Hybrid join Autopilot deployments time out with 0x80004005: the 2026 known issue and the fix

You start a user-driven Autopilot deployment that joins the device to on-premises Active Directory and Microsoft Entra ID, and instead of finishing, the Enrollment Status Page (ESP) reports a timeout with error 0x80004005. In February 2026 Microsoft documented this as a Windows known issue that is fixed by specific cumulative updates. In this post I'll go through exactly what the official page says, how to confirm a device is on an affected build, how to get the fix onto devices that haven't enrolled yet, and how to verify the result.

Symptoms#

• The Autopilot deployment profile has Join to Microsoft Entra ID as set to Microsoft Entra hybrid joined. Cloud-native (Entra join only) deployments aren't part of this known issue.
• The deployment stalls and then fails with a timeout that carries error code 0x80004005. Microsoft's page describes the symptom only as "timeout errors with error code 0x80004005 in the deployment process" and doesn't name a specific ESP step.
• The device is running a Windows 11 build older than the fixed builds listed below. Devices on a current build don't hit this issue.

One word of caution: 0x80004005 is the generic E_FAIL HRESULT ("Unspecified error"). On its own it doesn't prove you're looking at this known issue, which is why the build check in the fix section matters.

Why it happens#

Microsoft hasn't published a root cause beyond stating that the issue is resolved by Windows cumulative updates, so this is a client-side defect in Windows rather than an Intune or connector problem. Because cumulative updates are, well, cumulative, any update released after the ones listed also contains the fix. I pulled the build numbers from the KB articles so you can compare them with what a failing device reports:

Preview updates roll into the following month's security update, so for 25H2 any October 2025 or later cumulative update qualifies, and for 23H2 the December 2025 security update or later does.

How to fix it#

1. Rule out the usual hybrid join suspects first. A hybrid join deployment also times out when the device can't reach a domain controller, when the Intune Connector for Active Directory is inactive or can't create computer objects in the target OU, or when a VPN scenario is missing Skip AD connectivity check in the Autopilot profile. Check Devices › Windows › Enrollment › Intune Connector for Active Directory shows the connector as Active, and on the connector server review Applications and Services Logs › Microsoft › Intune › ODJConnectorService.
2. Check the build on the failing device. At the ESP error screen press Shift+F10, type powershell and run:
   PowerShell

   Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
     Select-Object DisplayVersion, CurrentBuild, UBR

   If CurrentBuild.UBR is lower than the fixed build for that version in the table, the device is on an affected build.
3. Collect logs before you change anything. From the same command prompt run mdmdiagnosticstool.exe -area Autopilot -cab C:\autopilot.cab and copy the file to a USB drive. On Windows 11, if your ESP profile has Turn on log collection and diagnostics page for end users set to Yes, Ctrl+Shift+D opens the Autopilot diagnostics page. The DeviceManagement-Enterprise-Diagnostics-Provider › Admin event log inside the cab is where enrollment and policy errors land.
4. Get the fixed update onto devices before they reach OOBE. This is the real fix, and you have a few options:
   • OEM devices: ask your OEM which cumulative update is in the shipping image. Images built after late 2025 normally include the fix already.
   • Your own media: add the current cumulative update to the image offline. The KB articles document the command, which is DISM /Image:<mountdir> /Add-Package /PackagePath:<update>.msu with the package downloaded from the Microsoft Update Catalog. Microsoft also publishes installation media with the latest cumulative update included in the Microsoft 365 admin center.
   • A handful of devices on your desk: at the first OOBE screen press Shift+F10, install the .msu with DISM /Online /Add-Package, restart and then start the deployment. Test this on one device before relying on it.
5. Retry the deployment on the updated build. If it still times out with the same code, you're looking at something else; go back to step 1 with the logs you collected.

Verify the fix#

• The PowerShell check above returns a build at or above the fixed build for the device's version.
• The ESP completes both the device and the account setup phase, and the device lands on the desktop with no error page.
• In the Microsoft Intune admin center, the Windows Autopilot deployment report under Devices › Monitor shows the deployment as successful. Microsoft notes a known reporting quirk here: the deployment duration includes the time the user spends signing in at the lock screen if a reboot happened during OOBE, so don't read a long duration as a failure.
• On the finished device, dsregcmd /status shows DomainJoined : YES and AzureAdJoined : YES, and the computer object exists in the OU named in your Domain Join profile.
• Expect two device objects in Microsoft Entra ID for a hybrid deployment (one pre-created at Autopilot registration, one from the hybrid join) and a compliance state of N/A until a user signs in. Both behaviours are documented as by design.

Prevent it next time#

• Treat the cumulative update level of your deployment images as a deliverable. Refresh OEM and custom images at least quarterly and record the build you expect to see at OOBE.
• Subscribe to the RSS feed linked at the top of the Windows Autopilot known issues page so new entries reach you without checking manually.
• Pair this with the Install Windows quality updates ESP setting only after your images include KB5079473 or later, otherwise hybrid deployments may skip the updates anyway.
• Longer term, Microsoft's own guidance on the hybrid join page is to deploy new devices as cloud-native Microsoft Entra joined. Every hybrid-only known issue on the page, including this one, is a reason to plan that move.

References#

• Windows Autopilot known issues
• Deploy Microsoft Entra hybrid joined devices by using Intune and Windows Autopilot
• Troubleshooting the Enrollment Status Page