This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 67%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EH%3C/text%3E%3C/svg%3E)
Which ways would be possible to get an existing device with Windows 10 1809 LTSC (Member of an Active Directory) managed via intune - and how can the user then log in with their azure ad credentials?
I already figured out that executing a provisioning package isnt a solution: I always get the error "0x8007000D". Found out it has sth to do with the LTSC-Version which isnt able to execute those Provisioning Packages.
In my opinion the only way is to "Enroll only in device management" (screenshot). But in order to do that I have to type in the Administrator Account of the AD-Domain. The AD Domain will be turned off in the future, so we dont want to do hybrid join, and no enrollment via GPO.
The next question I have is: When enrolling that device with "Enroll only in device management" my device has a connection to AD and MDM. Is that a problem? Should I delete the connection to the on premise world first?
Last Question: What do I need to do in order to enable a user then to log in with their azure credentials?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 66%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENH%3C/text%3E%3C/svg%3E)
A device can't be joined to both on-prem AD and Azure AD. It would need to be unjoined from the on-prem domain first, then joined to Azure AD (make sure there is a local user admin account and be careful of data loss for profiles etc) "Enroll only in device management" will enrol the device Intune (and register it in Azure AD but not join Azure AD)
Thanks For your support and for your Information
I deleted that devices membership to the domain and after a restart the device now is Resetting like in the screenshot.
/reset-this-pc-removal-process-windows-10-56a6fadc3df78cf772913fda.png)
Is it because the device is in a group in Azure AD that has an autopilot profile assigned? Or could that be a Policy that comes from the Active Directory, that tells leaving devices to reset?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 30%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
@Halogeen , Could you confirm if the action "delete the device membership" means dis-join the device from on premise AD. For the reset, maybe this can be related with provision package. Could you dis-join another on-premise domain joined computer and see if it is working as expected.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 50%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EP%3C/text%3E%3C/svg%3E)
1) Use script to collect hardware hash.
2) Add them into Autopilot.
3) Do a reset of the device, and go through Autopilot OOBE scenario.
Since you are moving away from AD, use Autopilot with Azure AD Join.
Usually i woud agree With you. Especially with those LTSC Versions which we really want To get rid of. With your solution we could easily reinstall That device With a win10 Enterprise and do autopilot. But the location is far away im Not Able To Support locally and there are only 5 devices. So if i do it like in the comment above from NickHogarth I would have To log in With a local User Account and would be only registered. Seems To be ok for now.
There is another location, they do have win10 pro and no AD. At That Department i Would try out joining With provisioning package do you agree With me ?
@Halogeen , From your description, it seems you want to migrate from on-premise AD to Azure AD. If there's any misunderstanding, feel free to let us know.
Based on my research, I find an article for the reference:
https://o365hq.com/services/on-premises-active-directory-to-azure-active-directory-transition
Note: Non-Microsoft link, just for the reference.
If you want to know more about the migration, please contact Azure AD support with tag "azure-active-directory":
https://learn.microsoft.com/en-us/answers/topics/azure-active-directory.html
For Intune enrollment, there are many methods, we can choose one in our environment:
https://learn.microsoft.com/en-us/mem/intune/enrollment/device-enrollment#windows-enrollment-methods
https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enrollment-methods
Hope it can help.
If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.