Forum Discussion
Intune + OOBE without local Admin permission on Device
Hi, I have a question about the enrollment method because something is unclear. Now I try to describe it. In Intune, I created a new profile under Windows Enrollment > Windows Autopilot Deployme...
Hi... are you 10000% sure the device went through the autopilot enrollment? seeying the esp is something else than the autopilot enrollment (even when its a part of it) 99,9% of the time when a device ends up with being a local admin or the old device name, the device didn't went through the autopilot enrollment
Besides the autopilot standard user setting you could also deploy some additional configuration to make sure the user isnt becoming a local admin
Manage your local administrator with Intune / MDM (call4cloud.nl)
- Thank you for your reply. No, I'm just not sure.
I reset Windows 10 from the OS via Settings.
Does the device for Autopilot have to be registered under "Windows Autopilot Deployment Program" > "Devices"?
If I reset the device in the OS and then log in to the OOBE (without autopilot) with the business E-Mail address, is this a "normal" AD join and the device is then enrolled to Intune (if I have that activated)?- Hi.. yes the device needs to be shown in Intune in that section... if not... the device iits hash isnt uploaded or registered in your tenant.
If you don't use Autopilot , the device would prompt you for your email address (depends on win 10 or 11) and after entering your credentials the device will be azure ad joined and intune intune enrolled if you have the proper license and not blocking personal devices to be enrolled
So if you want to be sure that only autopilot devices can be enrolled into azure and configure intune restrictions to block personal devices- Hi
Thanks for the information. I think I understand it better now.
Autopilot requires device registration in Intune in any case.
The other method (Reset or Reinstall) is an Azure AD Join and is enabled via normal enrollment.
My biggest concern is the thing with the admins on the devices. With autopilot (with device registration in Intune) the switch should work which I mentioned in the start post.
Do you have a note just now on what is recommended with devices that are added via Azure AD and come to Intune? Or is that the clues from your link you posted above?
