Detecting when you are in OOBE

By September 16, 2023Windows AutoPilot

Windows 11

People have asked in the past what the best way to detect when you are using Windows Autopilot to deploy a device, so that some apps and potentially even settings are deferred until a later point in time. When you boil this down, it’s a little more general than that. All you really need to know is when you are in OOBE, at least for device-targeted stuff with ESP enabled. (If you aren’t using ESP, then it’s likely that very little will try to install while in OOBE.)

Fortunately, there is a documented API call for you to check. The OOBEComplete function will return a boolean that tells you if OOBE is done (true) or not (false). You can wrap that into a simple PowerShell script:

$TypeDef = @"

using System;
using System.Text;
using System.Collections.Generic;
using System.Runtime.InteropServices;

namespace Api
 public class Kernel32
   [DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
   public static extern int OOBEComplete(ref int bIsOOBEComplete);

Add-Type -TypeDefinition $TypeDef -Language CSharp

$IsOOBEComplete = $false
$hr = [Api.Kernel32]::OOBEComplete([ref] $IsOOBEComplete)


Save that as IsOOBEComplete.ps1 and you can use it as needed. It returns 1 if OOBE is complete and 0 otherwise..ps1

Regardless of the tool you are using (Tanium, Configuration Manager, Intune, etc.), you can use a script like that determine whether the app should be considered applicable/required for the machine. In the Intune Win32 app case, it would look something like this:

Source link

Share this post via

Leave a Reply