setting up devices with intune

[cdwyersandysecondary]

Hi,

 

just done my first autopilot / intune "deployment" to a VM following this

https://learn.microsoft.com/en-us/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm

 

I then managed to do a deployment on a real laptop:

 

burnt the win10 education iso from vlsc to usb and booted from the usb

harvest hash/load to autopilot: get-windowsautopilotinfo.ps1 -online

wait till assigned, reboot, go through setup / login.

 

All a bit long winded / manual process!

 

How do you do this in production?

I.e. for newly purchased devices and exiting devices you

want to move from on-prem to Azure AD joined managed via intune ?

 

E.g. at the moment I update a VM then capture the wim image.

For new PCs / laptops we've bought or existing devices that may have an issue (e.g. hard drive fail)

I just pxe boot from WDS and install via MDT.

 

 

Our process is -

 

New devices:

 

If manufacturer supports it, have them upload the autopilot hash’s.

 

Assign scope tags (laptop, teacher, office etc)

 

Log in and build (using user deployment as self deploy too unreliable)

 

If manufacturer doesn’t support hash upload, we have an MDT task sequence that installs a clean wim of windows 11 (much easier as never need a ghost image, if you need latest version of OS, just swap the wim with the newest. All policies and programs installed during the autopilot process)

 

Existing devices, we just fresh start and sign in.

[chaplic]

My process - got rid of on prem AD and associated services pre covid.

 

Get laptop from manfuacturer

Sign in with AAD account, device automatically autopilots. Don’t think I do much during the autopilot process

 

From AAD portal rename machine to laptopnnnnn (asset tag)

Add to a teachers devices or pupil devices group which applies policies and software

some auto removal of crapware

Leave for a few hours to do its thing.

 

Supply to end user.

 

Rebuilds are pretty rare, but just from a win10 ISO put on a USB stick

Manual removal of crapware where its unique / I haven’t got round to automating removal

[TechMonkey]

Sign in with AAD account, device automatically autopilots. Don’t think I do much during the autopilot process

Can I ask how did you set this up? Not managed to find an automated way to do this except manufacturer doing it or them supplying all the hashes.

[chaplic]

Must admit I could not remember but I think it's this

Automatic registration of existing devices | Microsoft Learn

 

it's just that it's an existing device for merely a few minutes...

[_techie_]

I use my OSDCloud ISO on a fresh laptop that I install Win10/11 over the internet including the corresponding driver pack. Then once that's done, shift+F10 and install all windows updates, rename computer to serial number then reboot.

 

I then use the powershell module AutoPilotOOBE to do the autopilot enrollment which is online and you can name the device here too and Group tag. You can even specify sysprep reboot/shutdown and wait for the tag be be assigned before sysprep.

I then am doing the autopilot pre-provisioning which means when I'm handing it over to the staff member who I've assigned it to in the autopilot device console.

 

It's far from quick, but I'm only doing this on staff 1:1 devices (laptops) at present...

We also tried this (Intune) with shared laptop trolleys and it was far from perfect IMHO. Ive achieved better results with GPO for shared hot desking computer suites at present. The settings are enforced from the point of logon in the in the case of computer suites with GPO.