In the case of Lildidi, it was the "Device Management Enrollment Service".
Make sure to enable OOBE compatibility, it's already in there protected.
netefu, let me know of your preset, and also retest it with OOBE components kept.
Gonna lock DmEnrollmentSvc for Live only.
Thanks.