Annabelle

Thanks for your insight into Modern Management. It was very helpful. I have since talked to a Microsoft rep and your info is pretty spot on. Here are some notes to help me understand after talking to the MS rep. Workflow: Buy computer from vendor -> upload AutoPilot info to Intune (either get info from vendor or run PowerShell script to gather info) -> user logs in using Azure account -> machine is managed by Intune MDM -> computer grabs policies from Intune There is no need to reimage a computer if the computers are at least v1703 or later which is the requirement for Autopilot. If an older computer doesn't meet this requirement, then the computer will need to be reimaged using a Windows 10 ISO (no need to create a base image) using MDT or bootable USB. Don't use SCCM as it adds the SCCM client to computer which is not desirable. No need to use provisioning package from WCD tool. Intune takes care of "everything". I think the hard part for me is that I am coming from SCCM world, so I am comparing the process and performance to a traditional Windows computer. I see the inability to add non-MSI applications or customize the OS as a negative, but the selling point with Intune is faster sign-in (yet to be tested and confirm), more secure since the computers are getting updates from Microsoft and not need to rely on administrator managing the updates on SCCM (I have never really seen Software Updates work in SCCM), less management, etc. Instead of comparing this workstation not a traditional Windows computer, this needs to be compared to a Chromebook.

Can someone help walk me thru modern management of Windows 10 from when I first receive a laptop from the vendor to giving the laptop to the teacher or students. I am trying to piece together the workflow. How can I customize the OS? Do I still imaging it with a thin image or only apply provisioning packages created by WCD to customize the OS? Do I manually run provisioning package on each computer, so touching every single computer? To add the computer to the Azure AD, are the options bulk enrollment or Autopilot? Which method is better or what is the scenario to consider each method? What settings and policies are set by provisioning package and which are managed by policies in Intune? Thanks in advance.

I change the locale and region during deployment.

I asked a similar question before in the Technet forum. Students were able to run "gpupdate /force" in the search even tho cmd was blocked. The explanation given to me was that the commands that I ran were actually separate programs. They need to be blocked separately/individually.

I remove the Windows 10 apps during SCCM OS deployment.

I prefer hybrid approach: base image = Windows 10 + visual C++ + .NET Framework + MS Office + Windows updates. We also build the image using MDT. Then the WIM created by MDT is imported to SCCM. Within SCCM, there are several task sequence based with variations of applications that need to be installed usually differed by user type: students, teachers, admins, BitLocker. Computers are grouped by the room in the OU. Any specialty software such as Photoshop, Autodesk, etc will be pushed out imaging to a specific OU/Room.

Which collection are you deploying the task sequence to? When you first image the machines, most likely you would have deployed the task sequence to "Unknown devices". After imaging, it is no longer "unknown" and so when you try to reimage the same machine, no task sequence will be available to it. You then had to do what you did and that is to remove the machine from SCCM so that is it unknown to SCCM again. Alternatively is to add the machine to another device collection and then deploy the task sequence to this new device collection that you created.

If you don't want to wait and want to test that the deployment is working, you can go to the Control Panel -> Configuration Manger and grab the latest machine policy. Then see if the app shows up "quicker". If the application is still not deployed in 5 minutes then it is time to troubleshoot.

Just don't expect the applications to install right away, as soon as you add those machines to the device collection.

It could just be a timing issue. Deployment of software doesn't happen right after re-imaging. If you go to the Control Panel - Configuration Manager and force it to grab the latest machine policy, does it recognize that it has applications available to be installed? Check the three logs that begin with App* on the client machines.

What are the errors under Monitoring - System Status - Site Status?

Can you ping the fqdn of the DP server from your MP?

Could there be more than one USB driver and SCCM auto apply driver applies the wrong one? Have you tried specifying the specific driver package with the correct USB driver?

How do you deploy your drivers? Do you use the auto apply drivers or do you create driver package for specific computer model and then apply the driver package base on the computer model?

What's everyone approach to the Windows Store? Are you using the public or private store? Or do you just push out apps using SCCM?

How is the WDS setup? Is it done thru Windows Server role and features or from SCCM? If you are completely stuck and will be be setting up SCCM again, do away with the CAS. Go with primary standalone. Unless you have more than 100,000 clients.

If the SCCM is managed by someone else, ask for access so that you can import OS, applications, etc and whatever other tasks that you need to get done. SCCM is RBAC so they can give some or all access to SCCM. You can install the SCCM console locally and connect to the server for any administrative work.

Go with one primary site with DPs at remote site. If bandwidth is an issue, limit the rate limit or schedule. When initially building these DP, you can build them at your primary sites so that the first download of OS, applications, updates are done over a local network. Then move the DP to the remote site and then subsequent downloads would include smaller updates (assuming you don't build new image often). Or you can also prestage the DP with content Only go with secondary sites with the remote schools have more than 500 computers or you need to control the upward traffic flow. Don't install MP everywhere either. No need to have fresh install of SCCM at every site. The purpose of SCCM is to simplify management and having SCCM at every site would defeat the purpose of that. Every image, application, update you would need to manage at each SCCM.

To what extent are you using SCCM for? OSD? Applications deployment? Software Update? Endpoint? Compliance?

Do you have a thin or thick image? Are you installing applications during task sequence? How many applications? How big are these applications? If you are installing big applications during task sequence (like Autodesk, Adobe Photoshop, etc), it will increase the deployment time significantly.

Create a new SCCM server with new site code. Look into using migration tool to move any old applications, drivers, task sequence, etc to the new SCCM install. SCCM clients will also need to be updated so it has the new site code.

I have a Windows 10 machine and able to deploy applications to it as available and install it in the software center. To help me understand your setup, you install Windows 10 using a DVD, then install the SCCM client manually onto this machine, and now try to install a software thru the software center? Does the software appear in software center? Or is the problem only when you select it for install and it doesn't install? What do AppDiscovery, AppEnforce, AppIntentEval logs say?

how is the computer name defined? did you define the variable OSDComputerName?

add a command line during the task sequence and modify the registry