Jun 21 2022 03:38 PM
Jun 21 2022 03:38 PM
I'm looking for a way to wipe and re-configure my Win10/11 endpoints without losing remote access afterward. My endpoints are all AAD-joined and Intune (MEM)-managed with remote access through ConnectWise Control. Yet for all that, I'm unable to complete a device wipe and reconfigure remotely. When I wipe, I choose the "keep enrollment state and associated user acct" option, but the device is incommunicado until someone does something on the box itself. This "someone" is usually me and "something" usually involves driving an hour into the office to do the something. I feel like truly remote mgmt should be possible, but I can't seem to get there. I've tried deploying the agent through Intune, deploying a PS script through Intune, etc., but Intune won't work until someone actually logs into the refreshed device for the first time. Advice?
PS: We are a cloud-only shop. There is no server in the office.
Jun 22 2022 07:05 PM
Jun 23 2022 09:50 AM - edited Jun 23 2022 09:50 AM
So the Enrollment Status Page looks like this and yes, it's set up to allow the user to bypass it and go to the desktop.
My frustration is the loss of remote access during the process. If I do a format and clean install, the computer will start at the Out-Of-Box-Experience, then proceed to the Enrollment Status Page after the user first signs in. So remote access is lost until someone either sits down at the machine and installs my remote agent, or sits down at the machine and logs in to get the Intune deployments going. Either way, someone needs to sit down at the machine.
If I initiate a device wipe from Intune, the computer will start with a default Windows sign in screen, and again, proceed to the desktop after the user first signs in. And again, my remote access is lost until someone sits down at the machine to re-install my remote access agent, or sits down at the machine to log in and get the Intune deployments started. Again, someone has to sit down at the machine either way, which is the step I'm trying to eliminate.
Surely there is a way around this. ?
Jun 24 2022 07:54 PM
Jun 26 2022 01:00 AM - edited Jun 26 2022 01:01 AM
I think this does not 100% solve you issue but you can use quick assist bevor the real enrolment start. The only issue here is that someone has to enter the connection code. But as soon as this is done you can do the enrolment remote.
Jun 27 2022 08:17 AM
Jun 27 2022 12:15 PM
Jun 28 2022 02:04 AM
Jun 28 2022 10:00 AM
Jun 29 2022 07:18 AM
Jul 14 2022 01:05 AMSolution
I think we all were (incorrectly) assuming you were using Autopilot. At least I was .
The ESP will only start through OOBE with AAD-join or during the Autopilot process (see Set up the Enrollment Status Page in the admin center - Microsoft Intune | Microsoft Docs). That probably explains why you need to sign in before anything happens. With Autopilot, the device configuration is applied before the first sign-in.
Jul 18 2022 08:58 AM