Annabelle

Thanks for your insight into Modern Management. It was very helpful. I have since talked to a Microsoft rep and your info is pretty spot on. Here are some notes to help me understand after talking to the MS rep. Workflow: Buy computer from vendor -> upload AutoPilot info to Intune (either get info from vendor or run PowerShell script to gather info) -> user logs in using Azure account -> machine is managed by Intune MDM -> computer grabs policies from Intune There is no need to reimage a computer if the computers are at least v1703 or later which is the requirement for Autopilot. If an older computer doesn't meet this requirement, then the computer will need to be reimaged using a Windows 10 ISO (no need to create a base image) using MDT or bootable USB. Don't use SCCM as it adds the SCCM client to computer which is not desirable. No need to use provisioning package from WCD tool. Intune takes care of "everything". I think the hard part for me is that I am coming from SCCM world, so I am comparing the process and performance to a traditional Windows computer. I see the inability to add non-MSI applications or customize the OS as a negative, but the selling point with Intune is faster sign-in (yet to be tested and confirm), more secure since the computers are getting updates from Microsoft and not need to rely on administrator managing the updates on SCCM (I have never really seen Software Updates work in SCCM), less management, etc. Instead of comparing this workstation not a traditional Windows computer, this needs to be compared to a Chromebook.

Can someone help walk me thru modern management of Windows 10 from when I first receive a laptop from the vendor to giving the laptop to the teacher or students. I am trying to piece together the workflow. How can I customize the OS? Do I still imaging it with a thin image or only apply provisioning packages created by WCD to customize the OS? Do I manually run provisioning package on each computer, so touching every single computer? To add the computer to the Azure AD, are the options bulk enrollment or Autopilot? Which method is better or what is the scenario to consider each method? What settings and policies are set by provisioning package and which are managed by policies in Intune? Thanks in advance.

I change the locale and region during deployment.

I asked a similar question before in the Technet forum. Students were able to run "gpupdate /force" in the search even tho cmd was blocked. The explanation given to me was that the commands that I ran were actually separate programs. They need to be blocked separately/individually.

I remove the Windows 10 apps during SCCM OS deployment.

I prefer hybrid approach: base image = Windows 10 + visual C++ + .NET Framework + MS Office + Windows updates. We also build the image using MDT. Then the WIM created by MDT is imported to SCCM. Within SCCM, there are several task sequence based with variations of applications that need to be installed usually differed by user type: students, teachers, admins, BitLocker. Computers are grouped by the room in the OU. Any specialty software such as Photoshop, Autodesk, etc will be pushed out imaging to a specific OU/Room.

Which collection are you deploying the task sequence to? When you first image the machines, most likely you would have deployed the task sequence to "Unknown devices". After imaging, it is no longer "unknown" and so when you try to reimage the same machine, no task sequence will be available to it. You then had to do what you did and that is to remove the machine from SCCM so that is it unknown to SCCM again. Alternatively is to add the machine to another device collection and then deploy the task sequence to this new device collection that you created.

If you don't want to wait and want to test that the deployment is working, you can go to the Control Panel -> Configuration Manger and grab the latest machine policy. Then see if the app shows up "quicker". If the application is still not deployed in 5 minutes then it is time to troubleshoot.

Just don't expect the applications to install right away, as soon as you add those machines to the device collection.

It could just be a timing issue. Deployment of software doesn't happen right after re-imaging. If you go to the Control Panel - Configuration Manager and force it to grab the latest machine policy, does it recognize that it has applications available to be installed? Check the three logs that begin with App* on the client machines.

What are the errors under Monitoring - System Status - Site Status?

Can you ping the fqdn of the DP server from your MP?

Could there be more than one USB driver and SCCM auto apply driver applies the wrong one? Have you tried specifying the specific driver package with the correct USB driver?

How do you deploy your drivers? Do you use the auto apply drivers or do you create driver package for specific computer model and then apply the driver package base on the computer model?

What's everyone approach to the Windows Store? Are you using the public or private store? Or do you just push out apps using SCCM?