Windows Autopilot: hybrid Entra user-driven deployment does not grant Administrator rights
Summary
In user-driven hybrid Microsoft Entra deployments, Windows Autopilot does not grant the user Administrator rights, even if the Autopilot profile specifies it. This happens when another user with Administrator rights already exists on the device. Microsoft documents this as a known issue and describes how to avoid it.
Symptoms
After a user-driven hybrid Microsoft Entra Autopilot deployment, the user does not have local Administrator rights although the Windows Autopilot profile specifies them.
Affected
- Windows Autopilot user-driven hybrid Microsoft Entra deployments
- Devices where another local account in the Administrators group exists during the process, for example one created by a PowerShell script or a policy
Workaround
- Do not create another local account with Administrator rights (for example via PowerShell script or policy) during the Autopilot process.
- Create such accounts only after the Windows Autopilot process is complete.
Fix
No fix announced in the source. Avoid the cause as described in the workaround.
Recommendation
Review scripts and policies that apply during Autopilot enrolment and make sure they do not create local administrator accounts. Move this account creation to after Autopilot is complete, then check that users receive the intended rights.
Sources
- Windows Autopilot: known issues Vendor · learn.microsoft.com
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 18:25.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.