Windows Autopilot image security

Question

Are we being unnecessarily cautious if we decide to re-image and enroll devices onprem before running autopilot setup? Or will we be just as secure by setting up directly on oem imaged devices? Or in a hypothetical scenario on a malware infested device?

Asked in another way: Do autopilot verify that the image it installs on is 100% clean and secure before it deploys any company resources? Will it remove all non windows original iso software?

Answer 1

Hello there,

When initially deploying new Windows devices, Windows Autopilot uses the OEM-optimized version of the Windows client. Instead of re-imaging the device, your existing Windows installation can be transformed into a "business-ready" state so my guess is it is not a new image.

You can check the build date of the image to check whether it is a custom build image (which in case you tampered with it) or an original OEM image.

As far as I know, you can also use Windows Autopilot to reset, repurpose, and recover devices.
When you create a provisioning package from Windows Deployment Toolkit, there is a handy option to "remove pre-installed apps".

Overview of Windows Autopilot https://learn.microsoft.com/en-us/mem/autopilot/windows-autopilot

Identify a custom image https://techcommunity.microsoft.com/t5/windows-deployment/identify-a-custom-image/m-p/302823

----------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept it as an answer–