setting up devices with intune

[mrstrong]

Hi,

 

just done my first autopilot / intune "deployment" to a VM following this

https://learn.microsoft.com/en-us/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm

 

I then managed to do a deployment on a real laptop:

 

burnt the win10 education iso from vlsc to usb and booted from the usb

harvest hash/load to autopilot: get-windowsautopilotinfo.ps1 -online

wait till assigned, reboot, go through setup / login.

 

All a bit long winded / manual process!

 

How do you do this in production?

I.e. for newly purchased devices and exiting devices you

want to move from on-prem to Azure AD joined managed via intune ?

 

E.g. at the moment I update a VM then capture the wim image.

For new PCs / laptops we've bought or existing devices that may have an issue (e.g. hard drive fail)

I just pxe boot from WDS and install via MDT.

[Steve21]

Hi,

 

just done my first autopilot / intune "deployment" to a VM following this

https://learn.microsoft.com/en-us/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm

 

I then managed to do a deployment on a real laptop:

 

burnt the win10 education iso from vlsc to usb and booted from the usb

harvest hash/load to autopilot: get-windowsautopilotinfo.ps1 -online

wait till assigned, reboot, go through setup / login.

 

All a bit long winded / manual process!

 

How do you do this in production?

I.e. for newly purchased devices and exiting devices you

want to move from on-prem to Azure AD joined managed via intune ?

 

E.g. at the moment I update a VM then capture the wim image.

For new PCs / laptops we've bought or existing devices that may have an issue (e.g. hard drive fail)

I just pxe boot from WDS and install via MDT.

 

For brand new the easiest is to get the hash from the manufacturer in advance Unless you mean randomly bought items which then is likely to be the same you mentioned above

 

In terms of rebuilds HDD changes shouldn’t affect hash so will just rebuild

 

It’s more when it’s old machines you already own that’s faff as lots may not support automated methods. But you can script it etc if it’s already online and working on domain etc

 

Steve

[mrstrong]

thanks, so you can't use pxe boot to speed up / simplify the process ? Just seems a bit old school booting up off usb.

E.g. say you've got a a few IT suites to "re-image / refresh" over the summer ?

 

Most of our existing domain joined machines are on windows 10 1809 LTSC, how would you move those to intune azure AD joined ?

[DalekSec]

You can run a script on multiple devices to get the hardware hash and then import the csv containing all devices in one go.

 

You could push the script out and point it to a share maybe?

 

(this isnt something i've done but i know it should work!)

 

 

New devices speak to reseller and they will be either able to give you the hash or put them directly into your autopilot.

[Steve21]

thanks, so you can't use pxe boot to speed up / simplify the process ? Just seems a bit old school booting up off usb.

E.g. say you've got a a few IT suites to "re-image / refresh" over the summer ?

 

Most of our existing domain joined machines are on windows 10 1809 LTSC, how would you move those to intune azure AD joined ?

 

Personally I wouldn’t yet

 

InTune still doesn’t seem “ready” for shared devices/suites in the way it works yet

 

We are only using it for offsite/1:1 assigned devices

 

Been looking a lot through it for a new school build and just can’t seem to get it setup as nice as I can using SCCM etc

 

Steve

[Squelch]

Totally agree with the above and have done the exact same with offsite/1:1 devices. The existing domain joined devices are hybrid joined.

[Wubbalubbadub]

Disagree totally with the above. We have full secondary’s running intune only. Including full shared suites.

 

If you ever want a visit we’re in war midlands .

Happy to show you around and how it works for our team.

[DalekSec]

Disagree totally with the above. We have full secondary’s running intune only. Including full shared suites.

 

If you ever want a visit we’re in war midlands .

Happy to show you around and how it works for our team.

 

This we ran a prep school and secondary off intune alone

[Steve21]

Not saying you can’t, just saying everything seems to work worse than normal on-site methods

 

As a few examples, how are you dealing with security on machines when not all the user policies apply instantly? Meaning students can change settings around on 1st login to a machine etc (unless you mean hybrid then still needing servers/gpos etc)

 

Building shared machines without either manually assigning login/users to each, or having supported TPMs etc for self/deploy (bearing in mind that’s only in preview still)

 

Or if you’re upgrading a suite to SSDs/replacing failed HDDs without manually booting off USBs/ISO etc? (Unless you’re booting via pxe and then doing hybrid join etc)

 

Any kind of packages over 8Gb being deployed? (Think solid works/Adobe etc) as they’re not supported via InTune

 

Etc

 

Seems to be lots of these “workarounds/settling withs ” that are required to do things that should be basic if done on-site

 

Would be interested in throwing a long list of things like this to you two if you have time to see what you do with them if you have other ways around it

 

Steve

[mrstrong]

mmm there's certainly a lot to think about here.

 

Just tried setting up a brand new HP laptop I had spare.

 

I just let it boot into oobe, autopilot assigned (via get-windowsautopilotinfo.ps1 -online), waited a while ...

and rebooted, it joined intune ok but then I realised it still had all the HP crap free trials etc and lots of updates needed

 

So I guess I will need to wipe it and boot off a usb ?

[Steve21]

mmm there's certainly a lot to think about here.

 

Just tried setting up a brand new HP laptop I had spare.

 

I just let it boot into oobe, autopilot assigned (via get-windowsautopilotinfo.ps1 -online), waited a while ...

and rebooted, it joined intune ok but then I realised it still had all the HP crap free trials etc and lots of updates needed

 

So I guess I will need to wipe it and boot off a usb ?

 

There seems to be a few ways to do it

 

You can add all the apps to your store removal list - this then uinstalls them all as part of the “install” but you need to prepop that list

 

You can use scripts etc to remove them all, similar to metro apps

 

You can request clean images via manufacturer if bulk buying

 

You can wipe it as you said with usb etc - but then this means you need hands on the device prior to sending it out etc

 

Steve

[Squelch]

User policies is our problem too. Currently our shared devices are used by staff and pupils, my intention is to change that so those devices have a restricted pupil profile applied at all times, when that happens we can get rid of hybrid as others have said above.

 

I guess it all depends how you run your shop really. Everyone has different usage scenarios, Intune does not suit all of them.

[Quinn]

There seems to be a few ways to do it

 

You can add all the apps to your store removal list - this then uinstalls them all as part of the “install” but you need to prepop that list

 

You can use scripts etc to remove them all, similar to metro apps

 

You can request clean images via manufacturer if bulk buying

 

You can wipe it as you said with usb etc - but then this means you need hands on the device prior to sending it out etc

 

Steve

 

i personally use the store removal list, however its fairly easy for me as we are using the VLSC image which doesn't have much to uninstall. But this means I don't have to do anything hands on once its set. Depends on your situation really.

[EssentialRug]

There seems to be a few ways to do it

 

You can add all the apps to your store removal list - this then uinstalls them all as part of the “install” but you need to prepop that list

 

You can use scripts etc to remove them all, similar to metro apps

 

You can request clean images via manufacturer if bulk buying

 

You can wipe it as you said with usb etc - but then this means you need hands on the device prior to sending it out etc

 

Steve

 

Interesting...didn't know about requesting clean images from the manufacturer. Great tip

[foofighterjim]

mmm there's certainly a lot to think about here.

 

Just tried setting up a brand new HP laptop I had spare.

 

I just let it boot into oobe, autopilot assigned (via get-windowsautopilotinfo.ps1 -online), waited a while ...

and rebooted, it joined intune ok but then I realised it still had all the HP crap free trials etc and lots of updates needed

 

So I guess I will need to wipe it and boot off a usb ?

 

Once in Intune try using the Fresh Start option on the device, from memory it removes all Win-32 apps installed on the device. Not perfect, but worth a try.

[mrstrong]

I guess with an existing domain joined laptop, I could grab hash and import into intune

then do a "reset this PC, remove everything" from the laptop's windows settings ?

 

As most of ours are LTSC 1809 I guess it would stay on that version, could I force it to

update to 22H2 in intune ?

[Quinn]

yep you can grab the hash using a PowerShell script and then add to Intune and wipe the device. not sure about the LTSC version as i use 22H2 which works fine for me.

[Wubbalubbadub]

Not saying you can’t, just saying everything seems to work worse than normal on-site methods

 

As a few examples, how are you dealing with security on machines when not all the user policies apply instantly? Meaning students can change settings around on 1st login to a machine etc (unless you mean hybrid then still needing servers/gpos etc)

 

Building shared machines without either manually assigning login/users to each, or having supported TPMs etc for self/deploy (bearing in mind that’s only in preview still)

 

Or if you’re upgrading a suite to SSDs/replacing failed HDDs without manually booting off USBs/ISO etc? (Unless you’re booting via pxe and then doing hybrid join etc)

 

Any kind of packages over 8Gb being deployed? (Think solid works/Adobe etc) as they’re not supported via InTune

 

Etc

 

Seems to be lots of these “workarounds/settling withs ” that are required to do things that should be basic if done on-site

 

Would be interested in throwing a long list of things like this to you two if you have time to see what you do with them if you have other ways around it

 

Steve

Security - We apply most security policies as Device policies. There isn't much (if all) difference between what we allow a staff member to do on a computer, compared to a student. That being said, unless you're a global administrator in Azure, a standard user gets the most basic with no admin anyway.

 

Building machines - We user enroll all machines, we then remove the assigned user - azure then converts the machine into a shared device.

 

Not sure what you mean with the USB thing? Imaging is done manually the first time - we then use autopilot reset when refreshing a device - or just re-image with a USB on a case by case basic.. Autopilot takes over the OOBE process - so is no difference to PXE booting in speed, if not a bit quicker, given no need to download the ISO from a network share.

That being said.. you could just have a clean install hosted on your network PXE server.. not sure why you would though.. as then you have a server on the network!

 

8GB limit - Speak to MS support, they will increase it to 30GB for you. We had to do this to get adobe published.

 

Throw anymore queries and I can do my best to assist/answer them.

[ConceroEdu_Brad]

Fully Funded Microsoft Intune Consultancy and Training (edugeek.net)

[cheekycharly]

Using Intune in our shared environment and removed the shared pc mode options as this causes more headaches than its worth. Without this, logon is seamless and has all the software required and auto configured OneDrive and other application on boot. Just takes a lot of time and policy creation and once it is all in place your golden.

[mjhardisty]

A good debate here. Obviously there are many ways to skin a cat - the quickest way as mentioned is to have new machines pre-registered by the OEM (Dell, etc) with your Intune config and set with a specific Group Tag so they are automatically assigned policies. Use the Group Tag to have dynamic Azure AD device groups that are then ready to go. Switch them on and away you go.

 

For ad-hoc machines, then either export to CSV ... or just use the USB at OOBE to capture the information. I think it's as quick as PXE-ing a machine in SCCM! Once a machine is into Intune the management should be easier. The last post about Fresh Start, etc, should give huge advantages on summer re-imaging work - just hit the button and the machine *should* rebuild itself from new.

[mrstrong]

been too busy to look any more into this .....

 

... but one last thing, can you just bypass autopilot e.g. user just goes into settings

and "Connect to work or school" and have them sign in with their 365 account,

(would need to leave on-prem domain first) ?

 

 

For my own benefit list of stuff to look into:

driver management

licensing: user or device (A3 vs OVS)

local admins

wifi (PSK?) / certs

activation (MAK via powershell script?)

printing!!!

access on-prem shares (e.g. nas)

device type: shared PC?

mdm mam scopes

microsoft store for education retirement

[cheekycharly]

Yes I dont personally use AutoPilot as we have a small netowrk so I just fire the machine up give it the name I.E. W11-"SERIALNUMBER" connect to the wifi and join the work/school domain. After this I just leave it logged in downloading its software / policies which can take a while but im usually busy on with the next machines to worry about the time its taking.

[mrstrong]

I guess you have to leave the on-prem domain first, before joining to azure ad ?

Also does it matter which user logs in first ? Just looking at my test device in

azure portal and it has me as the "Owner"

[mrstrong]

well since is relatively quiet here (teacher strikes) decided to try adding a

a newly imaged domain joined laptop via settings (had to leave on-prem domain first):

Access work or school option and click + Connect

Join this device to Azure Active Directory link

used my 365 account

Failed 80180014 error

looks like thinks its a "personal" device and blocks enrollment

created a new "windows restriction" to allow enrollment

Here https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/deviceTypeEnrollmentRestrictions

and it now joins.

 

in endpoint devices shows up as "Personal" ownership managed by Intune with me as as primary user.

Oddly (?) in azure portal shows Intune as MDM but it is Azure AD registered

i.e. not Azure AD joined !

 

Also on laptop there is only the one local user account Administrator so you can't sign in with

your email

 

Think I'm going to go back to autopilot