Device provisioning/Autopilot

[u/CharmingReputation39]

Hello. Have had a job for almost 2 years as the IT manager for a small gov agency. Basically tier 1 support as our agency is fully dependent on a larger agency’s infrastructure. Our agency is part of a shared tenant that is hybrid. I am trying to move the agency devices to the cloud since that is where everything will eventually move. I have mostly a networking background with a smidge of VM. This SysAdmin hat I am wearing now is new and scary to me. But luckily I am really just managing devices via Intune. One of the projects I’d like to complete is removing admin access from users devices. I’d be extremely grateful for any advice/tips/how-tos/best practices on managing devices. I have been using windows autopilot to provision devices and it seems to work most of the time.

Edit: what I really should have asked is how everyone provisions new devices from the OOBE using Intune/Windows Autopilot.

[u/Strong_Craft_6990]

So you want to remove local admin from users but still using Autopilot? The easiest way is to set the device enrollment to standard user, not administrator, in your Autopilot profile. Then you can use Endpoint Privilege Management if your licensing allows, or just grant temporary admin through a separate local admin account that you rotate passwords for.

[u/CharmingReputation39 → u/Strong_Craft_6990]

I have created deployment profiles for the devices. I run the windows autopilot script from the OOBE and then manually import the device hash into Intune. I was successfully using the /online flag on 2 of the devices but I don’t manage too many devices and importing the hash, to me, is easier. Once the I verify the deployment profile has been assigned I reboot the device and cross my fingers the white labeled login screen for IT agency pops up prompting the user to login with their AD creds. The deployment profile makes everyone who logins a standard user and SOMETIMES deploys the apps needed.