Open Entra Admin Portal, and lookup the device. Delete all device entries for this device.



Make sure you're logged in as admin on the old computer. To do this open command prompt and enter net localgroup administrators.


That command will display all local admins on the PC.



Now you should be able to go do Settings -> Accounts -> Access Work or School, and delete the local.domain connection. 


If you are not able to delete this then do the following. 

  1. Press Win + R, type sysdm.cpl, and hit Enter.
  2. On the Computer Name tab, click the Change... button.
  3. Under "Member of," select Workgroup instead of "Domain."
  4. Type WORKGROUP in the box and click OK.
  5. Important: You will be prompted for local administrator credentials. Ensure you use a local admin account (e.g., .\WERLA) rather than a domain one.
  6. Restart your computer when prompted.


Now that you are disconnected from the domain in settings you need to reset your registry settings to defaults. 


RD /S /Q "%WinDir%\System32\GroupPolicy"

RD /S /Q "%WinDir%\System32\GroupPolicyUsers"

gpupdate /force



Once that is complete, we then need to remove stale enrollment guids from the registry. Run the following script in an elevated powershell to clear out most of them.


Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Enrollments" | 

Where-Object { $_.PSChildName -notin "Context", "Ownership", "Status", "ValidNodePaths" } | 

ForEach-Object { Remove-Item -Path $_.PSPath -Recurse -Force -ErrorAction SilentlyContinue }



Now there will likely be a few GUIDS remaining in the folder. To clear these out proceed with this following step. If there are no remaining GUIDS then skip this step. 


Right click on one of the remaining GUID's and select 'Permissions...'. In the popup window select the 'Advanced' button near the bottom for special permisions. 


In the top left the owner will likely be something different than SYSTEM or ADMINISTRATORS. We need to click 'Change'. 


In the enter object name box type 'Administrators' and hit ok. Once this succeeds, close the advanced security settings windows, and go back to the standard permissions window for this  GUID.


Select the administrators security group and check the box 'Allow' for 'Full Control'. Hit apply and ok. Now you should be able to delete the GUID. 


Repeat this for every remaining GUID.



Now click on the enrollments folder and in the right box you should see a key called 'Externally Managed'. This will likely be set to a value of 1. Set it to 0 and apply. 



Next go back to powershell and run the following final cleanup command


dsregcmd /leave



Now restart device and download company portal. You should now be able to join to Intune as normal.