AutopilotNuke

Runs from OOBE screen, connects to Azure AD, Intune and optionally to AD DS, finds all objects for the serial number of the machine it is running on, then deletes it from everywhere, then adds it to Autopilot again.
Asks for deletion of each object
Usage:
- The script can work from running Windows 10, but be careful removing native Azure AD joined Intune Devices - you can lock yourself out, if you do not know local administrator's password
- Intended usage - from OOBE (Out of Box Experience)
- While in OOBE, hits Shift+F10
- Powershell.exe
- Install-Script AutopilotNuke
- Accept all prompts
- & 'C:\Program Files\WindowsPowerShell\Scripts\AutopilotNuke.ps1'
- The script will:
       Download and install all required modules (accept all prompts)
       Show you the Serial Number of the machine
       Prompt to connect you to Azure AD and Intune Graph
       Ask you if you want to connect to local AD (ADDS, NT Domain) so it could delete old records from there. Enter the local FQDN (domain.com, contoso.local) of your AD Domain
       If you entered local AD domain, it will ask you for the username and password, for the username, use <NetbiosName>\User format
       Search in Autopilot for the serial number
       Show you all objects in Intune and AAD related to that Serial Number
       Ask if you want to delete in from Intune then deletes
       Ask if you want to delete in from Autopilot then deletes
       Loop through all AAD and AD (if it was selected) objects and ask to delete them
       Ask if you want to add it to AP then adds

Minimum security rights needed:
• To authorize Intune Graph, you will need global admin, but this is just one time. Ask your GA to run:
   Install-PackageProvider -Name NuGet
   Install-Module AzureAD
    Install-Module WindowsAutopilotIntune
   Install-Module Microsoft.Graph.Intune
   Connect-AzureAD
   Connect-MSGraph
   Accept the consent prompt
• Custom role with the following permissions required in Intune:
   Managed devices
       Read
       Delete
       Update
       Enrollment programs
       Create device
       Delete device
       Read device
       Sync device
   Assigned to All Devices (did not try scoping it with RBAC, but should work in theory)
• Cloud device administrator role required in Azure AD
• AD DS rights similar to Intune Connector rights: https://docs.microsoft.com/en-us/mem/autopilot/windows-autopilot-hybrid#:~:text=The%20Intune%20Connector%20for%20your,the%20rights%20to%20create%20computers.