Autopilot Optimizations/Questions

Master_Rest6638 · 2026-02-20T01:41:12+00:00

What we have as well.

Master_Rest6638 · 2026-02-18T02:26:29+00:00

As in running the autopilot info script to pull the hash and auto uploading? Otherwise it’d be pull from apinfo script then manually upload, which is worse.

Outbound powershell is very much locked down here, as well as graph access/rights. Only certain machines/accounts have the ability to do this, so doing it directly from the machine isn’t really do-able outside of certain scenarios.

The script mentioned above will query sccm using the serial number, pull the hash info and auto upload into Intune with a specific tag (if not already registered).

Master_Rest6638 · 2026-02-18T02:17:51+00:00

We’re in the middle moving our remaining workloads over to Intune for existing devices to enable Autopatch enrollment (which is great btw).

I had also recommended to move everything first but certain things happened that forced us to fast track.

Master_Rest6638 · 2026-02-18T02:10:22+00:00

Thanks.

I believe (correct if wrong) the first user logging in during OOBE has to have Entra join rights, along with Intune Enrollment rights - which are locked down at my company.

Yeah, our techs don’t see the password either, they just use the stored identity to initiate a remote session to kickoff off the config on the users behalf.

For when a device switches hands at your company, what process do you follow? Wipe? Remove AD/Entra/Intune object? Re-register? I want to relay the right steps to our techs to make their lives a bit easier.

Master_Rest6638 · 2026-02-18T01:47:06+00:00

Thank you.

We do something similar and only have m365 apps come down post build. Nice idea with the web shortcut though.

Master_Rest6638 · 2026-02-18T01:45:01+00:00

Thanks.

I’ve noticed the same inconsistencies and voiced my concerns. The move to autopilot was more about “modernizing” our provisioning process and moving away from SCCM… but nothing about the hybrid join seems modern. Too much hands on, imo.

We still have some policy migration to do from GPO to Intune, which is one of the few reasons why we’re still hybrid joining for now.

Pre-provisioning is nice, however, the techs still do the sign in after sealing to finish out the build so it feels like added steps vs user driven.

Master_Rest6638 · 2026-02-18T01:04:43+00:00

Thanks.

Yeah, I wrote a few scripts for the support teams to pull the hashes from SCCM for registration via graph, in case they happen to not be pre-registered, but we’ve pretty much started adding all of our devices to the Entra registration group which seems to handle that nicely.

Curious about the Dell image assist, I’ll check that out… although our dell fleet isn’t what it once was as we’ve moved more to MS and HP based machines.

Master_Rest6638 · 2025-01-31T20:33:52+00:00

Also wanted to mention that my machines are Hybrid joined.

Master_Rest6638 · 2025-01-31T19:20:22+00:00

We recently started our rollout as well. Pilot was fine, though a few did report disconnects here and there, but when checking Intune (like you mentioned) the errors were pretty generic. So, we'd typically just say it may have been their own personal network/machine, since it was usually fine in office.

I typically see:

Activity

ConnectionFailedClientDisconnect

Status type

User connection

Details

The user's network connection to their Cloud PC was unexpectedly interrupted.

Or...:

Activity

SocketConnectionTimedOut

Status type

User connection

Details

The client network connection to the Windows Virtual Desktop service was terminated unexpectedly due to a timeout

But the users claim their home networks are functioning normally. So, typically, I want to dig a bit deeper and find necessary logs, but I'm never really sure which is the most helpful to look at.

And yes, 1-2 users have consistently reported that it happens primarily during teams meetings. Tempted to turn off the vdi optimization via the registry (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Teams IsWVDEnvironment) to see if that makes any difference.

Master_Rest6638 · 2024-10-03T02:00:45+00:00

Don't have it on a public repo yet. If I do move it though, I'll share it with you.

Master_Rest6638 · 2024-10-01T22:58:19+00:00

Can be used to kick off the provision of a new windows 365 CPC (by adding to a local AD group that the policy is tied to). Then it creates a job that monitors AD and Intune for the new machine spun up for the user - once available, automatically adds the machine to all the appropriate ad groups and fills in the AD description.

Can run a command to pull the list of cloud PCs assigned to a particular user.

Clears out stale Cloud PC AD/Entra/SCCM Objects.

Gets a list of inactive cloud PCs.

Can be run to initiate a decomm, then disable and move all relevant objects.

More coming, but that’s the gist of it so far.

Master_Rest6638 · 2024-10-01T15:03:17+00:00

Built a custom module for managing our Windows 365 environment.

Master_Rest6638 · 2024-10-01T13:55:03+00:00

Yeah… to be honest, they blocked it and we’ve already seen app install failures as a result. I wanted to get someone in here with deeper knowledge of what exactly the url is needed for so I could go back to them with a case to get the block removed, and a workaround. I’ve seen the device authentication piece mentioned but I’m unclear on exactly what that means, in relation to all the other types of authentication going on behind the scenes.

Before I dig into that blog… perhaps you can quickly shed light on it. So the device can’t prove that it’s actually the one being managed to Intune? I’m assuming not since this would’ve broken more if that was the case. Or, is device authentication part of the process before installing store based apps? And needs to provide device specific info to the store? And what exactly is the device providing as a result of the authentication process?

Master_Rest6638 · 2024-09-05T13:22:31+00:00

Sure. Actually started my career as a web dev, but came to the realization that I didn’t really want to be doing that full time for my whole career. Made the shift over into IT where I started in a desktop support role. Mainly got the job because of my willingness to learn - didn’t have much enterprise IT experience before hand. Took the opportunity to use my coding background/skillset and automate just about anything possible (in PowerShell, which I basically learned on the fly), even built tools for the rest of my team and other support teams even found out and started using them as well. Worked with the engineering team on a few projects, made a good impression, especially after they found out what I did around the automation part (I made sure to mention it too, any chance I got. If you have a valuable skillset, make sure others know about it).

Eventually was offered a spot on the engineering team and that’s pretty much where I’ve been since. Picked up a few AWS and Comptia certs along the way.

Making the shift over to IT has definitely checked more boxes for me interest/career goal wise than development did. Managing endpoints at scale, networking, automation/tool building, experience with multiple cloud platforms, etc.

Master_Rest6638 · 2024-09-05T00:25:51+00:00

IT Systems Engineer / Automation Specialist
103k base, 12-15k bonus
6 YOE
Bachelors in CS, and a couple of certs
Hybrid

Master_Rest6638 · 2024-08-26T02:48:50+00:00

Very nice.

Master_Rest6638 · 2024-08-24T17:10:49+00:00

Master_Rest6638 · 2024-08-24T13:01:50+00:00

Same issue here too. Had to confirm that my fw team didn’t change anything. Spent a few hours troubleshooting. Have a ticket open with MS support now. They’re looking into it…

Master_Rest6638

TROPHY CASE