[Feature] - Add optional script to enable Windows Location Services after Autopilot provisioning

[Crypdonick]

Is your feature request related to a problem? Please describe.

Yes.

After Windows Autopilot provisioning, when the OOBE privacy page is skipped, Location Services can remain disabled and grayed out for standard users.

We experienced the same behaviour as described here:
https://msendpointmgr.com/2026/02/10/location-services-is-grayed-out/

This also impacts the following OIB policy:

Win - OIB - SC - Device Security - D - Location and Privacy - v3.2

In our case, the policy was not fully effective because the global Location Services setting was disabled. As a result, Outlook and windows.immersivecontrolpanel were not able to request or use location access, even though the policy allowed / enforced it.

Describe the solution you’d like

I would like to suggest an optional OIB script that enables the global Windows Location Services setting after Autopilot provisioning.

The script should run in SYSTEM context and enable Location Services by using:

C:\Windows\System32\SystemSettingsAdminFlows.exe SetCamSystemGlobal location 1

This would allow the existing OIB Location and Privacy policy to apply as intended and allow approved apps such as Outlook and windows.immersivecontrolpanel to request or use location access.

Describe alternatives you’ve considered

I initially solved this by using an Intune remediation script with detection and remediation logic.

However, for OIB, this might make more sense as a standalone optional script instead of a full detection/remediation package, since the main goal is to enable the global Location Services setting once after provisioning.

Another alternative would be to not skip the OOBE privacy page, but this is often not preferred in standardized Autopilot deployments.

Additional context

This is not necessarily a bug in OIB, but a proposed optional improvement to better support the existing Location and Privacy policy after Autopilot provisioning.

Observed impact:

• Location Services are disabled globally
• Standard users cannot enable Location Services themselves
• The OIB policy Win - OIB - SC - Device Security - D - Location and Privacy - v3.2 is not fully effective
• Outlook cannot request or use location access
• windows.immersivecontrolpanel cannot request or use location access
• Location-dependent functionality, such as automatic time zone configuration, may not work as expected

I already have a working Intune remediation script and would be happy to provide it or create a pull request if this fits the direction of OIB.

[Michael-eit]

Isnt that what this https://github.com/SkipToTheEndpoint/OpenIntuneBaseline/blob/main/WINDOWS/Scripts/Enable-AutoTimezone.ps1 is resolving or am I missing something else? Though its a little messy at the moment with one spot saying assign per user the other per system.

[jamiehallghs]

Think the script might need reviewing / updating. The following article seems to suggest editing the registry key (HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\location) no longer works as of this year for enabling location services: https://msendpointmgr.com/2026/02/10/location-services-is-grayed-out/

[Crypdonick]

@jamiehallghs @Michael-eit

Thanks both for pointing this out.

Yes, that is exactly the context I was referring to. I did not mention the existing Auto Timezone PowerShell script in my original request, but you are right, instead of adding a completely new script, the existing script should probably be updated to also cover this scenario properly.

Especially with the recent changes around the registry-based approach no longer reliably enabling Location Services, it would make sense to adjust the current script accordingly.

Thanks for the helpful input!

$AdminFlow = "$env:windir\System32\SystemSettingsAdminFlows.exe"
$Arguments = "SetCamSystemGlobal location 1"

if (Test-Path $AdminFlow) {
Start-Process -FilePath $AdminFlow -ArgumentList $Arguments
-Wait `
-WindowStyle Hidden
}