How to Fix Autopilot error 80070002

Issue

You are trying to provision a device using Microsoft Intune Windows autopilot hybrid join setup. You enter your corporate credential at the company branding screen after OOBE. The autopilot device provisioning gets stuck at the “please wait while we set up your device” screen for approximately 20-30 minutes and then shows the following error.

Something went wrong: Confirm you are using the correct sign-in information and that your organization uses this feature. You can try to do this again or contact your system administrator with the error code 80070002.

Autopilot error 80070002

Cause

The environment was correctly configured and Windows autopilot hybrid join provisioning worked fine. However, it suddenly stopped working. Since this issue is mostly related to incorrect permissions on the Active Directory OU, we focus our investigation on that.

This error usually happens when the device does not receive an offline domain join blob from the Intune connector. The device requests the offline domain join blob information when it gets the offline domain join profile from Intune. Once the Intune connector receives an ODJ request, it creates a computer account on the On-premises domain and then returns the information to Intune which passes the details back to the autopilot device. If the autopilot device does not receive the details then it keeps waiting for the details and device provisioning time out.

You need to look into the logs on the Intune connector servers to identify the exact issue. If you have more than one Intune connector server in your environment then you need to navigate to all servers one by one to know which server handled the offline domain join request.

We found the following error on the ODJConnectorService event log on the Intune connector server.

The ODJConnectorService event was showing a “Failed to call NetProvisionComputerAccount machineName=xxxx” error message.

OdJConnectorService Intune connector server log

Event viewer logs:

RequestOfflineDomainJoinBlob_Failure: Failed to generate ODJ blob
RequestId: xxxx
DeviceId: xxxx
DomainName: xxxx
RetryCount: 0
ErrorDescription: Failed to call NetProvisionComputerAccount machineName=xxxx
InstanceId: xxxx
DiagnosticCode: 268435455
WinErrorCode: 8557
DiagnosticText: We are unable to complete your request because a server-side error occurred. Please try again. [Exception Message: "DiagnosticException: 0x0FFFFFFF. We are unable to complete your request because a server-side error occurred. Please try again."] [Exception Message: "Failed to call NetProvisionComputerAccount machineName=xxxx"]

The Netsetup.log file “c:\windows\debug\Netsetup.log “on the Intune connector server was showing the below error. As per the error in the log file, the Intune connector server was unable to create a computer object in AD which indicates that permission assigned to OU was not appropriate.

NetpMapGetLdapExtendedError: Parsed [0x216d] from server extended error string: 0000216D: SvcErr: DSID-031A126C, problem 5003 (WILL_NOT_PERFORM), data 0
NetpModifyComputerObjectInDs: ldap_add_s failed: 0x35 0x216d
NetpCreateComputerObjectInDs: NetpModifyComputerObjectInDs failed: 0x216d
NetpProvisionComputerAccount: LDAP creation failed: 0x216d
ldap_unbind status: 0x0
NetpJoinCreatePackagePart: status:0x216d.
NetProvisionComputerAccount: status: 0x216d



We further checked the permission assigned to the Intune connector server computer account on the Active Directory OUs created for hybrid join devices. The Intune connector server should have full control (for Computer objects) on OU & all child containers where the computer account to be created. The correct permission was assigned earlier. However, it was changed to “This object only” due to an unknown reason.

You can follow this Microsoft article to for the steps to delegate OU permission to the Intune connector server.


Solution

Once the permission was changed to “This object and all child objects”, the issue got fixed and the Autopilot build started working fine.

Related Posts

Subscribe to Techuisitive Newsletter

Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news.


Scroll to Top