2023E11 - Windows Provisioning (5-Ways including Autopilot) (I.T)

[@vladgrigoroiu5335]

Thank you for the amazing content guys. After scouring the internet quite a bit for some proper intune training tutorials, I will say that yours are hands down the best. Please keep the coming! 🙂

[@IntuneTraining]

Glad you like them. We certainly enjoy making the content. Hope you find what you need!

[@oopsgaming7111]

Thank you so much for the amazing content and many laughs along the way. I am new to intune and this video has helped me alot to understand the windows enrollment processes and I'm taking it as a guide to test development in my lab environment. 😊

[@danpowell7421]

this was a great video to watch :) Particularly loved the conversations and options about each provisioning topic.

[@dstowers]

side note: if you have Blocking Apps set to "selected" but select nothing it will not just move past it like I would expect, instead it seems to randomly pick assigned apps (sometimes 1, or 2, or 5, etc) and hang up the whole process so at minimum have Company Portal or Office or something consistent. This is assuming it was just a bug and hasn't been fixed yet.

[@mutallimibrahimov4566]

Amazing content guys. Really enjoyed ! Here is to many aspect that considerations. In some regions Companies purchase Free DOS laptops. So it means OOBE is not good choice in this scenario. Also I think Ent version required for compliance.So in other case status will be net eveluated. I am also preparing for intune nowadays, I am currently using it in hybrid joined mode. But not using autopilote for now :)

[@bash-shell]

Thank you for the providing such great content, such video quality so high I can put it on a tv and see details.

[@jonshaw2780]

Agreed, thank you.

[@itst0000]

11:50 would it be more secure to allow auto enrollment for a default security group that includes ALL staff?

[@zyeuh2565]

The PRT token can be refreshed on a users device to speed up the recognition of the new role activation ( local AAD joined admin ).

[@Hans-gb4mv]

43:35 The option "Block device use untill all apps and profiles are installed" is not the same as not showing the ESP. When showing the ESP and with the default of this option set to Yes, the user cannot get to the desktop unless everything is installed successfully. This can become a pain in the proverbial ass when you have enabled the ESP and an error occurs, because now you're stuck. No way to the desktop, only option is to reset the device and start all over. When you set this option to No, a button is added to the bottom right of the ESP labelled "Continue anyway" which the user can press at any time and you will just continue with the device onboarding.. I did see some new options however in this video that must have been introduced earlier this year, gonna have a play around with them, because it is nice if we can simply select the minimum applications and allow the user to continue after that.

[@andream2836]

Thank you. Would it be possible to also do a video on troubleshooting pre-provisioning issues?

[@itst0000]

7:30 is this still true, only way supported by msft for domain joined to entra only? once you wipe, you would then configure for AP?

[@esraguler5831]

Thx

[@markuss4314]

This is great, thanks!

[@ehababumoailish6574]

this is nice dive in windows enrollment options but usually the company's with existing on-prem DC switching first to hybrid to ensure they manage their devices and push heavy software's by SCCM on-prem... etc , as still the intune will be slow slow for heavy SW to be installed!

[@jamesg871]

1:12:45 the bickering gets too much sometimes and is hard to watch.

[@moepskie]

23:00 can confirm. Our IT partner recommended us to not leave it on "Not configured" but to set it on Enabled or Disabled "just in case" because "Targetted Windows Hello for Business policies will overwrite it anyway". Well damn was our IT partner wrong. The moment we switched this from "Not configured" to "Disabled", we immediately started having WHfB conflicts in our entire organization: The event logging kept showing WHfB switching between "on" and "off" every 5 minutes, WHfB sometimes would not setup anymore, and WHfB reset service also did not work anymore. Like Adam and Steve are saying, leave this at "Not configured" at all costs.

[@ehababumoailish6574]

i think best way when you keep it not configured here, is creating a device configuration profile to disable it for your specific groups\all ... as when they left it only without change its still asked them to setup WHFB everytime they login!

[@JH-ix9md]

When adding company portal from Microsoft Store app (new), I can’t change value to System, it is dim to User value only. Not sure why. Any idea?

[@eddie81585]

Great Video! New to Intune.. In the User-Driven Autopilot it was mentioned the device needs to be registered in Intune while doing the Get-Windowsautopilotinfo, but then in the BYOD User Enrollment you simply signed in and the end result appears the same as all the previous steps (Intune/Corporate). How did that happen with that out the store computer? Isn't it suppose to be registered first in Intune? The BYOD User Enrollment is path we are looking to implement.

[@eshin087]

If our organization has a mix of on site and remote workers who need to access on premise servers and applications, should we be configuring the on site endpoints as hybrid joined? Wasn’t sure how entra joined devices work when they’re connected to the network on site to access internal domain resources

[@IntuneTraining]

Entra joined all the way, as the user needs to access the data not the device, with ideally a split tunnel VPN that will route traffic that is needed back to your corp network

[@itst0000]

can you please explain why you block all byod? that would mean employees cant work from home or cellphone unless you provision laptop for them? if they entra join byod + conditional access/compliance policy then personal device should be no concern?

[@JordanFromIT]

Thanks guys for the awesome videos they have been super helpful for us rolling out intune so far. I'm currently trying to get Autopilot setup at work and the keyboard layout issue for Australia you mentioned at 35:00 has been driving me nuts. Any suggestions on the best way to get around this? Currently looking at using a PowerShell script but it seems a bit messy

[@stokesx7]

my devices enrolled with no assigned group and I can't find a place that will let me add them to a group

[@itst0000]

25:10 what did johannes say?

[@winston1387]

Can't Shft+F10 on Windows 11 anymore with new machines. What is the work around?

[@richardbell4631]

One interesting thing I've noticed personally (I need to see if this is still in effect) is that blocking all personal devices seemed to also block Automatic Enrolment BYOD without an Autopilot profile.

[@IntuneTraining]

That's because any windows device not registered with autopilot is classed as not corporate owned

[@tony6626]

It's weird, i got the same experience with ESP - default ran 1st time on the VM, Reverted and custom ESP loaded fine 2nd time around. Is this just a bug with using the VM, time delay, or did you find out why this happened?

[@brianbagchaser]

is there a way to enroll them into intune without doing a device reset?

[@Eagle710soarhigh]

If i watched alot of your original videos but simply want a refresher or maybe a little more in depth should i watch the reboots shows? Specifically im looking at prevent personal device from enrolling but knowing alof of the devices out in the field are actually corporate owned.

[@xkorbekx]

is byod user supposed to select 'join this device to AAD'? i thought "join" was only for corporate devices

[@IntuneTraining]

The join this device option will make the device Intune managed. Which for Windows is managed just like other Intune managed devices and not generally recommended.

[@certstudydev]

Love this one. Even the Android enrollment was bomb.Any chance of doing a Samsung Knox + Intune enrollment for Android?😢

[@IntuneTraining]

Unfortunately no. We don’t have access to Knox to be able to setup a demo lab for that.

[@KyleWilcox]

We use the Self-Deploying mode and do the unboxing and first time setup because we are in education and are giving these laptops to students. It would be real annoying for students to sit in class and wait 10 minutes for user driven mode. And it would be 20 devices all trying to do user drive off the same AP so that wouldn't be great either.

[@KyleWilcox]

We also login with a generic user 1 time so they don't have to wait at the ESP screen.

[@Soulreigner]

I appreciate the videos, as always. The naming template proves invaluable when dealing with over 500 devices across 15 schools and various departments within the Tenant, especially for Autopilot setup to deploy policies efficiently. However, I've encountered an issue post device enrollment in Intune, specifically with new devices. The Autopilot profiles aren't automatically assigned until after a user signs in. Do you happen to know a more effective way to manage these schools? I currently utilize dynamic groups and group tags, but this delay in Autopilot profile assignment poses a challenge. Is the only alternative to set up a laptop for a user, apart from having them sign in, through the JSON route? You mentioned that most people are familiar with working on computers or at least starting the Windows installation. Unfortunately, this isn't the case for many teaching staff, some of whom struggle with basic tasks like using OneDrive. Our IT team aims to simplify the device setup process as much as possible for end-users. Any insights or suggestions would be greatly appreciated.

[@Hans-gb4mv]

Can you explain a bit more about the process that you are using or where you are having issues? Because I'm a bit confused. You state that you have an issue post Intune enrollment, namely that the Autopilot profile is not assigned, but how did you enroll the device in Intune? As that is essentially the task of the Autopilot profile. Autopilot does essentially 2 things: it loads settings for the OOBE (what to show, what to skip) and it ensures that the user logs into your tenant to start the enrollment process. We also use group tags, create dynamic groups based on those tags and assign the Autopilot profiles to those groups. And while it does take a little bit of time, that usually is no issue as the devices are in the Autopilot Devices list even before they arrive at the location. We assign the group tag once they are uploaded and before they are even delivered. At that point it doesn't matter if it takes 10 minutes or 10 hours to sync everything. With Autopilot setup correctly and with good policies in Intune that enable SSO for a lot of services, like OneDrive, the user can walk through the OOBE very easily with just entering their credentials (except when they want to onboard on wifi as then they will get to select language, region and keyboard as well).

[@Soulreigner]

@@Hans-gb4mv When enrolling the device, I opt for the PowerShell online method. However, although this successfully enrolls the device into Autopilot, it falls short of assigning the device to an Autopilot profile. The device status consistently indicates "not assigned," preventing the computer from updating and restarting itself. Consequently, the user doesn't experience the Out of Box Experience (OOBE). To address this, we find ourselves signing into the computer (ourselves preping the computer for the user) manually to apply the profile and then triggering an Autopilot reset for the computer. The Autopilot is assigned to a dynamic group using the associated naming convention, and both Autopilot and policies are applied using policy sets. While there are no issues once the device is enrolled, preparing them for the user's OOBE becomes a challenge, as the Autopilot profile is not assigned until after the user signs in. Thank you for the reply and time taken to respond

[@Soulreigner]

@@Hans-gb4mv after explaining I realize what I have done. I have everything pointed at dynamic groups but nothing to devices not in a group. I've made changes to allow for this I haven't tested it but am sure it will work. Thanks again for the replies

[@Venom58970]

Hi thank you for this video its helping a lot i did not catch the name of the guy who has the script for captuer and uplod

[@cazibrasga]

Going to have to slightly disagree on leaving the Autopilot device name template the default or using only the serial number. If you only use %RAND% or %SERIAL% you'll likely end up with computers names all over the place (A...., D...., K...., X...., etc.), when listing all devices for reporting and administration. There's potential for them to get mixed in/between other different devices, such as mobile devices and even potentially server names on the list if those are sync'd to EntraID/AzureAD. I would recommend at least prefixing them with a device type, for example, PC-%SERIAL% or possibly CompanyPC-%Serial% (if it's short enough). That way all of the devices can be easily sorted and filtered, when dealing with bulk Intune lists, reports, and administration. It will keep things more organized, for example (Android-%SERIAL%, iOS-%SERIAL%, PC-%SERIAL%) and provide "at a glance" information and context to technicians.

[@IntuneTraining]

While I get your point, one rule we generally go by is - don’t add info in the device name that is already available in the drive record (one of the other columns you can filter on). It’s easy to filter out the noise quickly without adding additional stuff to the name. Plus you’re not careful you can easily end up with duplicate device names when using serial if you use too many prefix characters. We had that happen with surface devices where the last part of the serial was the same on all models but the first parts were different. The serial gets truncated from the end resulting in duplicate names. Do what works best for you but honestly I think if you gave it a shot, you’d find a great deal of freedom on not customizing device names and just relying on other fields for filtering/reporting. -Adam

[@cazibrasga]

@@IntuneTraining I think the bigger issue is for anything else that deals with all of the enterprise endpoints outside of Intune the names look like a mess with difficulty determining the device unless you drill down or look up their details in Intune or asset management. For example third party support tools, AV cloud consoles, security logging, etc. I guess I’m just a little more OCD about device names being in order by type across the enterprise.

[@itst0000]

@@cazibrasga interesting. I do filter by "XYZPC or XYZLPT" in tools like carbon black and thats been easy.

[@itst0000]

@@IntuneTraining is there an inherent disadvantage?

[@BananaCat_007]

❤❤

[@MrTWeatherbie]

Adam would like to know if you could talk for 15 minutes. I have a similar background story as you and would like to pick your brain.

[@IntuneTraining]

Sure. Shoot me an email. Firstname @ Intune.training

[@TheStevenWhiting]

Somewhat pointless if not also going to walk through hybrid. Lots of people will be in that situation.

[@drakeolson5871]

While supported method, Hybrid Autopilot isn't recommended for new devices. That may be the thinking for not having it be a big part of the video. Literally the only thing I have come by is wireless 802.1x doing LDAP look ups of computer objects not able to do Entra ID join.

[@IntuneTraining]

We will continually stand by our position of avoiding Hybrid Provisioning. We don't believe it's necessary and Microsoft specifically even recommends against it. See the top blue box on their docs page here: (learn.microsoft.com/en-us/autopilot/windows-autopilot-hybrid). Additionally, there are numerous other sources for information about settings up Hybrid Autopilot and we don't have the infrastructure in our labs anymore to even be able to demonstrate it anymore. Have you tried going Entra ID only (AADJ) or do you have specific items that don't work for you today?

[@itmunky]

Hybrid AD Join is not necessary for most scenarios. I have been deploying AAD only devices for a while and I have found it much easier to manage them through Intune. AD Connect takes care of the authentication and I can still access the on-prem resources as needed. For older devices, I have migrated them to Hybrid AD Join and I have also seen the benefits of using Intune for management. Hybrid AD Join adds complexity and overhead to the provisioning process and it is not recommended by Microsoft unless you have specific requirements that AAD only can’t meet. I think the video does a great job of showing the different ways of provisioning Windows devices using Autopilot and Intune. 👍

[@bash-shell]

It’s 2024… put your windows phone away…

[@Hans-gb4mv]

the question I have to ask at that point is: why do you require hybrid? When I started looking into using AutoPilot in my company, one of the first issues I ran into is that a hybrid deployment requires line-of-sight with a domain controller when the user gets to the login prompt for the first time. This is fine if your users are always in the office, but that was not the case in our company. So I asked our most senior guys and they said: nope, not allowing a device VPN tunnel so you can have LOS at the login prompt. So, I quickly started working on non hybrid join. And yes, there's a lot of pain that goes into that initially. But at the end of the day, I had everything working. I could access fileshares, printers, do RDP and all that other fun stuff. I spent a lot of time working out kinks and issues, but it was worth it. Ready to go on a non hybrid joined AutoPilot device. And then you go on vacation, you come back, and they attempted to switch it to hybrid, because they had forgotten one thing, our own software that we develop in house checks for the domain the computer is joined to in order to see if it is allowed to be run. And patching that out to something that could recognize if it is joined to our tenant will take probably a year. So, since we were implementing a new VPN solution that supported a PLAP,, we also had a workaround for that issue and after my vacation I cleaned up the mess that others had made and reluctantly accepted that we were still doing hybrid with the promise of going non-hybrid in 2025. But as I said, try non hybrid first, and only when you hit a roadblock where you have an external dependency on being domain joined, consider if going hybrid is the right solution. You'd be surprised how far you would get. I would like to add that while we have moved to hybrid, all the mgmt for AutoPilot enrolled devices is done through Intune. We are no longer applying GPOs for example, so going from hybrid to non-hybrid when we finally get the green light on that last dependency should be a simple matter of updating our Intune settings.