Thoughts about Intune enrollment on Workgroup PCs

Question

Thoughts about Intune enrollment on Workgroup PCs

Mike Gorski 1

Hello,

I am wondering if anyone has any thoughts about how to go about automatically enrolling workgroup laptops in Intune and Azure AD. The laptops in question are imaged using SCCM and not joined to AD. Also the PCs are severely locked down, meaning the end users that get these PCs have very little rights to do anything on them other than launch apps via desktop shortcuts that are provided. These laptops are given out to users for some temporary work. After the work is complete, they are returned, wiped and reimaged, and redeployed at later time. Ultimately I would like to find a way to somehow automate the enrollment (or make it as simple as possible) prior to the users receiving them but have not found a good way to do it. To further complicate this, I'd like to get away from workgroups and find a way to have the laptops join Azure AD (AAD) to allow the end users to log in with their AD credentials. The end users are remote so this would allow them to log into the laptops with out us having to know their domain password or reset it so we can cache their creds ahead of time. With this in mind, joining to on-prem AD will not work.

I have researched all of the enrollment methods and while some can work, almost all will require some manual intervention to get them to complete. I thought Autopilot could be the best method to accomplish what I want to do but the problem is I cannot find a way to automate the process of getting the devices registered with the Autopilot service during imaging. Yes I can manually run the powershell script to retrieve the hardware hash for Autopilot but there are several hundred laptops that need this. DEM accounts will not work as they register the PC with AAD and do not join. A provisioning package looked promising but there is a limit to how many devices each package can enroll and the token that is imported to the package is only valid for a max of 30 days.

If anyone has any thoughts, experiences, or success doing what I am trying to do, please share.

Thanks in advance.

1 answer

Your answer

Answer 1

Lu Dai-MSFT 28,501

@Mike Gorski Thanks for posting in our Q&A.

For this issue, I think Autopilot can work. If these devices are purchased in bulk, we suggest to contact the manufacturer to get these devices' csv files for Autopilot. Or we can try to deploy a PowerShell via SCCM to export the csv files of Autopilot, but we also need to collect these files from these devices.

Hope the above informtion will help.

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Mike Gorski 1 Reputation point

2021-01-22T15:46:24.977+00:00

Hi LuDaiMSFT thanks for the reply. The devices in question were purchased a few years ago so are you aware if a manufacturer can stil provide that? I was under the impression that the csv had to be requested at time of purchase.

I thought about deploying the script via SCCM but I do not know if those machines are already built and deployed to users or sitting in storage waiting to be used. It was because of this I thought if it were possible to capture the hash during the build phase and upload it, that would be a better option. Unfortunately that doesn't seem to be possible.

Thanks.
Lu Dai-MSFT 28,501 Reputation points

2021-01-25T02:16:02.09+00:00

@Mike Gorski Thanks for your reply.

For these devices that bought a few years age, we can try to contact the manufacturer. If they can provide it, that's the best. If they can't improve, we just get the csv file one by one.

From your description, I know that it seems that we have problem deploying the script via SCCM. Currently, there is no more good methods to met the requirement.

Thanks for understanding and have a nice day.

Share via

Thoughts about Intune enrollment on Workgroup PCs

1 answer

Your answer