Windows Autopilot Reset provides a fast way to return managed Windows devices to a clean, IT-approved state. It removes personal files, installed apps, and user settings, then reconstructs a fresh OS from the existing WinSxS store. The device keeps its Microsoft Entra ID join, Intune enrollment, Wi-Fi configuration, SCEP certificates, and regional settings.
This is different from a factory reset or full wipe. A factory reset removes everything, including the device's identity in your tenant, and requires full re-enrollment. Autopilot Reset skips that by preserving the management connection, so the next user can sign in and start working without IT needing to re-provision the device.
Intune supports two methods: remote reset (triggered from the admin center) and local reset (triggered from the device lock screen with Ctrl+Win+R). This tutorial covers both methods, from verifying prerequisites through monitoring completion and troubleshooting common failures.
Before you start
What you will learn
- You'll learn how to perform both remote and local Windows Autopilot Reset through Microsoft Intune, including prerequisites, policy configuration, execution, and post-reset verification.
- Autopilot Reset returns a Windows device to a business-ready state without a full reimage. It removes user files, apps, and settings while keeping the device's Entra ID join, Intune enrollment, Wi-Fi profiles, and regional settings intact, saving significant time when redeploying devices.
Requirements
- Access to the Microsoft Intune admin center at intune.microsoft.com. For remote reset, you need the Intune Service Administrator or Help Desk Operator role. For local reset, you need local administrator credentials on the device.
- Windows 10 or later, Microsoft Entra ID joined (not hybrid joined), enrolled in Intune MDM, and WinRE enabled.
- Intune Service Administrator (remote reset)
- Help Desk Operator (remote reset)
- Local Administrator on device (local reset)
Good to know
- Remote reset takes about 5 minutes to initiate; the device-side process typically runs 30 to 60 minutes.
- Steps verified against current Microsoft Learn documentation for Windows Autopilot Reset in Intune.
Quick answer
Open the Intune admin center, go to Devices > All devices, select the target device, and click Autopilot Reset in the toolbar. The device removes user data and apps while keeping its Entra ID join and Intune enrollment. For local reset, press Ctrl+Win+R at the lock screen and sign in with local admin credentials. Both methods require WinRE to be enabled on the device.
Microsoft Intune admin center > Devices > All devices > [select device] > Autopilot ResetStep-by-step tutorial
6 stepsVerify device prerequisites and WinRE status
Confirm the target device meets Autopilot Reset requirements before attempting any reset.
Open Command Prompt as administrator on the target device and check the WinRE status by running reagentc /info. Look for Windows RE status: Enabled. If disabled, run reagentc /enable.
Next, verify the device's Entra ID join and Intune enrollment by running dsregcmd /status. Confirm AzureAdJoined: YES and MDMUrl pointing to enrollment.manage.microsoft.com. Autopilot Reset only supports Entra ID joined devices; hybrid joined devices require a full wipe.
reagentc /infoIf WinRE can't be enabled, the recovery partition may be missing or corrupted. You'll need to repair or recreate it. Surface Hub devices are also not supported per Microsoft Learn.
Configure the local Autopilot Reset policy
Enable local Autopilot Reset from the device lock screen by deploying a device restrictions policy. Skip this step if you only plan to use remote reset.
Intune admin center > Devices > Configuration > Create > New policySign in to the Intune admin center at intune.microsoft.com. Navigate to Devices > Configuration > Create > New policy. Set Platform to Windows 10 and later, Profile type to Templates > Device restrictions. Name it Allow Autopilot Reset.
In the configuration settings, expand General and set Autopilot Reset to Allow. Assign the profile to your target device groups. By default, local Autopilot Reset is disabled; this policy enables it.
Per Microsoft Learn (January 2026 known issue), if an Intune policy sets Deny access to this computer from the network for the local account, local Autopilot Reset is blocked. Exclude devices that need local reset from that policy.
Perform a remote Autopilot Reset from the Intune admin center
Reset a device remotely without physical access by triggering Autopilot Reset from the Intune console.
Intune admin center > Devices > All devices > [device] > Autopilot ResetIn the Intune admin center, go to Devices > All devices. Select the target device. In the device toolbar, click Autopilot Reset (it may be in the overflow menu). Confirm with Yes.
The reset starts when the device next checks in with Intune. To speed this up, click Sync in the device toolbar, or locally on the device go to Settings > Accounts > Access work or school > Info > Sync. The device-side process takes 30 to 60 minutes with multiple automatic restarts.
Per Microsoft Learn, remote reset uses the RemoteWipe CSP and doesn't require any additional configuration profile. The admin must hold the Intune Service Administrator role or a custom role with Remote tasks/Wipe permission.
Execute a local Autopilot Reset from the device lock screen
Reset a device directly when you have physical access, using the lock screen shortcut.
Ensure the Device restrictions policy from Step 2 is applied. Sign out the current user so the device shows the Windows lock screen. Press Ctrl + Win + R to open the Autopilot Reset sign-in screen.
Sign in with an account that has local administrator rights on the device. After authentication, the reset starts automatically. If you have a provisioning package on a USB drive, insert it before pressing Ctrl+Win+R.
Per Microsoft Learn, local reset does not update the primary user or Entra device owner. Update them manually afterward in Intune at Devices > All devices > [device] > Properties > Change primary user.
Monitor reset progress and troubleshoot failures
Track the reset process and resolve common issues that may block completion.
Intune admin center > Devices > All devices > [device]Monitor the reset in the Intune admin center at Devices > All devices > [your device]. For remote resets, if the reset hasn't started, force a sync by clicking Sync in the device toolbar.
If the reset fails with a recovery environment error, run reagentc /enable on the device. If the device is stuck at Getting ready for more than 3 hours, verify network connectivity but don't force restart. If the local reset option doesn't appear, check that the Device restrictions policy is applied and no Deny access to this computer from the network policy is blocking it.
reagentc /enableFor remote reset, the device must check in with Intune to receive the command. If offline, the reset starts as soon as it reconnects. Do not force a restart if the device appears stuck; contact Microsoft support after 4 hours.
Verify reset completion and re-provision the device
Confirm the device is properly reset and ready for the next user.
Intune admin center > Devices > All devices > [device]In the Intune admin center, check that the device's last check-in is recent and enrollment status shows MDM. On the device, run dsregcmd /status and confirm AzureAdJoined: YES.
Complete the setup by proceeding through OOBE (remote reset) or signing in (local reset) with the intended user account. Intune policies sync and apps install automatically. If you use Enrollment Status Page, it guides the user through policy and app installation progress.
dsregcmd /status | findstr AzureAdJoinedBitLocker is temporarily suspended during reset and re-enabled automatically based on your Intune encryption policies. The recovery key is regenerated and stored in Entra ID.
What a Successful Autopilot Reset Looks Like
A successful Autopilot Reset returns the device to a clean, business-ready state. All user profiles, personal files, and non-Microsoft apps are removed. The OS is reconstructed from the local WinSxS store without downloading anything.
The device retains its Entra ID join, Intune enrollment, Wi-Fi configuration, SCEP certificates, provisioning packages, and regional settings. The next user can sign in and start working without re-enrollment.
For remote resets, the device presents the OOBE sign-in screen. For local resets, it goes directly to the Windows sign-in screen. Intune policies sync automatically during the first sign-in.
- Device at sign-in or OOBE screen with no previous user profiles. Entra ID join and Intune enrollment active. Wi-Fi connected.
- Device stuck at Getting ready, Autopilot Reset grayed out, or WinRE error. Check prerequisites (WinRE, join type, policy).
- User goes through a brief setup, then Intune policies and apps apply automatically.
- Next user signs in directly. Update primary user manually in Intune.
- WinRE is disabled or missing. Run reagentc /enable and retry.
Troubleshooting
Reset fails with recovery environment error
Cause: WinRE is disabled or the recovery partition is missing.
Run reagentc /enable in an elevated Command Prompt. If that fails, the recovery partition needs repair. Verify with reagentc /info that WinRE shows Enabled before retrying.
Autopilot Reset option grayed out in Intune
Cause: Device doesn't meet prerequisites: must be Entra ID joined (not hybrid), enrolled in Intune, running Windows 10+, and admin must have appropriate role.
Check the device join type with dsregcmd /status (AzureAdJoined must be YES, DomainJoined must be NO). Verify your admin role. For hybrid joined devices, use a full wipe instead.
Local reset shortcut Ctrl+Win+R doesn't appear
Cause: Device restrictions policy isn't deployed, or a Deny access to this computer from the network policy blocks the local admin.
Verify the Device restrictions profile shows Succeeded for the device. Force a sync. If a Deny access to this computer from the network policy is in place, exclude devices that need local reset from it (per Microsoft Learn known issue, January 2026).
Device stuck at Getting ready for hours
Cause: Network connectivity issues or slow policy downloads during the reset process.
Wait up to 3 hours before concluding the reset has failed. Verify network connectivity (Wi-Fi is preserved during reset). If stuck after 4 hours, contact Microsoft support. Do not force a restart.
Primary user not updated after local reset
Cause: Local Autopilot Reset does not update the primary user or Entra device owner by design.
Update the primary user manually in Intune at Devices > All devices > [device] > Properties > Change primary user.
Frequently asked questions
What's the difference between Autopilot Reset and a factory reset?
Autopilot Reset removes user data and apps but preserves Entra ID join, Intune enrollment, Wi-Fi profiles, SCEP certificates, and regional settings. A factory reset removes everything including the device's tenant identity and requires full re-enrollment.
Does Autopilot Reset work on hybrid Entra joined devices?
No. It only supports Microsoft Entra ID joined devices per Microsoft Learn. Hybrid Entra joined and Surface Hub devices require a full wipe. After a full reset, hybrid devices can take up to 24 hours to be ready for redeployment.
How long does Autopilot Reset take?
The device-side process typically takes 30 to 60 minutes depending on hardware and network speed. Fast SSD devices may finish in 20 to 30 minutes. Older or slower devices can take up to 90 minutes. The process includes multiple automatic restarts.
What happens to BitLocker during Autopilot Reset?
BitLocker is temporarily suspended during the reset. After the device rejoins Entra ID, BitLocker is re-enabled automatically based on your Intune encryption policies. The recovery key is regenerated and stored in Entra ID.
Can I perform Autopilot Reset on an offline device?
Local reset can be initiated offline with Ctrl+Win+R, but the device needs internet during the process for Entra ID authentication and Intune policy sync. Remote reset requires the device to be online to receive the command.
