People have asked in the past what the best way to detect when you are using Windows Autopilot to deploy a device, so that some apps and potentially even settings are deferred until a later point in time. When you boil this down, it’s a little more general than that. All you really need to know is when you are in OOBE, at least for device-targeted stuff with ESP enabled. (If you aren’t using ESP, then it’s likely that very little will try to install while in OOBE.)
Fortunately, there is a documented API call for you to check. The OOBEComplete function will return a boolean that tells you if OOBE is done (true) or not (false). You can wrap that into a simple PowerShell script:
$TypeDef = @"
using System;
using System.Text;
using System.Collections.Generic;
using System.Runtime.InteropServices;
namespace Api
{
public class Kernel32
{
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern int OOBEComplete(ref int bIsOOBEComplete);
}
}
"@
Add-Type -TypeDefinition $TypeDef -Language CSharp
$IsOOBEComplete = $false
$hr = [Api.Kernel32]::OOBEComplete([ref] $IsOOBEComplete)
$IsOOBEComplete
Save that as IsOOBEComplete.ps1 and you can use it as needed. It returns 1 if OOBE is complete and 0 otherwise..ps1
Regardless of the tool you are using (Tanium, Configuration Manager, Intune, etc.), you can use a script like that determine whether the app should be considered applicable/required for the machine. In the Intune Win32 app case, it would look something like this:
