Get-AutopilotDeviceAssociation

Author(s)

• Rudy Ooms

Tags

Windows Autopilot Intune DeviceAssociation DeviceLink Autopilot-Device-Preparation OOBE

Functions

Resolve-DLRequestedAction Add-DLRedaction Protect-DLText Protect-DLObject Get-DLSha256 Get-DLAuthenticationMethod Initialize-DLLogging Write-DLLog Write-DLVerboseLog Get-DLActionPlan Initialize-DLStepPlan Invoke-DLStep ConvertTo-DLHeaders ConvertTo-DLBodyLog Get-DLHttpFailure Save-DLHttpRecord Invoke-DLRestMethod Write-DLExportSummary Invoke-DLExport Invoke-DLLink Initialize-DLFirmwareInterop Get-DLFirmwareVariable Clear-DLFirmwareVariable Get-DLFirmwareRawValue Get-DLFirmwareAssociationState Remove-DLFirmwareAssociation Get-BlobFromCsv Resolve-Csv Get-DLDelegatedGraphScopes Get-DLInteractiveGraphToken Get-GraphToken U Invoke-Inspect BI Graph-Headers Get-DLIdentifierHash ConvertTo-DLNormalizedUuid Get-DLLocalDeviceIdentity Test-DLAssociationRecordMatch Assert-DLCloudRemovalParameters Resolve-DLCloudAssociation Invoke-DLCloudAssociationDelete Wait-DLCloudAssociationDeletion Wait-PreAssociated Invoke-Upload Wait-DLAssociated Show-LinkResult ConvertFrom-DLBase64Url Get-DLStringFromBytes Get-DLGuidCandidates Expand-DLDeviceLinkJwt Get-DLJsonQuietly Resolve-DLTokenSigningKeys Test-DLJwtSignature Invoke-DLValidateAssociationToken New-DLCheck Test-DLVirtualMachine Test-DLDeviceRequirements Write-DLRequirementsReport Write-DLStopBanner Invoke-DLRequirementsPreflight Get-DLNativeErrorHint

Dependencies

This script has no dependencies.

Release Notes

Version 1.8.0 gives the script meaningful exit codes - 0 success, 1 error, 2 the device does not meet the requirements - so CheckRequirements and a preflight stop no longer report success to a caller. Full also gains a sixth step that polls Intune until the record reports associated, so a successful client-side link is confirmed against the service instead of being assumed.
Version 1.7.0 makes RemoveAssociation remove the Intune Device Association record as well as the local UEFI variables by default. Use -KeepCloudAssociation (alias -LocalOnly) to clear UEFI only. -DeleteCloudAssociation is still accepted and is now a no-op, because it describes the default. The safety rules are unchanged: the cloud record must match this computer exactly and uniquely, and it is deleted only after local UEFI removal has been verified.
Version 1.6.1 replaces the raw PowerShell exception shown when the preflight stops a run with a readable summary of what is not met, how to fix it and how to override, and no longer records that clean stop as a failed run.
Version 1.6.0 makes the requirements preflight ask before continuing: Export, Sync, Discover, Link and Full now list the unmet requirements and prompt, -Force skips the prompt, and a host that cannot prompt stops instead of proceeding into a confusing native error. Native DeviceLink HRESULTs also carry a plain-language hint - 0x80004001 (E_NOTIMPL, the build predates KB5120998 and has no DeviceLink API), 0x8103C00F (no attestation material), 0x80090029 and 0x80090016 (the TPM refused the association key) and 0x80070005 (not elevated).
Version 1.5.0 adds -Action CheckRequirements, which verifies the Microsoft-documented Device Association requirements: physical device (not a VM), 64-bit Windows 11 client, a supported build (24H2 26100.9278 or 25H2 26200.9278, KB5120998 or later), a supported edition, TPM 2.0 enabled and not in Reduced Functionality Mode, UEFI firmware, and whether the TPM has been refusing to create the DEVICEASSOCIATION_TACK_RSA key. Adding -Online also tests the required ztd.dds.microsoft.com and attest.azure.net endpoints. The device-side actions run the same check as a non-blocking preflight and warn when the device does not qualify.
Version 1.4.0 adds -Action ReadAssociation -Validate: it decompresses DeviceLinkJwtCompressed, checks the token is a well-formed RS256 JWT, still inside its iat/exp window, has a linkId matching the DeviceLinkId UEFI variable, and (with -TenantId) a matching tenant and device inventory. Adding -Online resolves the issuer's published signing key and verifies the RS256 signature. Only booleans, timestamps and the signing-key thumbprint are printed or logged, unless -ShowClaims is added, which also prints the decoded JOSE header and payload to the console (console only; never to the diagnostic files).
Version 1.3.0 renames the script and published command to Get-AutopilotDeviceAssociation and adds a .DESCRIPTION block for PowerShell Gallery publishing. Export, Inspect, Upload, Discover, Link, ReadAssociation and RemoveAssociation behaviour is unchanged; the console banner, work folder and diagnostic file names are unchanged.
Version 1.2.0 keeps the normal console concise, moves diagnostic events to -Verbose, and selects the first returned Device Preparation policy when no policy ID or name is supplied.