EPM install issue in Autopilot build since July 2025 Windows patches

Out of Box Experience (OOBE) is clashing with a lot of things, and yes likely also with pgdriver.sys and more likely if you are working under a EPM Policy and not as a true admin building your image and doing the OOBE finalization.

I would not even consider doing OOBE with 3rd party AV or Security tools, way too many things conflicts with it. Consider deploying those after initial steps of end user logon.

I have not seen the issue my self, but always follow the above.

Thanks ​@Jens Hansen. The user performing the autopilot build will not have any EPM policy applied, it is a true local admin and even if the service is disabled after installing, it still causes the issue.

Run over the Service Hook Driver test. You will likely encounter that it is the pghook.dll and needed Hook Exclusion. use this KB to confirm https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0017077

Then do a captureconfig while attempting to run OOBE, followed by PGcaptureconfig to collect the logs and raise a ticket with BT.

KB for HookExclusions https://beyondtrustcorp.service-now.com/csm?id=csm_kb_article&sysparm_article=KB0017569

PatchMyPC have posted this article today which looks like the same issue:

Windows Autopilot 8018000a Error Caused by BeyondTrust

We are just testing the hook exclusion workaround.

Thanks Caleb. The advised workaround of the hook exclusions is working for us.

​@Jack, no worries, glad I could help 😊

​@Caleb Kershaw - by adding the hook exclusions cause any issues to the functionality of the beyond trust client? 

From what we can see the “wwahost.exe” is an internet-explorer based javascript runtime host.

Based on what the process is we see no reason to not Hook Exclude this process while we develop a permenant solution to this issue, at which point you should be able to remove the Hook Exclusion 😊