New device prep
-
Personal:
- Remove bloatware
- Install applications (usually stored on a Portable Hard Drive) and update as required. (Incl. Windows Updates)
- Run Windows 10 Powershell to remove unwanted applications and change registry for tracking etc.
- Update Drivers / Firmware
- Install device-specific applications (depending on the role of the device)
Business:
- Install from image.
- Run powershell to ready the device to our pre-approved stage.
- Install Office, antivirus and business applications that are not dished by GPO.
- Disable power settings on the network adapters
- Update as far as possible.
- Add device to domain and run GPO.
- Configure for end user (department-specific).
- Full disk encrypt the device if portable or in specific departments.
- Run Windows updates.
- Test all applications.
- Peer-review device, and prep additional equipment (keyboard / mouse / bag / etc)
- Arrange installation.
-
Personal:
- Remove windows, replace with the latest Ubuntu (usually LTS, but not always)
- Install the apps I need/want
- Install Steam Proton (notably the GE version)
Business:
- Ship laptop to employee
- When it's a new employee, email their personal account with their new company email and password 24 hours before start date.
- Employee signs in with work account
- Intune/Autopilot take care of installing core apps, running PowerShell scripts to remove bloatware, and apply policies.
- Use FleetDM 24 hours after deployment to make sure that all the policies are being met (notably full disk encryption)
Working for a small company, and using Intune makes deploying laptops stupid easy, and so far we haven't had any issues despite technically being in a hybrid environment (a lot of our VMs are still on-prem domain joined)
-
tankerkiller125 said in New device prep:
Intune/Autopilot take care of installing core apps, running PowerShell scripts to remove bloatware, and apply policies.
Use FleetDM 24 hours after deployment to make sure that all the policies are being met (notably full disk encryption)Curious - Why are you using FleetDM and not an Intune Compliance policy?
If you wanted, you could then leverage a conditional access policy to lock out the device UNTIL it was compliant with the disk encryption, AV, etc? -
-
tankerkiller125 said in New device prep:
katos We do use FleetDM because I can run realtime queries, we do have a compliance policy in intune as well, but we find that it's very slow to update if something changes.
Ahh that's very fair, InTune can indeed be slow to do things - one of the things that annoys me about it!
