Sorry this has dragged on — that spinning “Just a moment…” window means the in‑app sign‑in/enrollment flow is hanging (common causes: missing prerequisite updates, a Windows component/service that the WebAuth flow needs is disabled or broken, or the AAD/WAM broker package is corrupted). Based on what you’ve tried so far, try the focused checklist below (do them in order). I included exact commands you can copy/paste and what to look for — after each step tell me the result and I’ll tell you the next one.
Important: create a System Restore point (or backup any important files) before making system changes.
Quick background (why these steps)
- Microsoft and community posts show a few recurring causes for ESU enrollment failures: missing prerequisite updates/patches, disabled telemetry/diag services, ClipSVC being disabled (blocks Appx/WAM registration), or a broken AAD broker / WebAuth component. There were also known bugs fixed in recent patch updates.
Step 0 — Check Windows Update & prerequisites (do this first)
- Settings → Update & Security → Check for updates. Install all offered updates (including optional/preview updates). Some users fixed the enrollment after installing a recent prerequisite patch.
- Reboot and try the ESU enroll once — if it works, stop here and report success.
If still stuck, continue.
Step 1 — Ensure required services are enabled (DiagTrack, ClipSVC)
Open an elevated command prompt (right‑click Start → Command Prompt (Admin) or PowerShell (Admin)) and run:
- Check and enable DiagTrack:
sc qc DiagTrack
sc config DiagTrack start= auto
sc start DiagTrack
- Check and enable ClipSVC (Client License Service) — required for Appx registration / broker installs:
sc query ClipSVC
sc config ClipSVC start= auto
sc start ClipSVC
What to expect:
- If either service fails to start or shows errors, copy the exact error text here. Community troubleshooting shows ClipSVC being disabled will stop package registration and break the enrollment flow.
Step 2 — Try the ESU trigger tool & registry override (makes the ESU UI appear / evaluate eligibility)
(From an elevated cmd/powerShell)
- Enable the feature override (this is a known community/MS recommendation to force the ESU eligibility evaluation):
reg.exe add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 4011992206 /t REG_DWORD /d 2 /f
- Run the ESU eligibility evaluator (ClipESUConsumer may be present on your system):
cmd /c ClipESUConsumer.exe -evaluateEligibility
Note: some MS Q&A/community posts show this helped users who otherwise never got past the spinner.
Step 3 — Verify Windows account / Access work or school status
- Settings → Accounts → Access work or school. If you see any stale or broken entries, click the entry → Disconnect. Reboot.
- Then add your Microsoft account (Settings → Accounts → Email & accounts → Add a Microsoft account) and try ESU enrollment again.
Step 4 — Reinstall / re-register the AAD broker & related AppX packages
This often fixes sign‑in windows that never return control to the calling app. Run PowerShell as Admin and copy/paste:
- Check whether the broker package exists:
Get-AppxPackage -AllUsers Microsoft.AAD.BrokerPlugin
- If it returns nothing or looks corrupted, re-register it (this path is the normal system path; use copy/paste exactly):
Add-AppxPackage -Register "$env:windir\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\AppxManifest.xml" -DisableDevelopmentMode -ForceApplicationShutdown
- Also re-register the Store package (sometimes helpful):
Get-AppxPackage -AllUsers Microsoft.WindowsStore | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}
If the Add-AppxPackage command fails, note the ActivityId shown in the error and run:
Get-AppPackageLog -ActivityID <the-GUID-you-were-given>
Community threads show this re-register step fixes many WebAuth/AAD sign-in hangs.
Step 5 — Make sure WebView2 runtime is present (in‑app sign-ins rely on WebView components)
- Download & install the Microsoft Edge WebView2 Evergreen Runtime (Evergreen bootstrapper or the standalone installer) from Microsoft and reboot. If WebView2 is missing or broken, in‑app flows can hang. MS docs show installing WebView2 runtime is recommended for apps using embedded web sign-in.
Step 6 — Repair system files (SFC + DISM)
From an elevated cmd:
- sfc /scannow
- DISM /Online /Cleanup-Image /RestoreHealth
Reboot and try enrollment again.
Step 7 — Test from a fresh local admin profile
- Create a temporary local administrator (Settings → Accounts → Family & other users → Add someone else → “I don’t have this person’s sign-in info” → “Add a user without a Microsoft account” → make it an Administrator).
- Login with that new account, add your Microsoft account in Settings, then try Enroll in ESU. If that works from the fresh profile it points to a profile-level corruption.
Step 8 — Collect targeted diagnostics if it still fails
If none of the above fixes it, collect these outputs and paste them here (don’t post sensitive tokens/passwords — only command output text):
1) dsregcmd /status — paste the whole output (shows join/registration status).
2) Result of:
Get-AppxPackage -AllUsers Microsoft.AAD.BrokerPlugin
sc query ClipSVC
3) Any Add-AppxPackage error ActivityId if step 4 failed (then run Get-AppPackageLog -ActivityID <GUID> and paste results).
4) Event Viewer logs: Reproduce the failure, then open Event Viewer and check:
- Applications and Services Logs → Microsoft → Windows → User Device Registration → Admin
- Windows Logs → Application
- Microsoft-Windows-User Device Registration or any WAM/WebAccountManager logs under Microsoft → Windows
Copy the Event IDs & full messages (or screenshots).
Why I’m asking for these specific outputs
- dsregcmd /status tells whether the device is Azure/Entra joined or already has registration tokens — that changes the enrollment flow and what account is allowed. Many enrollment hangs are caused by a mismatch there. (If you’re domain-joined/hybrid, that’s important to know.)
- ClipSVC / AADBrokerPlugin / WebView2 are frequent culprits for in‑app Microsoft sign-ins that never return. Community troubleshooting repeatedly points to these fixes.
If you want, I can give the one‑line commands for each step and walk you through the outputs. If you prefer, post the dsregcmd /status and the ClipSVC and AADBrokerPlugin outputs now and I’ll interpret them and give the exact next command.
If you’ve already tried any of the above exact steps, tell me which and paste any errors/activity IDs you saw — that will let me skip repeated steps and go deeper.
