Win 11 - Hybrid joined devices renaming

[TheRobins]

Morning all,

 

I know the official answer is no, and its not suggested however for operational reasons at the moment I need to stick with hybrid joining devices.

 

I have been testing sucessfully autopiloting a device, and then getting it entra and the hybrid domain join then taking place. All works nicely. However as part of this procedure devices are given a random name after my choice of a prefix based on its deployment profile. Whilst this works in an ideal world I would have the devices named specifically for locating them, assigning them and managing them with other tools such as Senso.

 

I have done some reasearch and in theory it can be done by renaming the device locally and on AD, which entra connect will then within 10 minutes or so pick up and change the name in Intune and Entra. I have done this with a test device with an awfully complicated and long winded powershell script, which if I had to do for each machine would take far too long. 

 

I am not sure if anyone else has played with this but I have had a few theories.

 

• Remove the hybrid join stage from the deployment, get devices entra joined, rename them here and then hybrid join (if it can be delayed from the autopilot process)
• Try and tweak then powershell script to make it a bit more autonomous, looking to co pilot for this.

 

In theory, I could leave them named as they are but its going to create much work going forwards that hitting it at deployment might be the best way.

 

[Boredguy]

My solution was in the Domain Join naming section in InTune, when providing the prefix value, to have -AP- within the name.

 

We then created a PS script to rename the computer, and if it can't find a copy of a computername.txt file created during the MDT process (we tweaked the naming script), then it looks to a central CSV file that holds the MAC address and names of devices.

So this doesn't get applied to stations all the time, we have a filter setup to only apply to devices containing -AP- in the name.  This application is set as one of the few we insist is installed during the Autopilot process, but also means if a wipe is done remotely it runs again

[TheRobins]

Interesting solution.

 

Assuming that this is injected into the autopilot stage, and also relies on the device being on prem with an open shared CSV to read?

[Boredguy]

It does rely on it being on site, but isn't an issue for us since it'd only deployed out to our Hybrid build devices which are typically onsite only, or they get AoVPN installed soon as they join the domain.

Does mean it won't rename the PC if we do a remote rebuild if someone is offsite with it, but thats a minor issue

[TheRobins]

Looks like Microsoft have recently released some guidance on doing this. I have managed to get together a small script to sucessfully do this even after the device is hybrid joined.

 

How it works is.

 

• In the AD Group, you need to delegate the machine (SELF) to be able to read and write computer name in each OU that your hybrid devices will be joined into.
• Run the script which asks for the machine name you want to rename to.
• Script then checks DC connectivity, if all good the machine will rename itself locally, rename itself in AD (and re-gen a certifcate) 
• Once the AD rename is complete, machine will reboot and the naming will be complete. Entra Connect will then rename the device in Entra once the next sync takes place. 

 

Seems to work well so far, You can manipulate the script to run as a scheduled task and do many other things, I just want to keep it simple.

 

 

[psydii]

Last time I checked, if your reset/re-image an autopilot device, it picks a new random name. Might be worth checking that interaction doesn't break when you've renamed the account in AD.

[TheRobins]

I did think about that, but if you fresh start a device, it alway re-creates a new object in both Entra and AD, just one to watch when fresh starting that I remove stale devices and licences from SENSO and Sophos.

 

But with any luck its rare we have to fresh start a device anyway.