Troubleshooting

The device can't reach the portal - "unreachable (check DNS / firewall)" or TLS error

The device has an IP and can even ping the internet, but WinPE can't complete the HTTPS handshake to app.cloudimage.co.uk. Check these in order:

• System clock - most common on bare metal. WinPE uses the device's hardware clock; a dead CMOS battery or reset BIOS leaves the date badly wrong, so the TLS certificate looks expired / not-yet-valid and validation fails. VMs don't hit this (they inherit the host's time), so "works in a VM, fails on the physical device" is the classic tell. In WinPE run Get-Date; if it's wrong, Set-Date "2026-07-03 14:30" (the real date/time) and retry - then fix the BIOS clock / replace the CMOS battery so it sticks.
• Renewed / expired cloud certificate. If it fails on every device at once (and the browser portal may still load), the Let's Encrypt cert on the web server likely lapsed - renew it (win-acme) and make sure IIS serves the full chain.
• DNS. ping app.cloudimage.co.uk by name (not 8.8.8.8) - pinging an IP only proves routing; if the name doesn't resolve, the device has an address but no working DNS.

A driver pack didn't apply / the device booted without OEM drivers

• Confirm the pack is a ZIP or CAB of the .inf tree, not an .exe or .msi installer (see Adding Driver Packs). WinPE cannot run installers.
• Confirm the pack's Target manufacturer and model match the device.
• If no pack matched, the device relies on Windows Update for drivers at first boot - this is expected and the deployment still completes.

Autopilot / Intune enrolment fails

• Check the app registration has DeviceManagementServiceConfig.ReadWrite.All with admin consent granted (see Entra ID / Autopilot enrolment), and that the client secret hasn't expired.

"Boot from USB" doesn't work

• Enable USB / external boot in firmware; on Surface and some modern devices you must temporarily allow booting non-Microsoft / external media in UEFI settings.

Network Boot won't start / stops at Secure Boot

• The device must be set to UEFI network boot (x64) and be on the same subnet as a Site Server whose Network Boot status is Ready.
• Under Secure Boot, the device firmware must trust Microsoft's 3rd-party UEFI CA - on by default on most business PCs. On a Hyper-V test VM, set the VM's Secure Boot template to "Microsoft UEFI Certificate Authority." Very new or locked-down machines may also need the Windows UEFI CA 2023 certificate; most up-to-date machines already have it.

A deployment failed at a step

Open the deployment in the portal (Monitoring) and read the failing step's log / error output, then fix that step's content or configuration.

No first-boot progress screen / can't sign in after imaging

Make sure the Task Sequence has a local admin password set (see Task Sequences) - the first-boot UI signs in with that account.