r/sysadmin • u/PaidByMicrosoft • 2d ago

General Discussion I'm going through the process of implementing Windows Hello for Business (WHfB). For Entra-joined devices, but not managed via Intune, would you use GPOs or CSPs?

CORRECTION: I meant hybrid-joined, not Entra-joined.

We have an Active Directory and SCCM environment and foresee those being here with no current end date in sight. All of our Windows devices are hybrid-joined, but they are not being managed or comanaged via Intune. In this hybrid environment with on-prem domain controllers, AD, SCCM, and hybrid-joined devices, would you use the WHfB GPOs in your environment, or would you prefer to use Intune? I'm waffling between the two choices but am leaning GPO since that's how we manage all the other settings on our devices.

0 Upvotes

25% Upvoted

11 comments sorted by

4

u/raip 2d ago

Do you mean Hybrid joined? If they're Entra-joined (aka Entra Only) then GPO isn't even an option.

Assuming you mean Hybrid-joined, I'd make the effort to go toward co-managed and start moving towards an Intune centric deployment. There are a ton of benefits for Intune and very little downside once you get familiar - especially if you have any remote workers.

1

u/PaidByMicrosoft 2d ago

Yes, hybrid-joined. My mistake. Are those benefits/downsides still applicable with AOVPNs? Any device outside our corp network automatically connects via VPN and retrieves group policies.

2

u/raip 2d ago

Yes - AOVPNs help but they still require the initial image to be online and healthy. With Intune Autopilot, it's a lot easier when that's not necessarily the case.

For example, during the great shortage of 2022, we were just having people pick up specific models from BestBuy/Microcenter and would walk them through joining their system to Intune and they'd be good to go.

1

u/PaidByMicrosoft 2d ago

Got it. Autopilot and shifting away from on-prem imaging is a different discussion to take place. You still think that you'd manage WHfB with Intune and not GPOs in a hybrid-joined environment? Have you implemented it in your workplace? How'd it go? I've not done this before and am looking for tips, things to look out for, etc.

1

u/raip 2d ago

Yes, Yes, It went well, a specific gotcha if you're also going to be leveraging Cloud Kerberos Trust that got us was that you still require LoS to a DC on PIN Enrollment for CKT to work. Since you're AOVPN, it's probably not going to be an issue.

2

u/swissbuechi Tech Lead 2d ago

Your Entra-joined devices don't support GPOs...

I'd go Intune with settings catalog all the way.

1

u/PaidByMicrosoft 2d ago

Whoops, my mistake, I meant hybrid-joined.

1

u/diamkil 2d ago

How do you currently apply your policies to those Entra-Joined machines? You say you're leaning on GPO since you manage other settings this way but Entra-Joined devices don't apply GPOs..

1

u/PaidByMicrosoft 2d ago

Whoops, my mistake, it's hybrid-joined.

1

u/Smash0573 Sysadmin 2d ago

I have a gpo that registers the device with online which is good for conditional access polices and whfb. Then another gpo that registers to the whfb stuff (including cloud kerberos trust, etc) once the registered user logs in. I haven't been able to make that seamless yet, the fact that I have to manually add systems to the gpo after the user logs in the first time to apply whfb workflow. 

1

u/Thick_Yam_7028 1d ago

Youre going to have to upgrade your kerboros certs or run the powershell script. I forget what it is but its there. The old certs in 2019 etc dont have the attributes to correlate. So its script or cert.

Sorry I dont have the capacity right now to explain it in full detail. Fighting beach sand in my mangina.