BitLocker Was the Sysprep Blocker on Trusted Launch AVD
We spent weeks chasing LAPS as the culprit behind sysprep failures on Windows 11 AVD multi-session builds. It was BitLocker the whole time—specifically TPM-only mode on Trusted Launch VMs.
ReadFor Intune Engineers
What Intune doesn't tell you —
but you'll hit in production.
Real patterns from real environments. Compliance gaps, enforcement blind spots, and the fixes that actually hold up at scale.
Latest
Entra Hybrid Join Stuck in Pending: Device Registration Fix
Four devices stuck in "Pending" status in Entra ID after a migration. Here's what we found when we dug into the SCP, Cloud Kerberos Trust, and a broken NGC key binding.
ReadIntune Enrollment Won't Stick: Cleanup and Reimaging Guide
A single misspelled email in Active Directory cascaded into enrollment failure and stale MDM registry artifacts. Here's what we found, what we tried, and when we knew it was time to reimage.
ReadShould we take a look?
ReadIf your Intune environment looks like this...
ReadThe fastest way to break your apps with WinGet
ReadWhy your compliant devices aren't actually compliant
ReadYour Intune Compliance Model Is Wrong — Here’s Where It Breaks in Production
ReadWhat Intune doesn't tell you
ReadWorking on something harder? Talk to Hal → — 20 minutes, no pitch.