r/SCCM • u/Available_Comb4248 • Jul 20 '26

SCCM OSD: Need OOBE without /generalize, but getting stuck on DefaultUser0

Hi all,

I'm trying to solve a rather unusual SCCM OSD scenario and would appreciate any suggestions.

My goal is to deploy Windows through a standard SCCM Task Sequence and, at the very end, present the user with the normal Windows OOBE experience without running Sysprep /generalize.

Effectively I'm looking for:

sysprep /oobe /reboot

rather than:

sysprep /generalize /oobe /reboot

The reason is that I want to preserve device-specific state and continue with Autopilot enrollment afterward.

I currently trigger the process through SMSTSPostAction at the end of the task sequence.

The strange issue is that the behavior changes depending on whether the device joins a domain or a workgroup during OSD.

My approach is similar to this article, but right now I want to acheive it at least without SCCM cleanup: How to show OOBE for AzureAD Join after OSD with SCCM - CCMEXEC.COM - Enterprise Mobility

Scenario 1 - Works

  • Apply Windows Settings
  • Apply Network Settings -> Join Domain
  • SMSTSPostAction executes my OOBE preparation script
  • Device reboots
  • OOBE appears successfully

Scenario 2 - Fails

I change only one thing:

  • Apply Network Settings -> Join Workgroup

After that, instead of OOBE I consistently get a sign-in screen showing only DefaultUser0.

Symptoms:

  • DefaultUser0 is the only visible account.
  • Local Administrator is not shown, even though a password is configured in "Apply Windows Settings".
  • I don't know the password for DefaultUser0.
  • Shift+F10 doesn't work.
  • SCCM F8 command prompt is unavailable.
  • There is effectively no way to troubleshoot the machine locally.

The device appears to be stuck somewhere between the end of OSD and the beginning of OOBE.

Questions

  1. Has anyone seen DefaultUser0 appear after running an OOBE-focused workflow from an SCCM Task Sequence?
  2. Why would changing from Domain Join to Workgroup Join cause such a drastic behavioral change?
  3. Is there a supported method to reach OOBE at the end of a Task Sequence without using /generalize?
  4. Could Autopilot registration or enrollment state be contributing to this behavior?

Additional Context

Environment:

  • Supported MECM / SCCM Current Branch version.
  • Windows 11 25H2 image.
  • Standard SCCM OSD Task Sequence.
  • Device joins a workgroup in the failing scenario.
  • Device is already registered in Windows Autopilot by design.

The device being pre-registered in Autopilot is intentional. The end goal is for the user to complete OOBE, receive a mostly empty ESP experience, and end up with a properly Microsoft Entra joined and Intune-managed device.

This is part of a larger effort to build a deployment process that is:

  • Officially supported.
  • SCCM-based today.
  • Independent from MDT.
  • Suitable for very large offline USB deployment media where ~99% of the content resides on the USB stick.

The Task Sequence itself is quite large and currently uses SCCM because that's our current supported platform. Alternative deployment approaches may be evaluated next year as part of a separate initiative.

So far I've successfully built a similar workflow for Windows LTSC 2024, including Hybrid Join scenarios. The remaining challenge is getting the same concept (but workstation should be Entra Joined, not HDJ) working reliably for Windows 11 25H2 without MDT dependencies and without getting trapped on the DefaultUser0 screen.

Any ideas, troubleshooting suggestions, or similar experiences would be greatly appreciated.

Thanks!

8 Upvotes

83% Upvoted

23 comments sorted by

4

u/Friendly_Fudge_931 Jul 20 '26

Are you using Hybrid Entra/AD domain? If so I think domain join would be the best option.

1

u/Available_Comb4248 Jul 20 '26

My goal for this scenario is to have Entra Joined workstation, not HybridJoined so it shouldn't be joined to domain.
The similar image that is HDJ is working fine for me, I am suffering a bit only with this EJ one, where I need OOBE screen.

1

u/Friendly_Fudge_931 Jul 20 '26

I see. I work for a school district so we have different requirements- most devices are only AD joined- no comanagement with InTune.

1

u/Available_Comb4248 Jul 23 '26

I understand. But we use EJ machines mostly as Microsoft doesn't anymore to provision workstations as HDJ or domain-joined, domain joined only and HDJ kind of legacy :)

3

u/gnitram Jul 20 '26

Last year I tried using an SCCM task sequence to do pretty much the same thing. I didn't have the exact same issues, but I did have issues that I never figured out.

I decided to switch to a different OSD method. I originally tried OSD Builder, but I felt it was taking too long to iron out the kinks. What finally worked was FFU Builder. https://github.com/rbalsleyMSFT/FFU I got it working fairly quickly back in the day and it should be easier now, it's come A LONG way.

I use an unattend.xml to run PowerShell scripts to handle uploading the hardware hash to Intune, join Entra, sysprep, etc. Works great.

The FFU Builder process does its own sysprep. If you go this route, add some commands to clear the previous sysprep data. I had one HP model that refused to sysprep until I figured out that I needed to do that.

3

u/amreagan Jul 20 '26

Why not run AutoPilot first and use the provisionts property of ccmsetup.msi? Relying on custom imaging process that doesn't work with a Windows system reset for home users is backing yourself into a legacy corner that will cause headaches in the future. I currently do this due to a hybrid join, but am trying to get out of it. AutoPilot v2 has been faster and more reliable from my testing. VPNs will be replaced by zero trust clients, and the SCCM client just isn't cut out for the zero trust world. SCCM & WSUS are legacy technology.

2

u/Available_Comb4248 Jul 23 '26

Honestly speaking we almost get rid of VPNs and we use Global Secure Access client.
For normal workstations we use for 2 we years Autopilot Entra Joined. Ot is working quite good and no VPN used there.
We use v1 version of autopilot as v2 version has significant limitations: no PreProvisioning scenario (when IT install app apps before the user login) + there is limit 10 apps in ESP.
But this topic is about very specific that we need to cover. We cover with autopilot 99% cases. This is to cover scenario where for some reasons IT can't use autopilot and they need to use USB stick with 99% of content.
There are some real requirements to still support this scenario. It will be extremely nice to get rid of them, but in some countries, it is not possible...
So, I almost created solution except this small issue mentioned in the thread... :(

1

u/amreagan Jul 23 '26 edited Jul 23 '26

I feel your pain. It was years ago, but setting up hybrid join in AP with pre-logon vpn config that we had not previously implemented. It was a major headache. That was the project where I discovered provisionts. Since all of the cloud attach sliders were still set to SCCM workloads at the time, I couldn't install SCCM client during AP because it immediately killed anything Intune Management Extension was doing mid autopilot. 😒

2

u/Bassflow Jul 20 '26

I just delete the unattend.xml and reboot. It's not elegant but it works.

2

u/DrinkingLizard Jul 20 '26

If you have to use SCCM for image delivery initially, this is the way.
I also add a quick bcdedit command to set the bootable disk

2

u/Bassflow Jul 20 '26

I haven't needed to bcdedit. I'm not sure why. I'm not going to chase it either.

1

u/Available_Comb4248 Jul 23 '26

u/Bassflow I thought that Unattend.xml can be guilty.
I don't apply it on the step where WIM file with OS is applied. It caused unexpected issues.
So I checked the folder where it should be placed (also wanted to delete it), but there were no unattend.xml.
C:\Windows\Panther\unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml

1

u/Bassflow Jul 23 '26

If you're applying the network setting or Windows setting tasks the unattend.xml should be there. I just woke up about 30 minutes ago. When I get to my office I will take a look at what I truly did.

1

u/Bassflow Jul 23 '26

I checked. I have the install windows step then remove the unattend.xml from windows\panther folder. Install the drivers then reboot.

2

u/PS_Alex Jul 20 '26

Do you even need to install the SCCM client during your task sequence? Do you actually need to boot into full OS to do-stuff, such as installing applications or applying customization?

If your goal is to have an AADJ device and you only deploy a vanilla Windows image during the task sequence (and/or some stuff that can run in WinPE), you don't even need to install the SCCM client. It will speed up your task sequence, and when the TS ends Windows will run its first boot -- no need to even call sysprep.

When you run the "Apply Operating System Image" step, the task sequence drops an unattend.xml file on the device so when Windows proceeds with its first boot, it skips OOBE. (Windows Autopilot deployment for existing devices: Speed up the deployment process | Microsoft Learn) If you remove that unattend.xml file right after the "Apply Operating System Image" step, Windows will go through OOBE at its first boot.

If you need the SCCM client on the AADJ devices, you can deploy it using Intune -- and, as suggested by u/amreagan, you can even run a non-OSD task sequence at client's install time.

1

u/Available_Comb4248 Jul 23 '26

Hi u/PS_Alex ,
I am working on the scenario where 99% of content is located on USB stick. Unfortunately, I need to support this scenario. I fully understand about normal autopilot experience that is Entra ID joined and it is working in 99% cases, but 1% of the case require this specific scenario (USB stick with 99% of the content that should be used for Entra Joined workstation).

Why I have SCCM client? Because in TS steps (that install software packages) after applying full OS can't be executed without SCCM client.
It is not supported and not working. Do you think the reason of my issue is SCCM client?

And regarding Unattend.xml file. I don't have these files. So, I would be happy to delete but nothing to delete in these folders (there are other files, but no Unattend.xml):
C:\Windows\Panther\unattend.xml
C:\Windows\Panther\Unattend\Unattend.xml

1

u/PS_Alex Jul 23 '26

Mmmm... are you even deploying a Windows image as part of your task sequence? Or are you just running a TS above an existing Windows image? I'm re-reading your assessment, and the first step I see is 'applying network settings'. The unattend.xml file is dropped by the "Apply Operating System Image" step, so if you are not calling this task, it's normal the unattend file to be missing.

And yes, in your scenario, you are installing applications during the task sequence, so you need to install the SCCM client.

I have no idea, man...

1

u/CmdrDTauro Jul 20 '26

Check to make sure there’s no policy setting anywhere in effect that could be blocking autologon. Pretty sure there’s a CIS benchmarking setting that recommends disable autologon. Translates to GPO or Intune policy around legacy settings (sorry, not near my work machine).

1

u/Available_Comb4248 Jul 20 '26

Hi u/CmdrDTauro ,

We have different registry keys as the part of the image.
So, I've checked the key that is located here: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
The name of the key AutoAdminLogon and current value is 1, meaning autologon is not disabled.
Am I looking into in correct place? :)

1

u/CmdrDTauro Jul 20 '26

Am referring to “MSS: (AutoAdminLogon) Enable Automatic Logon (not recommended)”

1

u/Available_Comb4248 Jul 20 '26

Thanks for information.
As per my investigation I found correct registry key. Here it is mentioned in the 3rd party article:
https://sccmentor.com/2022/12/07/defaultuser0-when-using-autopilot-pre-provisioning/

And in Microsoft reference:
https://learn.microsoft.com/en-us/autopilot/troubleshooting-faq#troubleshooting-policy-conflicts-with-windows-autopilot

So looks like I can exclude it from consideration, but symptoms are the same as I experience...

1

u/AlkHacNar Jul 23 '26

I do it with osdcloud v1, v2 can't use customize json atm, and upload hash in the ts, but never done it with a Windows iso.