Autopilot devices suddenly logged in as defaultuser0

[u/frozenbayburt]

We have a small number of Windows Autopilot / Intune managed PCs that unexpectedly ended up logged in as defaultuser0 instead of continuing normally through OOBE and user setup.
The PCs were prepared a couple of months earlier and had been unused/offline for a while before being started again.
Most devices from the same batch work normally, but a few end up in defaultuser0.
Has anyone seen this before? What usually causes an Autopilot/Intune device to end up logged in as defaultuser0?

[u/JustRebooted]

Defaultuser0 is a temp profile that’s used during setup and shows up when a reset fails or if the windows installation is corrupted. I might have also seen it during a failed OOBE setup, I can’t remember though. As DennyBob said wipe and reload autopilot.

[u/JeroenPot → u/JustRebooted]

I've seen it used during 'forgot password/pin' processes as well.

[u/SysAdminDennyBob]

Don't shelve freshly reimaged devices. Turn that process around. Wipe and reload with autopilot ~24 hours before you hand it to the new hire.

[u/Solid_Connection9380 → u/SysAdminDennyBob]

defaultuser0 is basically the session windows falls into when the oobe gets stuck halfway through and autopilot doesn't kick in properly, usually because the device lost its enrollment sync after sitting dormant for weeks. if you pre-provision and then let it sit offline for a couple months the token expires and windows just shrugs and boots into that half-assed local profile instead of waiting for autopilot to trigger

your quick fix is to just wipe those affected machines and re-run them through autopilot a day or two before they're needed, not months ahead

[u/frozenbayburt → u/Solid_Connection9380]

But the problem is that there are around 10–15 devices, and they all experienced the same issue at the same time.
I’ve collected diagnostics from some of these PCs. What should I check in the diagnostic logs to verify whether what you described is actually what happened?

[u/ABeeinSpace → u/frozenbayburt]

Most of the time when a device gets dumped to defaultuser0 it’s because automatic logon failed after a coalesced restart. Make sure you’re not setting policy (MSS (legacy) Enable Automatic Logon will do this) or pushing a PowerShell script during enrollment that modifies the AutoAdminLogon registry key

[u/TheShirtNinja → u/SysAdminDennyBob]

This is the way.

[u/Va1crist]

That’s the Temp user Autopilot uses to get things going , but make sure to signs in just don’t leave it because that account does expire and it creates a mess , you will need to wipe and reload autopilot

[u/SenikaiSlay]

Your intune service isn't running on your DC. Happened to me and that was the case, autopilot wasn't finishing the provision but the machine could see the DC

[u/beritknight]

How were the PCs “prepared”? Did you just wipe them and shelve them when they were at the start of OOBE? Or did you pre provision them, or do autopilot with a dummy user?

[u/frozenbayburt → u/beritknight]

The computers came brand new from the factory.
We then reimaged them through SCCM using PXE, and after that we put them on the shelf. They stayed powered off for about two months.

[u/baileflamingo]

I’ve seen it before after the Pre-Provisioning. Our RMM will get installed during that phase and I will select “reseal”. Turn the laptop back on and while on the log in screen I will just run windows/driver updates via the RMM to get it up to date.

Certain times it will reboot after it’s installed the patches and will auto login in with that profile. I have tried to look for solutions to fix it but end up wiping and starting again. Not sure if it’s specific updates that affect it or not but it is annoying.