How do YOU deploy Windows

[Oaktech]

How does this work when you have to reload every pc in school?

 

We currently PXE boot then intune does the rest but we may go serverless in school (or ditch as many servers as possible) in 2025 due to them becoming EOL

 

We did it at Easter - we're a large primary and we have around 350 Windows devices. We put the teacher's laptops & Admin desktops which are more modern into Autpilot which dropped us down to a shade over 300 devices to build, of which about a quarter are still on spinning disks. I got some help from my Trust and we hit it with 3 of us for 3 days with multiple build sticks each and we were done.

[jmak]

We're in the early days of autopilot/Intune. It's definitely the future, but it's not our mainstream yet. It does make imaging very straightforward: order from Dell enrolled in autopilot, hand straight to user and when they sign in with their AAD account and it's "imaged". Re-image is just a reset.

 

In the meantime, I've set up a WDS/MDT VM on an old PC with an old switch as my deployment workbench. We pay around £25/year for a Server 22 licence on EES. Obviously it's not on the domain, so can't add anything to the domain, but if you're going serverless, I guess you also won't be running a traditional domain anyway.

[pete]

For those of you deploying via Intune, how are you handling software that doesn't (or shouldn't due to licensing constraints) need to be deployed everywhere?

 

Google suggests targetting deployments using Azure AD Groups is noticably slower (to realise something needs installing/membership has changed) than using a device characteristic (is laptop, machinename = "fred") - anyone seeing that?

Edited November 22, 2023 by pete

[MartinT]

MDT to deploy, EMCO to install applications, WSUS to install updates, Group Policy to configure it all.

[Rob_D]

For those of you deploying via Intune, how are you handling software that doesn't (or shouldn't due to licensing constraints) need to be deployed everywhere?

Can't you use group based app deployment?

[CrootUK]

Centrally hosted SCCM with Co-Management for our Trust. Still not happy enough with Intune/Autopilot for that to take on the role full blown.

 

Networks are part of a MPLS, IP Helpers at each school.

Edited November 22, 2023 by CrootUK

[pete]

Can't you use group based app deployment?

 

You can, but I seem to recall a thread that implied you paid a time penalty for doing so.

 

Right, found the post I'm mis-remembering:

 

The sub-thread discusses some (disproportionate) processing overhead through the use of Azure Groups. A few posters are only seeing that with dynamic groups in Azure AD (which I'd expect to be a bit more grindy), but others are seeing it with static groups as well.

[psydii]

Imaging/Build method history (most recent > oldest) SCCM, WDS, Symantec Ghost, RM Connect 2.4, 2.3 (can't remember if the build method had its own name) RM NET LM (diskless stations)

Ahhh they joy of further customising the highly customised rpl boot of RM LanManager to squeeze in an IPX stack to play doom deathmatch.

 

Any how... to the question: our fully cloud devices are autopilot/intune/AAD managed and don't even get line of sight to our legacy infrastructure.

 

Would be interested to hear how the MAT is approaching print management/accounting, building access control and cctv.

Edited November 22, 2023 by psydii

[Oaktech]

You can, but I seem to recall a thread that implied you paid a time penalty for doing so.

 

Right, found the post I'm mis-remembering:

 

The sub-thread discusses some (disproportionate) processing overhead through the use of Azure Groups. A few posters are only seeing that with dynamic groups in Azure AD (which I'd expect to be a bit more grindy), but others are seeing it with static groups as well.

 

We see no appreciable issues with static groups or dynamic groups for users. The only issue we see are with dynamic groups for devices. The initial processing is inconsistent - I assume based on load at MS. Sometimes membership changes are updated within a few seconds, sometimes it takes an hour or more.

[KK20]

You can, but I seem to recall a thread that implied you paid a time penalty for doing so.

 

Right, found the post I'm mis-remembering:

 

The sub-thread discusses some (disproportionate) processing overhead through the use of Azure Groups. A few posters are only seeing that with dynamic groups in Azure AD (which I'd expect to be a bit more grindy), but others are seeing it with static groups as well.

 

I have not observed the above, we use dynamic groups for our autopilot device IDs, as an extra heap of janky mess I also script our hybrid onsite AD into device groups! So our OUs are replicated via script into AAD (which get written back in a perverse twist), this lets me replicate our GPO software deployment via intune group deployment. Once we transition fully out of hybrid I can continue with the 365 pseudo OU groups.

 

We do preprovision though, this installs everything immediately. Error reporting is horrible, however collecting the extension logs can be fruitful (providing you are happy scrolling through CMtrace screens). With intune everything takes hours, not minutes. No gpupdate /force in a batch file, no group policy modeling or results, no gpresult. Test, test and test again with intune. It does work but I find it to be a massive backwards step compared to GPOs.

[Guest]

my recommendation would be to get intune and autopilot some resellers can get these machines added before shipping, set up for new new machines and then other machines i think i seen it some form off installer to your needs may need a PC though for the installers