Windows Autopilot device preparation - bridging the gaps

Windows Autopilot device preparation represents Microsoft’s next-generation approach to device provisioning, offering improved reliability and real-time reporting. However, the current implementation lacks four key features that many organizations depend on. This post introduces a device preparation script I’ve developed to bridge these gaps until Microsoft expands the native capabilities.

The gaps in Windows Autopilot device preparation

While Windows Autopilot device preparation brings significant improvements in deployment reliability and troubleshooting, it currently lacks four key features available in traditional Windows Autopilot:

The device preparation script addresses these limitations while also providing a location marker feature for multi-region deployments. This is common practice in the Nordics and other regions where organizations deploy a US English OS image but need to configure local keyboard layouts, timezones, and regional formatting for their users.

Prerequisites

Before deploying this script, ensure your environment meets the following requirements:

Script features

The script provides four independently configurable capabilities:

Device renaming

Applying consistent device names is one of the most common enrollment requirements. The script supports three naming methods:

The SHA256 hash method generates consistent, unique names - the same device will always receive the same name, even if re-enrolled.

Naming logic:

• NetBIOS compliance: Names are truncated to 15 characters; invalid characters and leading/trailing hyphens are removed automatically
• Prefix matching: If the current name already starts with the specified prefix, the script skips renaming to avoid unnecessary reboots
• Fallback handling: When the BIOS serial number is empty (common in virtual environments), a GUID is used instead

OOBE registry settings

The script configures registry settings to streamline the out-of-box experience:

These settings are written to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE]
"DisablePrivacyExperience"=dword:00000001
"DisableVoice"=dword:00000001
"HideEULAPage"=dword:00000001
"PrivacyConsentStatus"=dword:00000001
"ProtectYourPC"=dword:00000003

OOBE Registry Export

BitLocker validation (Preview)

This feature addresses the timing challenge where Windows enables BitLocker with default settings before your Microsoft Intune policy arrives. The script logs the current encryption state including protection status, encryption method (e.g., XtsAes256), key protectors, and volume status.

Location marker

This convenience feature creates a registry-based flag for multi-region deployments. When deploying en-US images to locations like Denmark, downstream scripts can read this marker to apply appropriate regional settings (timezone, keyboard layout, date/number formatting).

This pairs well with solutions like my Windows gecko  project for automated regional configuration.

Script parameters

The script accepts several parameters to customize its behavior:

Enabling and disabling features

The -Features parameter uses a bitmask to control which features are enabled. This provides granular control over script behavior without modifying the script itself:

Common combinations:

.\device-preparation.ps1

.\device-preparation.ps1 -Prefix "WIN-" -Suffix "-01" -NamingMethod "%SERIAL%"

.\device-preparation.ps1 -Prefix "PC" -NamingMethod "%RAND:8%"

.\device-preparation.ps1 -Features 7 -Prefix "PC" -NamingMethod "%SERIAL%"

.\device-preparation.ps1 -LocationMarker "USA" -LocationMarkerPath "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Contoso\Location"

Deploying with Microsoft Intune

Deploying this script involves three steps: customizing the default values in the script, uploading it to Microsoft Intune, and adding it to your Windows Autopilot device preparation policy.

Customizing default values

Microsoft Intune does not support passing parameters to PowerShell scripts, so you must modify the default parameter values directly in the script’s param() block before uploading. If your organization requires signed scripts, sign the script after making your modifications.

Locate the param() block and modify the values after the = sign:

param (
    [int]$Features = 15,           # Change to 7 to disable location marker
    [string]$Prefix = "WSR5",      # Your naming prefix (max 5 chars)
    [string]$NamingMethod = "",    # Use "%SERIAL%" or "%RAND:x%"
    [string]$LocationMarker = "DEN" # Your region code
)

Parameter block excerpt

Uploading the script to Microsoft Intune

1. Navigate to Microsoft Intune admin center > Devices > Scripts and remediations > Platform scripts
2. Click + Add and select Windows 10 and later
3. Enter the script properties and upload the script file
4. Configure the script settings as shown below
5. Assign to your target group (see assignment options below)

Script settings:

Assignment options:

1. Enrollment time grouping (Preferred): Assign to the same group used in your device preparation profile for immediate delivery during enrollment.

Adding the script to the Windows Autopilot device preparation policy

The script must be added to your device preparation policy to execute during enrollment:

1. Navigate to Microsoft Intune admin center > Devices > Enrollment > Windows Autopilot device preparation
2. Select Device preparation policies and choose your policy
3. Under Settings > Scripts, click +Add and select the uploaded script
4. Save and apply

Testing and troubleshooting

Before deploying to production, thoroughly test the script in a non-production environment. My preferred approach is using Windows Sandbox  - it provides a clean, isolated Windows environment that resets on every launch, making it ideal for testing scripts without affecting your host system.

To replicate how Microsoft Intune invokes scripts, run the script from an elevated command prompt using the same parameters:

powershell.exe -ExecutionPolicy Bypass -NoProfile -File ".\device-preparation.ps1"

To preview changes without executing, add -WhatIf after the script path:

powershell.exe -ExecutionPolicy Bypass -NoProfile -File ".\device-preparation.ps1" -WhatIf -Verbose

After execution, verify the results:

# View recent log entries
Get-Content "$env:ProgramData\Microsoft\IntuneManagementExtension\Logs\DevicePreparation.log" -Tail 50

# Verify pending reboot flag after rename
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update" -Name "RebootRequired" -ErrorAction SilentlyContinue

Reading the logs

The script writes CMTrace-compatible logs to %ProgramData%\Microsoft\IntuneManagementExtension\Logs\DevicePreparation.log with entry types for informational messages (1), warnings (2), and errors (3). A summary at the end shows the status of each operation.

Get the script

The device preparation script is available on GitHub as part of the Windows Kaleidoscope  repository:

• Device Preparation Script  (direct link)
• README and Documentation  (direct link)

The script has been verified with PSScriptAnalyzer and tested in PowerShell Constrained Language mode for compatibility with enterprise security configurations.

Summary

This device preparation script bridges the gaps in Windows Autopilot device preparation by providing device naming, OOBE streamlining, BitLocker validation, and location markers in a single, well-logged solution. Test thoroughly with the -WhatIf parameter before production deployment.

Happy provisioning!

–Jesper

Header image attribution: Image created with help from Microsoft Copilot