"Streamlining Windows Autopilot Enrollment: A Step-by-Step Guide for Efficient Device Setup"

1. Prerequisite of Autopilot

One of the major pre-req for autopiloting is network. Make sure you have connectivity to

internet for Azure Active directory (AAD) machines and for Hybrid Azure Active

directory (HAAD) machines, we need to have connectivity to Bentley network as well as

the internet.  

2. Autopilot Profiles

We have configured two profiles for Autopiloting and are explained below:

2.1       Azure Active Directory (AAD):

Under this Autopilot profile, the Machine is connected only to Azure Active

Directory (AAD) and not registered with on-premises Active Directory

servers. AAD-joined machines can access the Bentley network via Global

Protect, which is installed during the software deployment process under the

Autopilot procedure. We have a system in place to issue computer

certificates for AAD-joined machines. The naming convention for AAD-

joined machines will be in the format of "AAD%RAND:5%". Therefore, the

name of every AAD-joined machine will start with the AAD prefix followed

by a randomly assigned 5-digit number. Additionally, we can also use the

serial number for naming AAD-joined machines.

2.2 Hybrid Azure Active Directory (HAAD):

With this Autopilot profile, the machine is connected to both Azure AD and On-Premises AD servers. To enroll a machine with Hybrid AD join, the Autopilot process needs to be initiated from the Flatirons Network. Machines joined through HAAD will be named following the format "HAAD" + a few random numbers/alphabets. While we have limited control over the naming convention for HAAD, once a machine is joined to AAD or HAAD, the machine name can be easily changed from the Azure portal without

requiring end user assistance.

3        Windows Enrollment

3.1       Extracting Machine Details

Turn on the new machine. If they are enrolled in Windows Autopilot, you will be directed to a company login page after choosing the Region and keyboard layout as depicted below.

If it’s not registered with Company portal in Autopilot, you would get the below screen.

If this is the case, we need to extract machine details. In order to do so, Press “Shift” + “F10” at one time. It will open a command prompt as shown below.

Run the following commands under powershell.

1.  Set-ExecutionPolicy Unrestricted

2.  Install-Script -Name Get-WindowsAutoPilotInfo

3.  Get-WindowsAutoPilotInfo.ps1 -OutputFile c:\AutoPilotHWID.csv

By executing this command, an autopilothwid.csv file will be generated on the C Drive. The file will include the specified fields along with their corresponding values.

1.  Device Serial Number

2.  Windows Product ID

3.  Hardware Hash

In order to enable either Azure AD join or Hybrid AD join for the machine, we must include the Group Tag field in the file extracted from the PowerShell command. The Group Tag field should have a value of either "Azure" or "Hybrid". You can find a sample file attached below. After adding the Group Tag with the appropriate value, save the file and upload it to Intune.

3.1 Upload CSV file to Intune

Go to Intune > Device Enrollment > Windows Enrollment > Devices in the Intune Portal. Click on the "Import" button at the top of the page and choose the CSV file with the device information.

By pre-provisioning the workstation in Intune and Azure AD with the Device Serial Number and assigning an Autopilot Profile based on the Group Tag, the machine will be prepared for autopiloting. After uploading the machine details to Intune, it will be ready for autopiloting within approximately 15 to 30 minutes.

4. Provision with Autopilot – Azure AD Join

After importing the Device into Intune and restarting it, your language, keyboard layout, and additional keyboard layout will be automatically chosen in the backend. Subsequently, you will encounter a Company Login page:

Enter your email address and then your password.

The workstation provisioning process will be initiated by the Autopilot.

The entire autopiloting process typically takes between 45 minutes to 1 hour to complete, depending on your internet speed.

5. Provision with Autopilot – Hybrid AD Join

After importing the Device into Intune and powering it on again, your language, keyboard layout, and additional keyboard layout will be automatically chosen in the backend. Subsequently, you will encounter a Flatirons Login page:

Please input your email address followed by your password.

The workstation provisioning process will be initiated by Autopilot.

The entire autopiloting process typically takes between 45 minutes to 1 hour to complete, depending on your internet speed.

6. Reconfiguring Machine through Autopilot  

If a device has already been included in the Company's Autopilot profile and we need to reset it to ensure a clean system, we can proceed with the following steps.

To initiate the process, access the start menu and enter "RESET" in the search bar. This action will prompt the "Reset This PC" option to appear, as illustrated below.

By clicking on the reset button, you will be taken to the page below.

Click on the "GET STARTED" button to reveal two options.

Based on the requirement, one can choose the appropriate option. I will execute the task using the "Remove everything" setting. After selecting the option, the following confirmation will be displayed.

By clicking on RESET, the machine will be completely reconfigured. This process typically lasts for 45 minutes.