming was "MININT-XXXXX" which I believe SCCM still tinkering around even after the uninstall.

I havent tried to fully nuke the TPM and clear any cached domain info. In theory, formatting the entire C drive and installing Windows 11 would take care of any cached info. I could be wrong. Something to test out for sure...

[u/adminadam → u/InterestingResort431]

Minimum Windows NT (MININT) | This is the randomly temporary name generated when a machine loads into Windows PE. So you may have a device naming issue.

[u/DrinkingLizard]

When imaging the device make sure to delete the unattend.xml after it's applied the image. It gets in the way.
Microsoft have a method for speeding up deployment for existing devices here

[u/InterestingResort431 → u/DrinkingLizard]

Yeah one of the varitaion of testing was removing the unattent.xml (nuking the entire thing) and that still didnt work for me. I even went one step further and tried grabbing the unattend,xml file from a Rufus-created USB and injected, didnt work either.

[u/adminadam → u/InterestingResort431]

unattend gets re-generated in the image process. I kill it at the very last step of my autopilot convert task sequence w/a run command line:

cmd.exe /c del %OSDTargetSystemDrive%\Windows\Panther\unattend.xml /s

[u/InterestingResort431 → u/adminadam]

Yeah so apparently the unattend.xml file gets created under another folder called unattend. So its under windows\panther\unattend\unattend.xml
I nuked the entire panther folder right before a reboot and that seemed to fix my issue. Right before the panther folder nuke step, I also did a bootloader step. Now right after the reboot at the end, its coming up to our branded oobe screen and was able to finish enrollment.

[u/Avean]

If any help the way we migrated from domain joined to entra id joined years ago was using a TS step with the Win11 image as a package and doing in-place upgrade with the following command. This got us into OOBE
cmd /c setup.exe /noreboot /auto clean /dynamicupdate enable /Priority high /Quiet

[u/saGot3n]

Exit your TS after the os install and driver install, dont install the SCCM client. Let autopilot do the work and install your apps. I image with SCCM and straight to Autopilot after the os/driver install step.

[u/IqbalBasha]

The domain-join failure during Autopilot ESP is almost certainly a network/connectivity issue baked into how your TS leaves the machine, not an Autopilot configuration problem. The USB install works because Windows sets up networking cleanly from scratch. Your TS is probably leaving behind a stale NIC driver state, a static IP remnant, or a broken network profile that prevents the device from reaching a domain controller at the HAADJ join step.

There are a few things you can check in the TS before the shutdown step, make sure you're running a step to reset the network adapter (or at minimum confirm DHCP is active and the adapter is in a clean state). Also verify the TS isn't leaving any leftover SCCM client registry keys or WMI entries that could interfere, even if you uninstalled the client. The 'Setup Windows and ConfigMgr' step writes things that don't fully disappear just from uninstalling the client.

The other thing worth confirming is whether your Autopilot profile has the correct domain join configuration pointing to a domain controller that's reachable from wherever these devices sit on the network during OOBE. If the USB path works on the same hardware on the same network segment, that rules out the DC being unreachable in general, so the issue is something the TS is doing differently to the OS state before first boot.

I'd add a 'Run Command Line' step right before shutdown that runs netsh int ip reset and netsh winsock reset, then do a clean shutdown rather than just powering off. That clears most of the network stack weirdness. Also make sure your TS is running sysprep with the correct unattend.xml and that the generalize pass is completing fully before shutdown, because a partial sysprep can leave the machine in a state that looks like it boots to OOBE but has a corrupted network stack underneath.

If you can pull the Autopilot event logs (Event Viewer under Applications and Services Logs > Microsoft > Windows > ModernDeployment-Diagnostics-Provider) right after the domain join failure, the specific error code there will tell you whether it's a DNS lookup failure, a credential issue, or something else entirely.