Hardware MDM Locks: Detecting Absolute Persistence (Computrace) & Microsoft Autopilot in ITAD Audits

1. Silicon Anchoring: How Modern Corporate Locks Operate

In an era of distributed remote workforces and Zero-Trust architectures, enterprise IT departments no longer rely on disk cloning (Ghost, Clonezilla). Modern fleet management relies on immutable hardware identities anchored directly in motherboard silicon and synchronized with operating system cloud brokers.

A. Absolute Persistence (formerly Computrace / LoJack for Laptops)

Absolute Persistence is proprietary firmware telemetry developed by Absolute Software, embedded into the source code of UEFI BIOS firmware across virtually all Tier-1 enterprise laptops (Dell Latitude/Precision, Lenovo ThinkPad, HP EliteBook/ProBook, ASUS ExpertBook):

• Protected SPI Flash ROM Location: The module resides as a specialized Driver Execution Environment (DXE) driver or Option ROM stored directly within the physical SPI Flash memory IC.
• Firmware Persistence Engine (OS Injection): During every cold boot and restart sequence, the UEFI DXE driver inspects the primary NTFS volume before the Windows kernel (ntoskrnl.exe) initializes. It hooks the early boot process (often via autochk.exe) or writes agent binaries directly to C:\Windows\System32\.
• Agent Binaries: Inside the operating system, the module spawns rpcnet.exe and rpcnetp.exe and registers the Rpcnetp system service. If the drive is wiped, repartitioned, or replaced with a brand-new NVMe SSD, the BIOS automatically re-injects the agent on the very first Windows boot.
• Outbound Beaconing: Every few hours, the agent establishes encrypted outbound connections to Absolute infrastructure (including search.namequery.com and *.absolute.com on ports 80/443). The registered administrator can remotely:
  • Lock the computer with a custom corporate lock screen and PIN,
  • Issue a silent Remote Wipe command that cryptographically erases all partitions,
  • Track exact physical geolocation via public IP routing and BSSID Wi-Fi triangulation.

B. Microsoft Autopilot & Entra ID (Intune Zero-Touch Deployment)

Microsoft Autopilot requires no proprietary code in the BIOS. Instead, it relies on a cryptographic fingerprint known as the Hardware Hash (Device Hardware Data):

• Structure of the Hardware Hash: The hash is a Base64-encoded string approximately 4,000 bytes long, generated by Microsoft's proprietary cryptographic algorithm. It aggregates over 12 hardware telemetry components:
  • SMBIOS System UUID and Motherboard Serial Number,
  • TPM 2.0 Endorsement Key Public (EKPub) certificate hash,
  • Processor CPUID, Microcode Revision, and Stepping ID,
  • MAC addresses of integrated network interface cards (NICs),
  • Factory hardware IDs for PCI Express root complexes and disk controllers.
• Cloud Zero-Touch Deployment (ZTD) Registry: When an enterprise purchases laptops through an authorized OEM channel, the hardware hashes are uploaded directly into the organization's Microsoft Intune / Entra ID tenant.
• OOBE Handshake and Profile Contamination: When Windows 10/11 enters the Out-Of-Box Experience (OOBE) and establishes an internet connection, CloudExperienceHost transmits the local Hardware Hash to ztd.dds.microsoft.com. If a tenant match occurs, the server downloads AutopilotDDSZTD.json, locking the workstation into the company's branded login screen.

2. Verifying Absolute Persistence in BIOS/UEFI Settings

The physical state of the Absolute Persistence module can and must be audited directly inside the UEFI setup menu. This inspection requires no storage drives and no operating system.

BIOS Navigation Across Tier-1 Enterprise Vendors:

• Dell (Latitude / Precision / OptiPlex): Press F2 repeatedly at boot ➔ Navigate to: Security ➔ Absolute (or Computrace on older revisions) ➔ Inspect the Absolute Status field. If it reports Enabled, the board is locked. Selecting Permanently Disable triggers a confirmation dialogue warning that the change is irreversible.
• Lenovo (ThinkPad): Press F1 at boot ➔ Navigate to: Security ➔ Security Features ➔ Absolute Persistence Module. ThinkPads present three explicit states: Enabled, Disabled, and Permanently Disabled.
• HP (EliteBook / ZBook / ProBook): Press F10 at boot ➔ Navigate to: Security ➔ Hard Drive Tools / Automatic Drive Table or Absolute Software.

3. Laboratory OOBE Runbook: 100% Offline Autopilot Verification (Shift + F10)

Unlike Computrace, Microsoft Autopilot enrollment cannot be viewed in the BIOS. Many inexperienced technicians make the fatal error of plugging in an Ethernet cable during the OOBE region selection screen to "see if a login prompt appears". If the device is registered with a Self-Deploying Mode profile, this action immediately contaminates the machine and locks the TPM with corporate certificates.

Follow this strictly offline laboratory protocol to extract the hardware identity safely:

Step 1: Test Environment Preparation

1. Boot the machine from a pristine Windows 10/11 installation USB drive.
2. Install Windows to a temporary test SSD without entering a product key.
3. When setup reboots into the initial OOBE screen (Country/Region selection) — DO NOT CONNECT ETHERNET OR WI-FI!

Step 2: Launch the OOBE Diagnostic Shell

On the initial OOBE screen, trigger the administrative diagnostic shortcut:

Shift + F10   (on laptops with function locks: Fn + Shift + F10)

An elevated command prompt (NT AUTHORITY\SYSTEM) will open. Type powershell and press Enter.

Step 3: Extract 4K Hardware Hash 100% Offline via WMI/CIM

Standard documentation recommends running Install-Script Get-WindowsAutoPilotInfo, which fails offline because it attempts to reach the PowerShell Gallery. Instead, query the native CIM class built directly into the Windows WMI repository:

Paste the following script into the PowerShell console to extract the hash and save an Intune-compliant CSV to an attached USB flash drive:

# Native Hardware Hash extraction from local WMI / CIM repository (100% Offline)
$Serial = (Get-CimInstance -ClassName Win32_BIOS).SerialNumber
$Model = (Get-CimInstance -ClassName Win32_ComputerSystem).Model
$DevDetail = Get-CimInstance -Namespace root/cimv2/mdm/dmmap -ClassName MDM_DevDetail_Ext01 -Filter "InstanceID='Ext' AND ParentID='./DevDetail'"
$Hash = $DevDetail.DeviceHardwareData

Write-Host "Successfully extracted hardware identity:" -ForegroundColor Green
Write-Host "Serial Number: $Serial" -ForegroundColor Cyan
Write-Host "Hardware Hash Length: $($Hash.Length) characters" -ForegroundColor Yellow

# Export to CSV matching Microsoft Intune Bulk Import specifications
$CsvContent = "Device Serial Number,Windows Product ID,Total Hardware Hash,Group Tag,Assigned User`n$Serial,,$Hash,ITAD-Audit,"
$TargetDrive = (Get-Volume | Where-Object { $_.DriveType -eq 'Removable' -and $_.DriveLetter } | Select-Object -First 1).DriveLetter

if ($TargetDrive) {
    $OutPath = "${TargetDrive}:\Autopilot_HardwareHash_${Serial}.csv"
    $CsvContent | Out-File -FilePath $OutPath -Encoding ascii
    Write-Host "CSV successfully saved to external USB drive: $OutPath" -ForegroundColor Green
} else {
    $CsvContent | Out-File -FilePath "C:\Autopilot_Hash.csv" -Encoding ascii
    Write-Host "Saved locally to C:\Autopilot_Hash.csv (No external USB detected)" -ForegroundColor Yellow
}

Step 4: Audit the Hash on an Isolated Workstation

Transfer the CSV containing the serial number and Hardware Hash to an isolated technician workstation with internet connectivity:

• Microsoft Partner Center / Graph API: Query the device status across authorized tenant directories using the Microsoft Graph PowerShell SDK:
  Copy

  # Query device enrollment status via Microsoft Graph
  Connect-MgGraph -Scopes "DeviceManagementServiceConfig.Read.All"
  Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -Filter "serialNumber eq '$Serial'"

• Sandbox Network Live Validation: If physical network verification is required, attach the machine to an isolated VLAN or LTE cellular hotspot. If corporate branding (e.g. company.com) renders on the sign-in screen, disconnect power immediately.

4. Detecting Active Agents in an Installed OS (Windows & Linux)

When auditing pre-installed operating systems, Computrace and MDM bindings can be audited without rebooting into BIOS:

A. Windows PowerShell Diagnostics (Computrace / Absolute)

Audit running processes, background services, and filesystem signatures in System32:

# Verify presence of Absolute Persistence agent in Windows
$Processes = Get-Process -Name "rpcnet", "rpcnetp" -ErrorAction SilentlyContinue
$Service = Get-Service -Name "rpcnetp" -ErrorAction SilentlyContinue
$Files = Get-ChildItem -Path "$env:SystemRoot\System32\rpcnet*.exe" -ErrorAction SilentlyContinue

if ($Processes -or $Service -or $Files) {
    Write-Host "[!] ALERT: Active Absolute Computrace agent detected on this system!" -ForegroundColor Red
    if ($Processes) { Write-Host " -> Active Processes: $($Processes.Name -join ', ')" -ForegroundColor Yellow }
    if ($Service)   { Write-Host " -> System Service:   $($Service.Status)" -ForegroundColor Yellow }
    if ($Files)     { Write-Host " -> Binary Paths:     $($Files.FullName -join ', ')" -ForegroundColor Yellow }
} else {
    Write-Host "[✓] No active rpcnet agent files or processes found." -ForegroundColor Green
}

B. Linux Live USB Diagnostics

Booting a lightweight Linux Live environment (Ubuntu, Arch, Fedora) allows inspection of SMBIOS tables and UEFI NVRAM variables without triggering any Windows injection binaries:

# Inspect DMI / SMBIOS tables for Absolute / Computrace configuration strings
sudo dmidecode -t 11   # OEM Strings (frequently reveals Computrace flags)
sudo dmidecode -t 1    # Extract System UUID and Motherboard Serial Number

# Search UEFI NVRAM variables for Absolute telemetry markers
ls -la /sys/firmware/efi/efivars/ | grep -i -E "computrace|absolute"

5. Comprehensive ITAD Risk Decision Matrix

During hardware intake and classification, lab auditors must assign every unit to a clear disposition tier:

6. Warranty & Claim Protocol: How to Recover Autopilot-Locked Hardware

When auditing reveals laptops locked to an unknown tenant, authorized OEM repair depots (Dell, Lenovo, HP) will refuse motherboard replacement. Under Microsoft guidelines, swapping a motherboard with an active Autopilot binding requires explicit consent from the original registered enterprise owner.

Standard Operating Procedure for ITAD Claims:

1. Compile Discrepancy Evidence: Generate a consolidated CSV containing serial numbers, model strings, and extracted Hardware Hashes for all locked units.
2. Identify the Corporate Tenant: On the locked Windows OOBE sign-in screen, enter a test email (e.g. test@company.com). The interface will resolve the organizational branding, displaying the full corporate name or Entra ID domain.
3. Initiate Formal Broker Escalation: Provide the CSV to your equipment broker or corporate seller. Their enterprise IT administrator must perform the following actions in Microsoft Intune:
   • Navigate to: Devices ➔ Windows ➔ Windows enrollment ➔ Devices (Windows Autopilot),
   • Search for the hardware serial number,
   • Click Delete to purge the Autopilot identity from the directory,
   • If the device remains listed under all devices, execute a Wipe / Retire command.
4. Cloud Synchronization Window: Propagation across Microsoft Zero-Touch Deployment servers takes between 15 minutes and 24 hours. After propagation, wiping the test drive and passing through OOBE will allow standard local or personal Microsoft account creation.

7. Summary: 5 Golden Rules of the ITAD Auditor

• Rule 1: Always check BIOS before OS deployment: Verify that Absolute Persistence is Permanently Disabled or at least Deactivated.
• Rule 2: Zero trust in wiped SSDs: Drive replacements and NIST SP 800-88 sanitization have zero effect on Autopilot and Computrace silicon bindings.
• Rule 3: Audit Autopilot strictly offline: Use Shift + F10 during OOBE with the native CIM PowerShell one-liner before connecting network cables.
• Rule 4: Isolate validation networks: If performing live verification, always route through an isolated lab sandbox to avoid unwanted profile binding.
• Rule 5: Leverage SpecInfo audit tools: Cross-reference hardware errors in the Universal Error Decoder and verify sanitization compliance with Runbook A4 Card 12 (ITAD & NIST SP 800-88).