When deploying a Windows 11 image, the system automatically logs in as an administrator at the end of setup and launches OOBE to check for updates. Some of our computers are configured with a Group Policy that enables automatic logon. If OOBE requires a restart for updates, the machine logs back into that account, tries to resume OOBE, and can become stuck in a boot loop, sometimes showing a BSOD or remaining on the loading screen indefinitely. Has anyone found a reliable way to skip or defer this OOBE update stage, or otherwise prevent it from conflicting with automatic logon?
3 Answers
The update check can be controlled through the unattend configuration, so it is worth reviewing the Windows 11 OOBE and update-related settings in autounattend.xml. That said, the newer OOBE update pass appears to run under the defaultuser0 context and may still appear even when the usual skip settings are enabled. Microsoft treats this stage as mandatory in some builds, and the newer Skip button does not seem to have a supported unattended equivalent.
Be careful with proposed fixes that only hide the OOBE screens. The update phase can still run independently, especially after a restart, so hiding the pages does not necessarily prevent the autologon loop. The most dependable workaround discussed here is to avoid using an account with automatic logon while OOBE is still active, or defer the OOBE/update stage until after deployment rather than allowing the machine to restart into it.
We ran into the same issue and stopped trying to complete OOBE during the initial deployment. Instead, we skip it and handle the remaining setup later from a USB-based installer. In the unattend configuration, set both SkipMachineOOBE and SkipUserOOBE to true. We only collect the computer name during Windows PE, then automate the rest of the software and configuration steps afterward.
There are a few other OOBE settings involved as well. We also hide the EULA, local account, OEM registration, online account, and wireless setup pages, then set ProtectYourPC to 3. However, this approach is mainly useful for bypassing the normal OOBE flow; it may not eliminate the newer mandatory update check.