To register a device with Windows Autopilot, you need to extract its hardware hash — a unique fingerprint built from device-specific identifiers such as the TPM, CPU, BIOS, and network adapters — and upload it to your Intune tenant. This guide covers every method available in 2026, including what has changed with the introduction of Autopilot v2 (Device Preparation).

Detail
Last UpdatedMarch 2026
Applies ToWindows 10 (20H2+), Windows 11, Microsoft Intune
Autopilot VersionAutopilot v1 (classic) — see note on v2 below
DifficultyBeginner

Autopilot v1 vs v2 — Do You Still Need a Hardware Hash?

Before jumping into extraction methods, it is worth understanding where hardware hashes fit in 2026. Microsoft released Windows Autopilot Device Preparation (v2) in mid-2024, and it fundamentally changes registration: v2 does not require a hardware hash at all. Devices enroll simply by the user signing in with their work account during OOBE — no pre-registration needed.

However, hardware hash extraction remains relevant for classic Autopilot (v1), which is still widely used and is the only option for:

  • Hybrid Entra ID joined deployments (v2 is cloud-only / Entra joined)
  • Self-deploying mode (kiosk, shared devices)
  • Pre-provisioning (white glove) scenarios
  • Environments where OEM registration is not available and v2 is not yet rolled out

If you are starting fresh and your environment supports it, evaluate v2 first. If you are on classic Autopilot — read on.

Method 1: Extract During OOBE (Fresh Device)

This is the most common scenario — a brand new device or one being reimaged, where you need to register it before the user receives it. After the first boot, when you reach the language/region selection screen, open a command prompt with SHIFT + F10 (on a VM use SHIFT + FN + F10, or use the on-screen keyboard). Type powershell and press Enter, then run:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted
Install-Script -Name Get-WindowsAutoPilotInfo
Get-WindowsAutoPilotInfo.ps1 -OutputFile C:\AutoPilotHWID.csv

Confirm all prompts during script download. The CSV will be saved to C:\AutoPilotHWID.csv. You can redirect the output to a USB drive by changing the path — for example -OutputFile D:\AutoPilotHWID.csv — which makes it easy to transfer to another machine for upload.

Method 2: Register Directly to Intune (Online Mode)

If you have internet access and Intune admin credentials available, you can skip the CSV entirely and register the device directly to your tenant in one step:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted
Install-Script -Name Get-WindowsAutoPilotInfo
Get-WindowsAutoPilotInfo.ps1 -Online

You will be prompted to sign in with your Intune Administrator or Global Administrator credentials and complete MFA. Once authenticated, the device hash is uploaded directly and the device appears under Windows enrollment > Devices in the Intune portal within a few minutes.

Method 3: Extract from an Already-Deployed Device

If the device already has a working Windows installation and you need to retroactively register it for Autopilot, run PowerShell as Administrator from within the OS:

Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
Install-Script -Name Get-WindowsAutoPilotInfo -Force
Get-WindowsAutoPilotInfo.ps1 -OutputFile C:\AutoPilotHWID.csv

Method 4: Bulk Extract via SCCM / MECM

If you have SCCM co-management configured, you do not need to touch each device individually. In the MECM console, go to Assets and Compliance > Devices, select the target device collection, right-click and choose Convert to Autopilot. MECM fetches the hardware hashes from its inventory data and pushes them directly to Intune.

For bulk extraction without the Convert to Autopilot feature, deploy the following script as a SCCM script or package to the collection:

# Run on each device, output to a shared UNC path
$outputPath = "\\server\share\AutopilotHashes\$env:COMPUTERNAME.csv"

Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force
Install-Script -Name Get-WindowsAutoPilotInfo -Force
Get-WindowsAutoPilotInfo.ps1 -OutputFile $outputPath

Collect all the individual CSV files and merge them before uploading to Intune. You can merge them with a simple PowerShell one-liner:

# Merge all CSV files in a folder into one
$csvFiles = Get-ChildItem -Path "\\server\share\AutopilotHashes\" -Filter "*.csv"
$merged = $csvFiles | ForEach-Object { Import-Csv $_.FullName }
$merged | Export-Csv -Path "C:\MergedAutoPilotHWIDs.csv" -NoTypeInformation

Adding a Group Tag

Group tags let you automatically assign Autopilot deployment profiles to devices via dynamic Entra ID groups. You can add a group tag at extraction time using the -GroupTag parameter:

# Extract with group tag — direct upload to Intune
Get-WindowsAutoPilotInfo.ps1 -Online -GroupTag "CorporateLaptop"

# Or export to CSV with group tag included
Get-WindowsAutoPilotInfo.ps1 -OutputFile C:\AutoPilotHWID.csv -GroupTag "CorporateLaptop"

If you have already exported a CSV without a group tag, you can add it manually by opening the file and adding a Group Tag column with the desired value.

Uploading the CSV to Intune

  1. Go to Intune admin center → Devices → Enrollment → Windows Autopilot devices
  2. Click Import
  3. Browse to your CSV file and click Import
  4. Wait for the import to complete — this typically takes 5–15 minutes
  5. The device will appear in the Autopilot devices list once processed
  6. Assign an Autopilot deployment profile to the device or its group

Under Profile status, wait until the status changes from Pending to Assigned before proceeding with device provisioning.

Quality Updates During OOBE — What Changed in 2026

As of the January 2026 Windows security update, devices running Windows 11 22H2 or later will install quality updates by default during OOBE as part of Autopilot provisioning. This adds 20–40 minutes to the provisioning process and may trigger a restart. You can control this behaviour via a new setting in the Enrollment Status Page (ESP) profile:

  • Navigate to Devices → Enrollment → Windows → Enrollment Status Page
  • Edit your ESP profile and find the setting Install Windows quality updates (might restart the device)
  • Set to No if you want to suppress quality updates during OOBE provisioning

To ensure update deferral and pause settings from your Windows Update rings policy are respected during OOBE, assign both the ESP profile and the Update rings policy to the same Autopilot-registered device group.

Troubleshooting Common Issues

IssueCauseFix
Script download fails during OOBENo internet accessConnect to network first; check if OOBE Wi-Fi prompt was completed
NuGet provider install prompt loopsExecutionPolicy not setRun Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted first
Device does not appear after CSV importImport still processingWait 15 minutes and refresh; check for import errors in the Autopilot devices blade
Profile status stays “Pending”No profile assignedAssign an Autopilot deployment profile to the device or its dynamic group
Hash already registered errorDevice registered in another tenantThe previous tenant must delete the device from their Autopilot devices first

Summary

Hardware hash extraction remains the standard registration method for classic Windows Autopilot (v1) deployments in 2026. The Get-WindowsAutoPilotInfo script covers all scenarios — OOBE, existing OS, and bulk extraction via SCCM. If you are building a new Autopilot deployment from scratch, evaluate whether Autopilot v2 (Device Preparation) fits your environment first, as it eliminates the hash extraction step entirely for cloud-joined scenarios.

  • Use -Online for direct registration to Intune during OOBE
  • Use -OutputFile to export a CSV for later upload or bulk merging
  • Add -GroupTag to automatically assign profiles via dynamic groups
  • Review ESP quality update settings if provisioning time has increased unexpectedly after January 2026