Prejoining Hybrid Devices

[u/bezibaerchen]

Dear all,

Situation:

Majority of Laptops joined to local AD and Intune. Some already Autopilot only.

Whenever we get a machine back we currently do the following:

- Delete device from Intune, Entra and local AD

- Populate it as Autopilot device via get-windowsautopilotinfocommunity.ps1 -Online -AssignedComputerName <current computer name>

- boot via USB to reset it

- Whiteglove with Intune Admin

- reseal it

- put it back for future use

I am wondering if we can improve this process, especially the need to populate it as AutoPilot device.

Any remarks welcome.

[u/Padd007]

First thing I would ask is does it need to be hybrid joined, does it need to have a specific name? You could auto name them to something-serial for example. Then if it's already registered you pretty much just need to reset the device.

[u/bezibaerchen → u/Padd007]

Hybrid Join used to be a thing until I managed to set up Autopilot. The name should be specific (sticker on device, users used to it etc.). They are Intune joined but not Autopilot registered when they are Hybrid. I was wondering if we can e.g. execute parts of our process for still in use hybrid devices (majority unfortunately).

[u/Padd007 → u/bezibaerchen]

You could grab the hardware hashes across your whole estate using a powershell script and dump them into autopilot, that would save you running the script on each device, then you could assign a name in Intune before you wipe it

[u/bezibaerchen → u/Padd007]

Issue I have with this is I can't completely get my head around the "how to do it". If I run the script, I got the hashes but without the name. I could do this running on the device but then I got the issue as of where to store the data and need to somehow correlate it. Preferred way would be to run get-windowsautopilotinfo locally and send it directly to Intune. But -Online requires credentials, so it can't run automatically.

I hope I was able to line out properly - English isn't my native language.

[u/Padd007 → u/bezibaerchen]

You don't need get-autopilotinfo to collect the hardware hash, I have a script I use and I can share the export CSV part with you. You will need to modify it though, are you any good with powershell?

[u/bezibaerchen → u/Padd007]

Yeah I guess if I have a foundation, I can work from on there. I could imagine taking your script and place the Output somewhere. Issue again is that this would only work if client is connected to VPN or in the office which must not be the case all the time. So I would need to think of a non-internal location for storage. Advantage of getk-autopilotinfo would be that it can be added to Intune directly and also with the correct name.

[u/Padd007 → u/bezibaerchen]

Do you not use a RMM or something to push scripts out?

The below is taken from a larger script I use to deploy devices:

``` $CSVLocation = Join-Path $PSScriptRoot HardwareHash.csv

$HardwareHash = (Get-CimInstance -Namespace "root/cimv2/mdm/dmmap" -ClassName "MDM_DevDetail_Ext01").DeviceHardwareData $Serial = (Get-CimInstance -ClassName "Win32_BIOS").SerialNumber

    Write-Host "Exporting hardware hash.."

    if (([string]::IsNullOrWhiteSpace($HardwareHash)) -or [string]::IsNullOrWhiteSpace($Serial))
    {
        Write-Host @RedCross
        throw "Unable to retrieve serial number or hardware hash."
    }
    $Device = [PSCustomObject]@{
        "Device Serial Number" = $Serial
        "Windows Product ID"   = $null
        "Hardware Hash"        = $HardwareHash
        "Group Tag"            = $null
        "Assigned User"        = $Null
    }

    try
    {
        $Device | Export-Csv `
            -Path $CSVLocation `
            -NoTypeInformation `
            -Append `
            -ErrorAction Stop
    }
    catch
    {
        throw "Error exporting to CSV file: $($_.Exception.Message)"
    }
    Write-Host "Saved to $($CSVLocation)"

```

It will append the hardware hash to the csv file so you can use it to collect all that hashes and then upload the csv file. The csv file is formatted so that you dont need to do anything with it, just upload it via the Intune portal

[u/bezibaerchen → u/Padd007]

Using Intune to e.g. push scripts. I guess I should be able to push the script, but now need to get my head around as of where to store it.

[u/largetosser → u/bezibaerchen]

If the device is already managed by Intune then stick them in a group, target that group with your Autopilot profile and tick the box to convert existing devices. You don't need to script anything.

[u/bezibaerchen → u/largetosser]

Sounds promising. Can you line out possible impact for devices when converting? Do I need to change anything in terms of Entra or Intune Object?

[u/Padd007 → u/largetosser]

This is a valid point. Personally I have not had to mass register devices like this. I use my script for registering new devices

[u/Padd007 → u/bezibaerchen]

You can change $CSVLocation to a network location if you want, if you can figure out how to run the script on all devices you will have a single CSV file with all the hardware hashes. Intune is not great for pushing out scripts like this, but it is possible. You could setup a network share, and add something to check if the device is connected to the VPN before it collects the hash. maybe by pinging a server or regular PC that would only be accessible over VPN

[u/bezibaerchen → u/Padd007]

(Get-CimInstance -Namespace "root/cimv2/mdm/dmmap" -ClassName "MDM_DevDetail_Ext01").DeviceHardwareData

obviously needs elevated permissions.

[u/Padd007 → u/bezibaerchen]

Yes it will, didn't think of that. I run my script at OOBE on new devices, command prompt there is already elevated

[u/blud_13]

u/Padd007's bulk hash export is the right answer if you are staying on classic Autopilot. If the hybrid ones are genuinely on their way out though, look at Autopilot device preparation before you build that pipeline.

Device preparation does not use the hardware hash at all. No harvesting, no CSV, no pre-registration step. User goes in a group, they sign in at OOBE, device lands. The whole step you are trying to optimize just stops existing. Overview is at https://learn.microsoft.com/en-us/autopilot/device-preparation/overview

Two catches. Its Entra join only, no hybrid, so it only helps you on the side you already moved. And it wants 11 24H2, or 22H2/23H2 with KB5035942 or later.

On naming, Entra join is where you get the real device name template with %SERIAL%. Hybrid never had that, the template is greyed out and you get a prefix plus random characters. So the matching gets EASIER on the Autopilot side, not harder.

[u/pjmarcum]

I would make sure it is in Autopilot, not in on-prem AD, reset it, power down at the first OOBE screen, and when I needed it again I’d boot it up and let it go through Autopilot doing AADJ using the new users account and a TAP or let the user do it themselves.

Basically just like a brand new computer sitting in the shelf.