Intune/Autopilot Imaging

[Olliedawg]

Starting to dabble with Intune, mostly for staff laptops at the minute & staff mobile devices (company owned). All of our devices are currently domain joined (hybrid joined in 365 using Entra connect tool)

 

How do you all image your devices ready for autopilot?

We do have MDT/WDS setup already for our domain joined machines, so could utilise that I suppose? I tried making a fresh task sequence but getting it to cleanly end at the OOBE after a sysprep has been a massive PITA, spent most of the day looking at it... maybe it's just easier to image from a USB, or sysprep the device manually once the OS has installed.

 

Any advice would be appreciated!

 

edit: corrected typos!

Edited January 20 by Olliedawg

[BKGarry]

MDT is pretty much dead, but when I was doing it with MDT, I put this right at the end of the task sequence, after everything has been deployed

 

[Olliedawg]

5 minutes ago, BKGarry said:

MDT is pretty much dead, but when I was doing it with MDT, I put this right at the end of the task sequence, after everything has been deployed

 

 

Thanks i'll give that a go. I was specifying similar in my TS

 

%windir%\system32\sysprep\sysprep.exe /oobe /restart /quiet

 

Maybe the reboot was causing problems with the TS never finishing properly.

[itskdog]

When doing the initial transition over to Intune from AD, we used a USB stick with a copy of Windows 11 and a provisioning package from Windows Configuration Designer to enrol to Entra, which (through Automatic Enrolment) then automatically put the device into Intune - no need to collect hardware hashes (though you will just need to leave them connected to the network for a few hours to ensure all the policies and apps are picked up, there's no ESP with this method)

 

You could probably do similar with MDT to deploy a clean image to OOBE as above and then once each one has had the initial deployment, just walk around the building with the USB and just put it in each PC one-by-one.

 

You can use a dynamic security group in Entra to set policies based on the device name you picked during MDT, or have the PPKG change the device name during OOBE. (e.g. one naming scheme for student devices and another for staff devices)

[DavR]

23 hours ago, Olliedawg said:

Thanks i'll give that a go. I was specifying similar in my TS

 

%windir%\system32\sysprep\sysprep.exe /oobe /restart /quiet

 

Maybe the reboot was causing problems with the TS never finishing properly.

 

For what it's worth, I've got our MDT TS for this to 1) copy AutoPilot profile into C:\Windows and then 2) Delete Unattend.xml and reboot to the OOBE screen. There's also a batch file that clears up some leftover temp folders from the TS.

 

It's not a particularly dignified way of ending the TS and going to OOBE, but it's what the blogs I based our TS on at the time recommended.

[Jokrr]

We have gone through 2 iterations of intune/autopilot imaging and enrollment at our MAT the original method was a Windows 11 USB and manually running the get-windowsautopilotinfo script to upload the device to autopilot and add to a static device group which had the relevant profile assigned.

Our V2 method uses a Zero-Touch deployment of OSDCloud to install Windows 11, Drivers (Right now just Dell,HP, Intel Ethernet and Intel WiFi) and copy across our enrollment script which is pretty much Get-WindowsAutopilotInfo with azure app registration and 2 prompts for Grouptag and Asset Tag (Group tag and Asset tag are combined to name device e.g. ABC-1234). The enrollment profiles are now based on dynamic groups which use the grouptag to assign devices which has proven a lot faster and easier for the techs.

The process now looks pretty much like below:

1. Device is PXE booted to OSDCloud (Averages about 15 minutes for device to be imaged)
2. Tech runs the enrollment script and reboots the device after the script finishes
3. Tech then either pre-provision with autopilot (Win Key x5) or logs into the device (user-driven join) and waits for ESP to complete
4. Device is basically ready to go after ESP the only thing the tech needs to do is change the primary user to the correct staff/student or make sure the primary user is blank if its a shared device

It took a fair bit of testing to get it to its current state but feedback has been great from the techs. Happy to share the setup doc I made if you'd like?
 

[mrstrong]

@Jokrr would love to see your setup doc if poss. Started looking into intune (again) and the MS docs are a bit overwelming. 

 

Now MDT is EOL I've been wondering how to image machines going forward so will definitely have a look at OSDCloud.  

 

My plan is to get a teacher laptop setup in intune and then find a staff member to trial using it. Long term though we don't have enough

laptops for 1 per teacher so it will need to work with several staff logging into the same laptop / PC (guess that means a shared device ?)

I still don't really understand why you need autopilot e.g. could you just image it with win 11, login with a 365 account / local admin and join

to intune via connect in access work or school in settings ?

[itskdog]

9 minutes ago, mrstrong said:

I still don't really understand why you need autopilot e.g. could you just image it with win 11, login with a 365 account / local admin and join

to intune via connect in access work or school in settings ?

 

If you've used Apple devices e.g. iPads, you may be familiar with Apple School Manager, which automatically enrols the device into your MDM solution during first-time setup.

 

Autopilot is the Windows equivalent, it ensures the device is registered as a Corporate device rather than a Personal one, and then it just enrols to Intune and configures everything automagically with minimal interaction from the technician or user, plus if (for example) an enterprising child were to figure out a way to reset their 1:1 device to try and dodge the filtering and monitoring solution you've installed, it just comes back on its own into your control.

 

With self-deploying mode, you can even make it as simple as "Connect to the network and leave it alone to set everything up", too.

Edited January 28 by itskdog
fix paragraph order

[Olliedawg]

15 hours ago, Jokrr said:

We have gone through 2 iterations of intune/autopilot imaging and enrollment at our MAT the original method was a Windows 11 USB and manually running the get-windowsautopilotinfo script to upload the device to autopilot and add to a static device group which had the relevant profile assigned.

Our V2 method uses a Zero-Touch deployment of OSDCloud to install Windows 11, Drivers (Right now just Dell,HP, Intel Ethernet and Intel WiFi) and copy across our enrollment script which is pretty much Get-WindowsAutopilotInfo with azure app registration and 2 prompts for Grouptag and Asset Tag (Group tag and Asset tag are combined to name device e.g. ABC-1234). The enrollment profiles are now based on dynamic groups which use the grouptag to assign devices which has proven a lot faster and easier for the techs.

The process now looks pretty much like below:

1. Device is PXE booted to OSDCloud (Averages about 15 minutes for device to be imaged)
2. Tech runs the enrollment script and reboots the device after the script finishes
3. Tech then either pre-provision with autopilot (Win Key x5) or logs into the device (user-driven join) and waits for ESP to complete
4. Device is basically ready to go after ESP the only thing the tech needs to do is change the primary user to the correct staff/student or make sure the primary user is blank if its a shared device

It took a fair bit of testing to get it to its current state but feedback has been great from the techs. Happy to share the setup doc I made if you'd like?
 

I would be interested in seeing how yuu have this setup, please

[Jokrr]

Hi All,

Have attached the OSDCloud setup doc. For the enrolment script and app registration here is a good starting point

The autopilot setup is fairly straight forward have done a brief outline below:

Create a dynamic device group and use the below dynamic rule to add the devices with the appropriate group tag to the group (Replacing GroupTag with the correct tag)

(device.devicePhysicalIds -any _ -eq "[OrderID]:GroupTag")

then create a deployment profile and assign it to the device group.

Our specific setup is 4 dynamic groups per school (Staff 1-2-1, Staff Shared, Student 1-2-1, Student Shared)

I would also recommend setting up device categories and filters from the get go as it makes granular assignment of apps/policies much easier also helps to keep the environment tidy instead of using groups for e.g. IT Suites

Hope that helps

Edugeek_OSDCloud.pdf

[Pete66]

On 28/01/2026 at 00:07, Jokrr said:

We have gone through 2 iterations of intune/autopilot imaging and enrollment at our MAT the original method was a Windows 11 USB and manually running the get-windowsautopilotinfo script to upload the device to autopilot and add to a static device group which had the relevant profile assigned.

Our V2 method uses a Zero-Touch deployment of OSDCloud to install Windows 11, Drivers (Right now just Dell,HP, Intel Ethernet and Intel WiFi) and copy across our enrollment script which is pretty much Get-WindowsAutopilotInfo with azure app registration and 2 prompts for Grouptag and Asset Tag (Group tag and Asset tag are combined to name device e.g. ABC-1234). The enrollment profiles are now based on dynamic groups which use the grouptag to assign devices which has proven a lot faster and easier for the techs.

The process now looks pretty much like below:

1. Device is PXE booted to OSDCloud (Averages about 15 minutes for device to be imaged)
2. Tech runs the enrollment script and reboots the device after the script finishes
3. Tech then either pre-provision with autopilot (Win Key x5) or logs into the device (user-driven join) and waits for ESP to complete
4. Device is basically ready to go after ESP the only thing the tech needs to do is change the primary user to the correct staff/student or make sure the primary user is blank if its a shared device

It took a fair bit of testing to get it to its current state but feedback has been great from the techs. Happy to share the setup doc I made if you'd like?
 

Like to see the setup doc please.

[Spookyville]

18 hours ago, Pete66 said:

Like to see the setup doc please.

Me too please, thank you.