I'm considering buying a refurbished Lenovo ThinkPad T14 Gen 1 AMD from a local shop. I want to check that it isn't still assigned to an organization through Windows Autopilot or Azure AD, and that it doesn't have a hardware-level lock such as a BIOS Supervisor Password or an activated Computrace/Absolute module.
My current checklist is:
1. Enter BIOS with F1 and confirm there is no Supervisor Password prompt or restricted access.
2. Check Security settings for the Absolute Persistence Module and verify that it is enabled but not activated.
3. Factory-reset the existing Windows installation and boot from my Windows 11 USB installer.
4. Complete setup far enough to reach OOBE and see whether Windows requires a company login.
Is this a reliable way to detect enterprise enrollment, or can Autopilot or Intune restrictions be skipped or appear only after the machine connects to the internet? Would forcing an internet connection during OOBE, preferably over Ethernet, make the test more dependable?
2 Answers
Don’t test only while offline. A machine may get through OOBE without contacting Microsoft’s enrollment service, then reveal its organization assignment as soon as it connects to Wi-Fi or Ethernet. Keeping it connected during setup is a much better test, although it still shouldn’t be treated as an absolute guarantee that every management configuration has been found.
If you have access to your own Intune tenant, one possible check is to collect the device hardware hash from the OOBE command prompt and import it. A device can be registered with Intune without having a deployment profile assigned, so successfully reaching the desktop does not necessarily prove it is unassigned. If the service reports that the device is already assigned elsewhere, that is a strong warning sign. Since you don’t have your own Intune tenant, you’ll need to rely on the seller or refurbisher proving that the device has been removed from the previous organization.
I don’t have an Intune tenant, so I can’t perform that import check myself. I’ll ask the shop for confirmation that the hardware has been removed from any organization before buying it.
Forcing an internet connection during OOBE is sensible, and Ethernet is usually the simplest way to avoid Wi-Fi setup issues. The important part is that Windows can contact the enrollment services before you consider the machine cleared.