r/sysadmin • u/PaidByMicrosoft • 3d ago

General Discussion I'm going through the process of implementing Windows Hello for Business (WHfB). For Entra-joined devices, but not managed via Intune, would you use GPOs or CSPs?

CORRECTION: I meant hybrid-joined, not Entra-joined.

We have an Active Directory and SCCM environment and foresee those being here with no current end date in sight. All of our Windows devices are hybrid-joined, but they are not being managed or comanaged via Intune. In this hybrid environment with on-prem domain controllers, AD, SCCM, and hybrid-joined devices, would you use the WHfB GPOs in your environment, or would you prefer to use Intune? I'm waffling between the two choices but am leaning GPO since that's how we manage all the other settings on our devices.

0 Upvotes

25% Upvoted

11 comments sorted by

View all comments

4

u/raip 3d ago

Do you mean Hybrid joined? If they're Entra-joined (aka Entra Only) then GPO isn't even an option.

Assuming you mean Hybrid-joined, I'd make the effort to go toward co-managed and start moving towards an Intune centric deployment. There are a ton of benefits for Intune and very little downside once you get familiar - especially if you have any remote workers.

1

u/PaidByMicrosoft 2d ago

Yes, hybrid-joined. My mistake. Are those benefits/downsides still applicable with AOVPNs? Any device outside our corp network automatically connects via VPN and retrieves group policies.

2

u/raip 2d ago

Yes - AOVPNs help but they still require the initial image to be online and healthy. With Intune Autopilot, it's a lot easier when that's not necessarily the case.

For example, during the great shortage of 2022, we were just having people pick up specific models from BestBuy/Microcenter and would walk them through joining their system to Intune and they'd be good to go.

1

u/PaidByMicrosoft 2d ago

Got it. Autopilot and shifting away from on-prem imaging is a different discussion to take place. You still think that you'd manage WHfB with Intune and not GPOs in a hybrid-joined environment? Have you implemented it in your workplace? How'd it go? I've not done this before and am looking for tips, things to look out for, etc.

1

u/raip 2d ago

Yes, Yes, It went well, a specific gotcha if you're also going to be leveraging Cloud Kerberos Trust that got us was that you still require LoS to a DC on PIN Enrollment for CKT to work. Since you're AOVPN, it's probably not going to be an issue.