[24h2 / lts 2024] Deployment of Hybrid AD Devices

[ZakFarnworth]

Hello!

 

I’m unfortunately having to move our Class devices & office devices, anything that isn’t going to move on-site to a Hybrid AD deployment as we’ve been having a range of issues with Cloud only, particularly printers…

 

I’ve got the connector for it all setup and I know it works. But, when I come to deploy a device on MDT, I don’t sysprep or anything like that as those days are over for me, I have been able to just deploy the device on a fresh image, and it join the domain, got the GPO setup for automatic enrolment and set to user credentials.

 

One thing I’m concerned with, is that I’d have to wait until someone has logged into that PC for it then to install apps.

 

I just wondered whether there was a way around this?

 

I know I can use the domain join profile in Intune with Autopilot for Existing Devices template on MDT but I can’t get around the 15 characters limit, nothing I put in works.

 

Any ideas?

 

Thanks 🙂

 

Zak

[Boredguy]

You can select apps to be deployed as part of the initial join, which is what we do to ensure MS Office, Adobe Reader, VLC, Impero and our custom PC Renaming script (so that we don't have to deal with random names InTune generates, but uses the name we specified in the MDT setup)

 

We setup device filters based on the workstation naming convention for the different rooms, and each of the locations have their own Domain Join configuration setup so they go into the correct OU and the start of the name matches our basic requirements.

 

Your station names should really be at or under the 15 character limit

[supps]

@Boredguy Do you mind sharing your custom PC Renaming script/setup please? I have found some online but they just rename to the serial number, we are looking for it to be linked to the classroom name/number. I have been pulling my hair out with this!

[Boredguy]

@Boredguy Do you mind sharing your custom PC Renaming script/setup please? I have found some online but they just rename to the serial number, we are looking for it to be linked to the classroom name/number. I have been pulling my hair out with this!

 

We still use MDT currently to deploy out the computers, so using the "normal" Name PC prompt it gives we select our computer name (We updated it a bit so it has drop downs for the different OU's and prefills the names)

Before the MDT restarts after installing the OS, we run the following Powershell script, so make sure you have PowerShell enabled in your MDT Boot WIM.

 

You can do it with normal batch files, but I went down the Powershell route as my MDT script also goes and edits the unattend.xml file but it's not really needed but makes it nicer in the monitoring logs. Of course once MDT stops working with Windows 11 we have to look at this again, but for now it's fine.

 

In MDT

 

Script grabs the OSDComputerName variable provided in the MDT process and saves it as a text file in C:\Windows\Logs\Software folder (and creates said folder)

$TSEnv = New-Object -COMObject Microsoft.SMS.TSEnvironment  
 
#Get Name and OS Disk from MDT  
$MDTComputerName = $TSEnv.Value("OSDComputerName")  
$MDTOSDisk = $TSEnv.Value("OSDisk")


#Create Software logs folder
if (!(Test-Path $MDTOSDisk\windows\logs\Software)) {
  New-Item -ItemType Directory -Force -Path $MDTOSDisk\windows\logs\Software
}
#Create File with Computer Name for renaming post install
New-Item $MDTOSDisk\windows\logs\Software\OSDComputerName.txt -ItemType File -value $MDTComputerName

 

In InTune, we have different Hybrid Join configurations for each OU and it's based on a filter on the first part of the computer name, so for example our sites all start with with the 3 letter school Code (A) followed by Type/OU location then number so AAA-LT-01.

We then create a filter up where stations matching AAA-LT- are applied to the Hybrid Join Configuration for the LT area, but I have the default naming in the InTune config then be AAA-LT-AP-%.

 

I can then use a filter for the renaming application so anything that has "-AP-" in the name in a AutoPilot built device pending renaming.

 

Now the Actual script we have to rename the PC from the AutoPilot random name to what we actually want is has 2 files.

 

Install.cmd

%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy ByPass -file "%~dp0PCRename.ps1"

 

PCRename.ps1

$password = "XXXXXXXX" | ConvertTo-SecureString -asPlainText -Force
$username = "AAA\Setup" #Use an account that only allows computers to be renamed/joined to domain.  Does not need to be full admin as long as you have granted these rolls to the OU


#Check to see if OSDComputerName file exists
if (Test-path("c:\windows\logs\Software\OSDComputerName.txt")){
   #File Exists
   #Check if the Completion log file exists, as we've already run the script once
   if (Test-path("c:\windows\logs\Software\CheckComputernamePackageComplete.log")){
       #Check File Exists, so we don't want to do anything
       write-host "Nothing to rename here, Check file exists"
   }
   else {
       #File doesn't exist, so lets check if we actually need to rename this workstation or not
       $NewComputerName = get-content c:\windows\logs\Software\OSDComputerName.txt
    $NewComputerName=$NewComputerName.TrimEnd()
       if ($env:COMPUTERNAME -ne $NewComputerName){
           Write-Host "Computer name file and device name don't match so renaming"
           #Name doesn't match so lets rename the computer
           [PSCredential] $credential = New-Object System.Management.Automation.PSCredential($username, $password)
           Rename-Computer -NewName $NewComputerName -DomainCredential $credential 
           echo "PC Renamed by Script" > c:\windows\logs\Software\CheckComputernamePackageComplete.log
           restart-computer -force

       }
   }
}
else {
   #File Doesn't exist so we can't rename the computer, so lets drop the check file in place anyway
   Write-host "No Computername file available, PC likely reset via InTune Console, so nothing to rename to so completing"
   echo "No OSD Computer File available to rename to" > c:\windows\logs\Software\CheckComputernamePackageComplete.log
}

 

 

This is packaged and set as an InTune package.

It's set to allow InTune to do a mandatory device restart, and checks for the "CheckComputernamePackageComplete.log" in the "c:\windows\logs\Software" folder.

It's applied to all devices with a filter which has devices with -AP- in the name.

 

We then force this package (along with 5 others) as being installed as part of the build process, so when the computer gets to the login screen it's renamed and has at least Office and Impero installed.

[ITtech95]

Hi Boredguy,

 

This is what I've been worried about for quite some time. We will be moving from SCCM to InTune. Tell a lie, I believe we will be Hybrid joining. It's great to hear that you're able to pre install applications such as Adobe Reader. This is what I currently do in our "Golden Image" on SCCM.

What I was wondering was if those applications that are being pre installed are still patchable when a new update comes out? What I've found was that an application on our Golden Image would difficult to patch, whereas an application installed via Task Sequence is as simple as creating a new up-to-date application and replacing it in the task sequence. Also, is it quite a simple process to pre-install these applications?

 

Apologies, if what i'm saying isn't making sense. I've kind of just got to grips with SCCM and managed to automate applications based on room numbers during LDAP input and using one single task sequence for ALL machines (I came into this role as a apprentice and there were 4 different task sequence, Yikes!). Now we're changing everything due to wanting to become Cyber Security compliant.

 

Thanks

[Boredguy]

Hi Boredguy,

 

This is what I've been worried about for quite some time. We will be moving from SCCM to InTune. Tell a lie, I believe we will be Hybrid joining. It's great to hear that you're able to pre install applications such as Adobe Reader. This is what I currently do in our "Golden Image" on SCCM.

What I was wondering was if those applications that are being pre installed are still patchable when a new update comes out? What I've found was that an application on our Golden Image would difficult to patch, whereas an application installed via Task Sequence is as simple as creating a new up-to-date application and replacing it in the task sequence. Also, is it quite a simple process to pre-install these applications?

 

Apologies, if what i'm saying isn't making sense. I've kind of just got to grips with SCCM and managed to automate applications based on room numbers during LDAP input and using one single task sequence for ALL machines (I came into this role as a apprentice and there were 4 different task sequence, Yikes!). Now we're changing everything due to wanting to become Cyber Security compliant.

 

Thanks

 

I've not used a "golden image" for over 20 years. We just use the stock Windows image file.

In InTune, we have Office 365 apps setup to use their store version so it's always up to date for deployment, same with Adobe Reader.

 

Within your Windows Deployment profile in InTune, you can select which of your applications you want to push down to the station during the build, so we have a few "core" applications that would go to any device (be it full Azure or Hybrid) leave the subject/department specific software to pull down in the background post installation.

[ITtech95]

I've not used a "golden image" for over 20 years. We just use the stock Windows image file.

In InTune, we have Office 365 apps setup to use their store version so it's always up to date for deployment, same with Adobe Reader.

 

Within your Windows Deployment profile in InTune, you can select which of your applications you want to push down to the station during the build, so we have a few "core" applications that would go to any device (be it full Azure or Hybrid) leave the subject/department specific software to pull down in the background post installation.

 

Fantastic that makes sense. Are there anything else you would recommend I look into other than automation of application depending on departments/room numbers? I wanted to look into breaking down our naming convention further. Currently doing the following with the asset number added to the end: WD = desktop, WL = laptop, WS = server. I wanted to break down laptops to WL = student laptops and WT = teacher/business staff laptops. The reason for this is because we're finding teachers that tend to damage a laptop and then just swap it with one in a classroom with the same spec. I was hoping to create some sort of policy which will stop staff from logging into student machines and vice a versa (other than a few exceptions such as IT staff members).

[Boredguy]

One of our techs went down a whole complex naming convention, forgetting your limited to 15 chars.

 

We typically just stick with the school site code (since we have 7 sites), Room/Type of device and then it's number in that area.

 

We don't generally limit who can logon to a device, they all basically have the same security level, just staff have marginally less things restricted

[ITtech95]

One of our techs went down a whole complex naming convention, forgetting your limited to 15 chars.

 

We typically just stick with the school site code (since we have 7 sites), Room/Type of device and then it's number in that area.

 

We don't generally limit who can logon to a device, they all basically have the same security level, just staff have marginally less things restricted

 

Haha, luckily our assets numbers are only 5 digits long so it would be 7 characters. Thanks for your insight, appreciated!