Create a bootable Windows 10 Autopilot device with PowerShell! | Powers Hell

[utterances-bot]

Create a bootable Windows 10 Autopilot device with PowerShell! | Powers Hell

The most common complaint that I’ve received from people over the last few years around Intune / Autopilot / Modern Management is that people find it frustrating how much effort is involved in getting a device prepared to handover to a client for Autopilot enrollment.

https://powers-hell.com/2020/05/04/create-a-bootable-windows-10-autopilot-device-with-powershell/

[adzale]

Autopilot is having an issue today. there is a service degradation

[krizzie13]

any clear solution on the error: error while getting DeviceId of potential windows target drives i'm getting this on the new devices that arrive from Dell, currently testing this on 7420.

[Kaushalsingh131]

Hi , I am getting Error while getting DeviceID of USB stick . NO additional Storage device must be attached.

The above steps did not work.. i tried using ISO from media creation tool as well.

In reality their is not any another storage device... Please advice what can be done in this case

[krizzie13]

any clear solution on the error: error while getting DeviceId of potential windows target drives i'm getting this on the new devices that arrive from Dell, currently testing this on 7420.

anybody did add intel raid drivers to the usb stick? if i change the Bios from Raid to Aichi the usb still works?

[Lennethx]

As stated with a few others, and myself a while ago - the DeviceID USB Stick error is coming up often. I presumed as its seeing the USB Stick as a MediaType of Unspecified via a "Get-PhysicalDisk"

But even after forcing a "SSD" or "HDD" to the drive before that line is ran, its still failing.

Any idea's?

[Kaushalsingh131]

As stated with a few others, and myself a while ago - the DeviceID USB Stick error is coming up often. I presumed as its seeing the USB Stick as a MediaType of Unspecified via a "Get-PhysicalDisk"

But even after forcing a "SSD" or "HDD" to the drive before that line is ran, its still failing.

Any idea's?

On dell laptop-- in BIOS--Storage-- I changed to AHCI from RAID and it worked for me. The previous OS was built on RAID on

[Lennethx]

Would there be a way of adding the hash of the machine to upload to endpoint so we could future wipe the device over and over if required? As so far its adding them, but after a wipe seems to clear them from the endpoint enrolment.

Cheers.

[marky1975]

Would there be a way to add a group tag so the device is automictically joined to a group to get the correct device configuration profiles?

[Gianlucas94]

Hi, So... I have to make one stick for each device?

I'm searching for a way to re-deploy windows on a wiped machine.

[tabs-not-spaces]

Shouldn't need to - just change out the drivers for the devices if you have to customize it

On Wed, 22 June 2022, 3:35 pm Gianlucas Almeida, @.***> wrote:

Hi, So... I have to make one stick for each device?

I'm searching for a way to re-deploy windows on a wiped machine.

— Reply to this email directly, view it on GitHub https://github.com/tabs-not-spaces/powers-hell-blog/issues/8#issuecomment-1163106476, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIDA4LJWE3YDHKBK55WASZ3VQMJBJANCNFSM5CP4QVEQ . You are receiving this because you modified the open/close state.Message ID: @.***>

[mcdogg]

How do I reset the cached credentials? I managed to make usb succesfully for one azure account, but I need to recreate for a different azure account? thanks

[micceo]

Looks awesome! But,.. Hangs on this stage. "Grabbing Autopilot config file from Azure.. Multiple Autopilot policies found - select the correct one.." Waited a while, but don't get the opportunity to choose. Any fix for this?

[tabs-not-spaces]

No fix because this isn't a big. It should display a list of option in an "outgridview" process.

On Sat, 27 Aug 2022, 7:40 pm Mikael Östergren, @.***> wrote:

Looks awesome! But,.. Hangs on this stage. "Grabbing Autopilot config file from Azure.. Multiple Autopilot policies found - select the correct one.." Waited a while, but don't get the opportunity to choose. Any fix for this?

— Reply to this email directly, view it on GitHub https://github.com/tabs-not-spaces/powers-hell-blog/issues/8#issuecomment-1229160025, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIDA4LI6XKDDSK2BGCMYL23V3HPA5ANCNFSM5CP4QVEQ . You are receiving this because you modified the open/close state.Message ID: @.***>

[micceo]

And... running it a second time, the grid pops up and I can see the profiles. Kudos for the swift response. Continue to check your solution out.

[josteinthorsen]

Not sure whats wrong here, but cant find install.wim image.
Used this command : Publish-ImageToUSB -winPEPath "c:\ISO\WinPE.zip" -windowsIsoPath "c:\ISO\Win10ent.iso" -getAutopilotCfg

Getting install.wim from windows media..WARNING: An error occurred while downloading the resource. √

Getting image index from install.wim.. WARNING: System cannot find file.

[tabs-not-spaces]

This generally means that your BIOS has configured your disks as removable storage. This will need to be changed.

On Tue, May 31, 2022 at 11:01 PM Kaushalsingh131 @.***> wrote:

Hi , I am getting Error while getting DeviceID of USB stick . NO additional Storage device must be attached.

In reality their is not any another storage device... Please advice what can be done in this case [image: image] https://user-images.githubusercontent.com/106600522/171179315-669656d9-bd05-45be-98d2-58ae604e51a1.png

— Reply to this email directly, view it on GitHub https://github.com/tabs-not-spaces/powers-hell-blog/issues/8#issuecomment-1142106593, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIDA4LNFMRWZTBHCHUIDPPTVMYES3ANCNFSM5CP4QVEQ . You are receiving this because you modified the open/close state.Message ID: @.***>

[ajreiter20]

Ben, thanks for your work on this. When I try to use the script to create a USB, it seems everything is working except the part where it grabs the provision script and PWSH. I end up with only 2 folders on the second partition, Drivers and Images. Drivers is empty and Images has the install WIM and imageIndex file. Any thoughts on this?

[ajreiter20]

Never mind, I see that it is in the WinPE partition...

[Viziouz]

Great tool. Thanks for this. I noticed that during the setup it looks for PPKG files. I placed the file in the correct folder but I believe it tries to copy it after to W:\Windows\Panther, but this folder doesn't exist so it errors during this step. Am I doing something wrong? What's the correct way to use this feature? I created a ppkg file that enrolls the serial into Autopilot, would be superb if this could run automatically.

[suppandalte]

Hey, Thanks for the great tutorial and script. But I'm standing on an error with "Grabbing Autopilot config file from Azure.." I installed all modules in PS 7 and 5.1 (including MSALPS)

Grabbing Autopilot config file from Azure.. Write-Error: System.Management.Automation.CommandNotFoundException: Die Benennung "Invoke-MgGraphRequest" wurde nicht als Name eines Cmdlet, einer Funktion, einer Skriptdatei oder eines ausführbaren Programms erkannt. Überprüfen Sie die Schreibweise des Namens, oder ob der Pfad korrekt ist (sofern enthalten), und wiederholen Sie den Vorgang. bei System.Management.Automation.ExceptionHandlingOps.CheckActionPreference(FunctionContext funcContext, Exception exception) bei System.Management.Automation.Interpreter.ActionCallInstruction`2.Run(InterpretedFrame frame) bei System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame) bei System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame) WARNING: No Autopilot policies found..

Sorry the text is in german... I had reinstalled all modules without fixing it... Hope you can help me! Thanks!

[aaw00]

Any plans of upgrading to "windows 11" winPE ? I need a may-23 patched winPE, and have a hard time figuring out how to patch the 10.0.19041 boot.wim

[tabs-not-spaces]

It's a good idea. You should raise an issue with this request on the github repo. Provide me with info on where to acquire the w11 release of winPE and it'll get done a lot faster.

On Fri, 23 June 2023, 10:05 am aaw00, @.***> wrote:

Any plans of upgrading to "windows 11" winPE ? I need a may-23 patched winPE, and have a hard time figuring out how to patch the 10.0.19041 boot.wim

— Reply to this email directly, view it on GitHub https://github.com/tabs-not-spaces/powers-hell-blog/issues/8#issuecomment-1603891227, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIDA4LLJAWE7MMNVI6Z6PILXMVE25ANCNFSM5CP4QVEQ . You are receiving this because you modified the open/close state.Message ID: @.***>

[aaw00]

Suggestion: maybe you would do a guide, how to create the "winPE.zip" file. I guess it is done by using the ADK PE and copype.cmd. But some modifications seems to be needed to launch the powershell script.

[steyrs]

Hi Ben! Thank you for this awesome tool :) .. Any chance you have time to upgrade the tool to handle the changes Microsoft made in order to access Microsoft Graph? (the tool fails when it tries to grab the autopilot configuration file - and to the best of my knowledge - it all boils down to failure to access Microsoft Graph due to a whole bunch of changes made recently by Microsoft)

If my coding skills were adequate I would do it myself - but unfortunately we are not there yet.

Thanks in advance - and thank you for any update regarding this matter

[headthewall]

Great tool Ben, I love it's simplicity when you get it working and it is super fast to wipe and build devices.

For anyone running in to graph or auth issues this section fixed up my modules and I was able to get the Autopilot Config working correctly

https://learn.microsoft.com/en-us/mem/autopilot/tutorial/existing-devices/install-modules#install-required-modules-to-obtain-autopilot-profiles-from-intune

[tabs-not-spaces]

It's telling you what the error is. The autopilot script has been updated to rely on the msGraph module and that module doesn't respect the default way to pass in authentication. You HAVE to use their auth cmdlet.

This would be very easy to remediate. But it would be better to not do the offline autopilot join method in my solution. Capture the hardware hash and upload it properly. Wait until the device gets an autopilot profile and then reboot to enter managed onboarding of the device.

On Mon, 17 July 2023, 10:23 pm steyrs, @.***> wrote:

@headthewall https://github.com/headthewall - followed your link - and ran the Powershell code block - provided in step 3.

Unfortunately it didn't make any difference. Still issues when the script tries to grab the AutoPilotProfile As soon as I have authenticated - it throws this error:

https://imgur.com/a/EbnXS0y http://url

— Reply to this email directly, view it on GitHub https://github.com/tabs-not-spaces/powers-hell-blog/issues/8#issuecomment-1638023600, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIDA4LIADBSGZ7CYR37Y633XQUVE3ANCNFSM5CP4QVEQ . You are receiving this because you modified the open/close state.Message ID: @.***>

[steyrs]

@headthewall - thank you for sharing this.

Besides running the code block in step 3 - in your provided link - I also had to complete the next part where you verify that Autopilot profile(s) from Intune can be viewed:

Connect-MgGraph -Scopes "Device.ReadWrite.All", "DeviceManagementManagedDevices.ReadWrite.All", "DeviceManagementServiceConfig.ReadWrite.All", "Domain.ReadWrite.All", "Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.Read"

First time it failed with an error - that I had to use multifactor authentication to connect. Second time around - I managed to get it going

[steyrs]

@tabs-not-spaces Thanks for clarifying that. In my particular use case I would like to use the offline method. I will grab the Autopilot config file manually - and copy it to the USB stick instead.

........

It's telling you what the error is. The autopilot script has been updated to rely on the msGraph module and that module doesn't respect the default way to pass in authentication. You HAVE to use their auth cmdlet. This would be very easy to remediate. But it would be better to not do the offline autopilot join method in my solution. Capture the hardware hash and upload it properly. Wait until the device gets an autopilot profile and then reboot to enter managed onboarding of the device. … On Mon, 17 July 2023, 10:23 pm steyrs, @.> wrote: @headthewall https://github.com/headthewall - followed your link - and ran the Powershell code block - provided in step 3. Unfortunately it didn't make any difference. Still issues when the script tries to grab the AutoPilotProfile As soon as I have authenticated - it throws this error: https://imgur.com/a/EbnXS0y http://url — Reply to this email directly, view it on GitHub <#8 (comment)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIDA4LIADBSGZ7CYR37Y633XQUVE3ANCNFSM5CP4QVEQ . You are receiving this because you modified the open/close state.Message ID: @.>

[tabs-not-spaces]

Just add the auth step before the autopilot script runs. You'll probably need to use deviceCode flow.

On Mon, 17 July 2023, 10:38 pm steyrs, @.***> wrote:

@tabs-not-spaces https://github.com/tabs-not-spaces Thanks for clarifying that. In my particular use case I would like to use the offline method. I will grab the Autopilot config file manually - and copy it to the USB stick instead.

........

It's telling you what the error is. The autopilot script has been updated to rely on the msGraph module and that module doesn't respect the default way to pass in authentication. You HAVE to use their auth cmdlet. This would be very easy to remediate. But it would be better to not do the offline autopilot join method in my solution. Capture the hardware hash and upload it properly. Wait until the device gets an autopilot profile and then reboot to enter managed onboarding of the device. … <#m9116299851760199978> On Mon, 17 July 2023, 10:23 pm steyrs, @.> wrote: @headthewall https://github.com/headthewall https://github.com/headthewall https://github.com/headthewall - followed your link - and ran the Powershell code block - provided in step 3. Unfortunately it didn't make any difference. Still issues when the script tries to grab the AutoPilotProfile As soon as I have authenticated - it throws this error: https://imgur.com/a/EbnXS0y https://imgur.com/a/EbnXS0y http://url http://url — Reply to this email directly, view it on GitHub <#8 (comment) https://github.com/tabs-not-spaces/powers-hell-blog/issues/8#issuecomment-1638023600>, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIDA4LIADBSGZ7CYR37Y633XQUVE3ANCNFSM5CP4QVEQ https://github.com/notifications/unsubscribe-auth/AIDA4LIADBSGZ7CYR37Y633XQUVE3ANCNFSM5CP4QVEQ . You are receiving this because you modified the open/close state.Message ID: @.>

— Reply to this email directly, view it on GitHub https://github.com/tabs-not-spaces/powers-hell-blog/issues/8#issuecomment-1638050695, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIDA4LLFUAZVNRT3LP3BDWTXQUW43ANCNFSM5CP4QVEQ . You are receiving this because you were mentioned.Message ID: @.***>

[steyrs]

Thanks - I might have a look when I have some more spare time on my hand. My coding skills are limited - so I need a bit more headroom before getting into this.

[RSchahal11]

I've tried the solution but getting an error while booting from USB "Error while getting DeviceId of USB Stick. No additional USB storage devices must be attached".

I have only one USB attached though but couldn't figure out why it throwing this error.

[tabs-not-spaces]

Generally, this refers to a bios configuration where the USB devices are being read as external storage and not as a bootable usb.

On Mon, Aug 28, 2023 at 12:31 PM RSchahal11 @.***> wrote:

I've tried the solution but getting an error while booting from USB "Error while getting DeviceId of USB Stick. No additional USB storage devices must be attached".

I have only one USB attached though but couldn't figure out why it throwing this error.

— Reply to this email directly, view it on GitHub https://github.com/tabs-not-spaces/powers-hell-blog/issues/8#issuecomment-1694912809, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIDA4LN2QF3HSKJRIJDZBT3XXP7JXANCNFSM5CP4QVEQ . You are receiving this because you were mentioned.Message ID: @.***>

[aaw00]

Thanks for a great tool.

I would like to use a winPE patched with may 2023 updates due to KB5025885. The Windows 10 winPE in the Winpe.ZIP file is version 10.0.19041 and I cannot figure out any way to get that patched.

So I tried to use a Windows 11 based winPE from the ADK. That one could I patch. And I use that one with MDT.

I have "reverse engineered" the winpe.zip and found two modifications (startnet.cmd in system32 in the boot.wim, and the "script" folder). I did those modifications on my Win11 based winPE. I boots and starts the project, But fails with the error "USB - Error while getting DeviceId of USB Stick. No additional USB storage devices must be attached". Booting an USB made with the original winpe.zip works on the same computer.

Help would be appreciated.

[javiermoro]

@aaw00

You have to include powershell support into WinPE (boot.wim)

https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/winpe-adding-powershell-support-to-windows-pe?view=windows-11

[aaw00]

@javiermoro

I thought powershell support on this media was handled by the powershell placed in d:\script\pwsh

[javiermoro]

@aaw00

I had the same problem. Adding powershell support to the wim adds some cmdlets not included by default and needed by the Powershell 7 installation.

[pethealthinc]

Grabbing Autopilot config file from Azure.. Creating implicit remoting module ... [Getting command information from remote session ... 970 commands received 6s]

Write-Error: Microsoft.Graph.PowerShell.AuthenticationException: Authentication needed. Please call Connect-MgGraph. at System.Management.Automation.MshCommandRuntime.ThrowTerminatingError(ErrorRecord errorRecord) WARNING: No Autopilot policies found..

Configuring USB..

Number TotalSize(GB) Name

---

 1         28.91 PNY USB 3.2.1 FD

Please select Desired disk number for USB creation or CTRL+C to cancel:

[dominicene]

Great work Ben! I was watching the youtube demo video, reviewing the material on this site and I do have 2 questions. You touched on this momentarily about using your own custom image. First question. Do you put the custom .wim file(s) in the "image" folder as you eluded to in the youtube video? Second question. If so, can I drop more than 1 .wim file in the "images" folder? I'm just wondering how would the tool determine which image to apply in DISM. Hope these questions don't sound stupid.

[dominicene]

Decided to give it a try and getting the following ........

Setting up configuration paths..

Getting WinPE media.. Checking if file already downloaded.. √ .zip Size: 0.405697008594871 Checking if file already unzipped.. √ Folder Size: 0.428764617070556

Getting install.wim from windows media..√

Grabbing Autopilot config file from Azure.. WARNING: Could not load type 'System.Security.Cryptography.SHA256Cng' from assembly 'System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'.

Configuring USB..

Disk number 1 selected.

Clearing Disk: 1 Creating New Partions

Writing WinPE to USB..√

Writing Install.wim to USB..√

Writing Autopilot to USB..√

Setting up folder structures for Drivers.. Grabbing provision script from GitHub.. WARNING: The SSL connection could not be established, see inner exception. PS C:\Windows\System32>

[ronaldbok]

Great work Ben! I do have a suggestion for a feature option. Is it Posable to include the XML file for the Wifi zo it will autoconnect ?

Greetings Ronald

[loganhawker]

When grabbing the autopilot config: "AADSTS700016: Application with identifier 'd1ddf0e4-d672-4dae-b554-9d5bdfd93547' was not found in the directory"

Plan for Change: Update your PowerShell scripts with a Microsoft Entra ID registered app ID

"If you're using the Intune PowerShell application ID (d1ddf0e4-d672-4dae-b554-9d5bdfd93547), you'll need to update your scripts with a Microsoft Entra ID registered application ID to prevent your scripts from breaking."

[stevemg7]

I am guessing that what @loganhawker said remains an issue and will no longer be supported? If perhaps I am missing something can someone let me know? I got the same exact error and I suspect it's just because the script hasn't been updated. I'd really love to be able to make this work because it's by far the sleekest/cleanest process I've seen for doing exactly what I am trying to do.

[tabs-not-spaces]

Hi @loganhawker @stevemg7, as the "well known" intune app has been discontinued, I have no updated the tool to use a custom app registration. Currently the only plans are to remove "offline join" as there are better solutions that work today.

Please feel free to review the solution and provide feedback / contributions for review.

On Wed, 4 Sept 2024, 7:36 pm stevemg7, @.***> wrote:

I am guessing that what @loganhawker https://github.com/loganhawker said remains an issue and will no longer be supported? If perhaps I am missing something can someone let me know? I got the same exact error and I suspect it's just because the script hasn't been updated. I'd really love to be able to make this work because it's by far the sleekest/cleanest process I've seen for doing exactly what I am trying to do.

— Reply to this email directly, view it on GitHub https://github.com/tabs-not-spaces/powers-hell-blog/issues/8#issuecomment-2329731723, or unsubscribe https://github.com/notifications/unsubscribe-auth/AIDA4LNSMEABVMCYX7Y63Z3ZU5HJNAVCNFSM5CP4QVE2U5DIOJSWCZC7NNSXTN2JONZXKZKDN5WW2ZLOOQ5TEMZSHE3TGMJXGIZQ . You are receiving this because you were mentioned.Message ID: @.***>