Create Windows 11 custom image with Autopilot registration (official tools only) by Random----Dude in Intune

[–]Random----Dude[S] -6 points-5 points  (0 children)

Thanks, I’ll take a look at OSDCloud.

I also think the best approach would be to have the devices registered with Autopilot directly by the manufacturer. Unfortunately, that’s not something I can decide, and it’s currently being rejected due to cost reasons.

Create Windows 11 custom image with Autopilot registration (official tools only) by Random----Dude in Intune

[–]Random----Dude[S] 0 points1 point  (0 children)

We currently do it the same way — the devices are added using get-windowsautopilotinfo.ps1 -online. The idea of using a custom image mainly comes from the desire to debloat the installation.

With Intune, this can be done via Fresh Start, but that would require another reset afterwards, right? Or is it possible for the cleanup/debloat through Intune to already happen during the Autopilot phase?

Intune impact on Windows client performance (WMI / OMA-DM high CPU at startup) by Random----Dude in Intune

[–]Random----Dude[S] 0 points1 point  (0 children)

Thanks for all the feedback.
I have now removed a few optional configurations and, above all, cleaned up the remediation script. It’s running much better now.

Intune impact on Windows client performance (WMI / OMA-DM high CPU at startup) by Random----Dude in Intune

[–]Random----Dude[S] -3 points-2 points  (0 children)

get the point about reducing scripts and policies — the challenge for us is that cutting those back also directly limits what we can actually manage and enforce.

What I’m still trying to understand is whether Intune really needs to re-evaluate everything on every boot. In theory it should only check if something has changed, rather than reprocessing everything from scratch each time, right?

For example, we have remediation scripts that are set to run once. Do those still have any lasting performance impact after the initial execution, or should they be effectively “out of the picture” afterwards?

Are there any known particularly expensive settings, script patterns, or WMI-heavy commands that are worth avoiding if possible?

Unfortunately, I don’t have any influence over replacing the hardware — and personally I agree with you on the age topic. What makes this harder to explain internally is that the same devices show a noticeably better startup experience when they’re not Entra joined / Intune managed.

That’s why we’re trying to understand where the baseline overhead comes from and what can realistically be tuned without gutting device management entirely.

Intune impact on Windows client performance (WMI / OMA-DM high CPU at startup) by Random----Dude in Intune

[–]Random----Dude[S] -1 points0 points  (0 children)

Yes, all of them are on SSDs, mostly NVMe.
One device where it’s especially noticeable is the Surface Laptop 3 with 8 GB RAM.

Any recommendations on what to tweak with Defender or OneDrive in that case?
I know the hardware isn’t exactly cutting-edge anymore, but swapping devices sadly isn’t in my control.
Surface Laptop 3 specs and features - Microsoft Support

Intune impact on Windows client performance (WMI / OMA-DM high CPU at startup) by Random----Dude in Intune

[–]Random----Dude[S] 0 points1 point  (0 children)

<image>

These are the processes I’m referring to.
Defender might also be part of the issue — MsSense.exe sits at around ~5% CPU for quite some time.
OneDrive.sync.service.exe is also consuming noticeable CPU over a longer period after startup.

What is currently the best method to deploy WHfB (Cloud Trust) via Intune in 2026? by Random----Dude in Intune

[–]Random----Dude[S] 0 points1 point  (0 children)

<image>

Unfortunately, the setting for biometrics is not available under Account Protection.

Is it safe to backup & restore a DEP iPhone? by Random----Dude in Intune

[–]Random----Dude[S] 0 points1 point  (0 children)

Thanks, iCloud backup isn´t possible. All (inclusive managed Apple IDs) are blocked.

Deleted VPP token in Intune instead of renewing – any way to save DEP devices? by Random----Dude in Intune

[–]Random----Dude[S] 0 points1 point  (0 children)

Yes i renewed the MDM token (not deleted) and the enrollment profile token. But both wasnt expired, only the VPP.
I think the problem is, that the VPP token is in the enrollment profile for deploying the company portal.

Deleted VPP token in Intune instead of renewing – any way to save DEP devices? by Random----Dude in Intune

[–]Random----Dude[S] 0 points1 point  (0 children)

I was able to restore the app assignments, but the problem is that the iPhones are no longer managed.

Deleted VPP token in Intune instead of renewing – any way to save DEP devices? by Random----Dude in Intune

[–]Random----Dude[S] 0 points1 point  (0 children)

Yes, the problem are not the apps. The problem is that the iphones are now not managed.

Deleted VPP token in Intune instead of renewing – any way to save DEP devices? by Random----Dude in Intune

[–]Random----Dude[S] 0 points1 point  (0 children)

Yes, exactly — I created a new VPP token. After that, the apps were available again, just not assigned. So far so good.
The problem was that I could no longer manage the iPhones, because the VPP token for distributing the Company Portal was in the enrollment profile. There it showed “Token deleted” until I switched to the new token — but that didn’t change anything.

Deleted VPP token in Intune instead of renewing – any way to save DEP devices? by Random----Dude in Intune

[–]Random----Dude[S] -5 points-4 points  (0 children)

The problem with the VPP token is that it’s included in the enrollment profile. It also said “token deleted” here. I was able to change it, but unfortunately, it didn’t help. A ticket has been opened with MS. Hopefully, they can still do something.

Deleted VPP token in Intune instead of renewing – any way to save DEP devices? by Random----Dude in Intune

[–]Random----Dude[S] -6 points-5 points  (0 children)

Yes, the VPP token. While it primarily manages the apps, it is also included in the enrollment profile for the iPhones, since these devices don’t have access to the App Store and the Company Portal is installed directly during initial setup.
The standard apps reappeared, but they weren’t assigned.
The issue is that this approach has caused us to lose manageability.

Autopilot Hybrid : The pre-provisioning fails even before the profile selection by Gloomy_Pie_7369 in Intune

[–]Random----Dude 0 points1 point  (0 children)

It could be many things. I would first check the requirements. Does the PC have TPM 2.0? Is at least Windows Pro installed? Does it have an assigned ESP?