How to deploy hybrid Azure AD-joined devices by using Intune and Windows Autopilot

When deploying new Windows devices, Windows Autopilot leverages the OEM-optimized version of Windows 10 that is preinstalled on the device, saving organizations the effort of having to maintain custom images and drivers for every model of device being used.

Instead of re-imaging the device, your existing Windows 10 installation can be converted into a “ready” state, applying settings and policies and installing apps.
After deployment, Windows 10 devices can be managed by Microsoft Intune.
This is a perfect tool for small and medium-sized business which do not have SCCM or MDT to automate the deployment of computers in their organization.

Windows Autopilot and InTune enables you to:

• Automatically join devices to Azure Active Directory (Azure AD) and Active Directory (via Hybrid Azure AD Join) at the same time.
• Auto-enroll devices into Microsoft Intune.
• Install all company applications from Intune Portal.
• Silently encrypt the local drive with BitLocker and store recovery key in Azure AD.
• Enroll Device in Windows Update for Business and keep all Windows 10 workstation updated.
• Apply some of Groups Settings from Intune instead from Local AD

Software and OS requirements

• Windows 10 v1809 or greater.
• The following editions are supported:
• Windows 10 Pro
• Windows 10 Pro Education
• Windows 10 Pro for Workstations
• Windows 10 Enterprise
• Windows 10 Education
• Windows 10 Enterprise 2019 LTSC

Licensing requirements

One of the following is required:

• Microsoft 365 Business subscriptions
• Microsoft 365 F1 subscriptions
• Microsoft 365 Academic A1, A3, or A5 subscriptions
• Microsoft 365 Enterprise E3 or E5 subscriptions, which include all Windows 10, Office 365, and EM+S features (Azure AD and Intune).
• Enterprise Mobility + Security E3 or E5 subscriptions, which include all needed Azure AD and Intune features.
• Intune for Education subscriptions, which include all needed Azure AD and Intune features.
• Azure Active Directory Premium P1 or P2 and Microsoft Intune subscriptions (or an alternative MDM service).

Local AD Requirement
AD Connect (the most recent version)
Windows Server 2016 to install Intune Connector

An overview of deployment steps

1. Create new OU and new GPO to configure SCP entry in the registry of your devices.
2. Configure Delegation to new OU for computer object which is going to have Azure Intune Connector
3. Reconfigure AD Connect to include new OU in syncing scope
4. Install Intune Connector on windows 201q6 server hosted on-premises.
5. Configure a couple Groups in Azure AD
6. Configure Device Settings to allow users to join devices to Azure AD
7. Configure automatic MDM enrollment
8. Create and assign an Autopilot deployment profile
9. Create and assign a Domain Join profile
10. Load Hardware Hashes from workstation to Azure AD
11. Boot up workstation to start deployment.

Let’s review the steps that this goes through:

1. The workstation boots up and connects to the network.
2. Autopilot profile is downloaded to workstation.
3. Workstation is asking  for Azure AD credentials , which are used to enroll the device in Intune. The workstation does not join Azure AD.
4. The device enrolls in Intune, using the “Domain Join” device configuration profile settings, the device will request an Offline Domain Join blob from Intune. Intune passes this request to the Offline Domain Join connector service and gets back the blob. That blob is passed back to the client PC.
   The client PC applies the Offline Join Blob blob and then restarts  to complete the Active Directory join process.
5. The workstation won’t reboot if it can’t find a domain controller.The most common errros on this steps is  “Something went wrong” with error 0x80070774.
6. After the reboot, the enrollment status page (ESP) will be shown to process the device configuration .
7. Now, the user will be asked to sign in again , but this time using their Active Directory credentials.
   The AD account signs on, goes through the first sign-on experience  and then desktop is presented.

Create new  OU and new GPO to configure SCP entry in the registry of your devices.

Create new OU where provisioned Computers will be created.

In our case, we created the following OU
OU=AutoPilot Domain Join,DC=9tech,DC=ca

For a computer to be able  joined in Azure AD, we will need to configure SCP entry settings using the following GPO

Create a Computer-based GPO with the following names and settings.

Configure client-side registry setting for SCP

Use the following example to create a Group Policy Object (GPO) to deploy a registry setting
Create new GPO (Hybrid Azure AD join) and locate the following path: Computer Configuration > Preferences > Windows Settings > Registry
Right-click on the Registry and select New > Registry Item

1. 1. On the General tab, configure the following

• Action: Update
• Hive: HKEY_LOCAL_MACHINE
• Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD
• Value name: TenantId
• Value type: REG_SZ
• Value data: The GUID or Directory ID of your Azure AD instance (This value can be found in the Azure portal > Azure Active Directory > Properties > Directory ID)

Click OK

2. Right-click on the Registry and select New > Registry Item
   1. On the General tab, configure the following

• .Action: Update
• Hive: HKEY_LOCAL_MACHINE
• Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\CDJ\AAD
• Value name: TenantName
• Value type: REG_SZ
• Value data: Your verified domain name if you are using federated environment such as AD FS. Your verified domain name or your onmicrosoft.com domain name, for example, contoso.onmicrosoft.com if you are using managed environment

Click OK

2. Close the editor for the newly created GPO
3. Link the newly created GPO (Hybrid Azure AD join) to the desired OU (OU=AutoPilot Domain Join,DC=9tech,DC=ca) containing domain-joined computers that belong to your controlled rollout population

Login to AD Connect Server and run Synchronization Service Manager
Navigate to containers using the following figure

Select your OU, Save, and Exit

Open Powershell on AD Connect Server and run the following Powershell Command.

Start-ADSyncSyncCycle -PolicyType initial

We need to run this command each time we make modification in OU Scope

You can run this script on AD Connect server during deployment to speed up domain join operation to Azure AD.
Script will run sync process every 300 sec.

$i=1
for(;$i -le 10;$i++)
{
Start-ADSyncSyncCycle -PolicyType delta
Write-Host $i
start-sleep -seconds 300
}

Configure Delegation to new OU for computer object which is going to have Azure Intune Connector

The Intune Connector for your Active Directory creates autopilot-enrolled computers in the on-premises Active Directory domain.
The computer that hosts the Intune Connector must have the rights to create the computer objects within the domain.

Open Active Directory Users and Computers (DSA.msc).
Right-click the organizational unit that you’ll use to create hybrid Azure AD-joined computers, and then select Delegate Control.

In the Delegation of Control wizard, select Next > Add > Object Types.In the Object Types pane, select the Computers check box, and then select OK.

In the Select Users, Computers, or Groups pane, in the Enter the object names to select box, enter the name of the computer where the Connector is installed.

Select Create a custom task to delegate >

Next. Select the Only the following objects in the folder checkbox, and then select the Computer objects, Create selected objects in this folder, and Delete selected objects in this folder checkboxes.

Under Permissions, select the Full Control checkbox.
This action selects all the other options.

Select Next, and then select Finish.

Install the Intune Connector

The Intune Connector for Active Directory must be installed on a computer that’s running Windows Server 2016 or later. The computer must also have access to the internet and your Active Directory.

1. In Intune, select Device enrollment > Windows enrollment > Intune Connector for Active Directory (Preview) > Add connector.
2. Follow the instructions to download the Connector.
3. Open the downloaded Connector setup file, ODJConnectorBootstrapper.exe, to install the Connector.
4. At the end of the setup, select Configure.
5. Select Sign In
6. Enter the user Global Administrator or Intune Administrator role credentials.
7. The user account must have an assigned Intune license.
8. Go to Device enrollment > Windows enrollment > Intune Connector for Active Directory (Preview), and then confirm that the connection status is Active.

Create Azure AD Group for AutoPilot Devices

Navigate to  Home>9 Tech>Groups – All groups

Group Name=All Autopilot Devices
MemberShip Type = Dynamic

(device.devicePhysicalIDs -any _ -contains “[ZTDId]”)

Create Intune Users Group

To limit who can join devices in Intune, create the following group

Group Name=Intune Users

Membership type = Assigned

Members = Add all users which will be using Intune and AutoPilot

Configure MDM Global Settings

Navigate to

Home\9 Tech – Mobility (MDM and MAM)\Configure

MDM User scope = Some=  ADD Intune Users (Group created in the previous step )

MDM User scope = Some = ADD Intune Users (Group created in the previous step )

Configure Device Settings

This setting will allow only members of Intune Users groups to join a workstation to Azure AD

Navigate to

Home\Azure Active Directory\Devices\Device setting

Select the users and groups that are allowed to join devices to Azure AD= Selected = Intune Users

Create and assign an Autopilot deployment profile

• In Intune, select Device enrollment > Windows enrollment > Deployment Profiles > Create Profile.
• Type a Name= AutoPilot Profile User Driven

• For Deployment mode, select User-driven.
• In the Join to Azure AD as box, select Hybrid Azure AD joined (Preview).
• Do not select Out-of-box experience (OOBE) and then select Save.
• Select Create to create the profile.

• In the profile pane, select Assignments.
• Select Select groups.
• In the Select groups pane, select the AutoPilot All Autopilot Devices device group, and then click Select.

It takes about 15 minutes for the device profile status to change from Not assigned to Assigning and, finally, to Assigned.

Turn on the enrollment status page

1. In Intune, select Device enrollment > Windows enrollment > Enrollment Status Page.
2. In the Enrollment Status Page pane, select Default > Settings.
3. In the Show app and profile installation progress box, select Yes.
4. Configure the other options as needed.
5. Select Save.

Create and assign a Domain Join profile

1. In Intune, select Device configuration > Profiles > Create Profile.
2. Enter the following properties:
3. Name: AutoPilot Hybrid Profile
4. Description: Enter a description for the profile.
5. Platform: Select Windows 10 and later.
6. Profile type: Select Domain Join (Preview).
7. Select Settings, and then provide a

Computer name prefix = PC
Domain name = 9tech.ca
Organizational unit in DN format  OU=AutoPilot Domain Join,DC=9tech,DC=ca

Do not experiment with computer prefix putting %serial% variable. It will fail on Offline Domain Join Process.

Select OK > Create

The profile is created and displayed in the list.

To assign the profile. navigate to Assignments and select AutoPilot User Driven Group.

Turn on default enrollment status page for all users

1. In Intune choose Device enrollment > Windows enrollment > Enrollment Status Page.
2. In the Enrollment Status Page blade, choose Default > Settings.
3. For Show app and profile installation progress, choose Yes.
4. Choose the other settings that you want to turn on and then choose Save.

Registering Devices

Register devices from an OEM

Extract Hardware Hashes from existing devices

I created the following three files which will automate all the processes.
Put all these three files on a USB drive.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsStore] “AutoDownload”=dword:00000002

@echo off
color 06
ECHO --------------------------------------------------------------------------
ECHO Collecting Hardware Key
Powershell.exe -ExecutionPolicy Bypass -File "%~dp0\Get-WindowsAutoPilotInfo.ps1" -OutputFile %~dp0\%computername%.csv
ECHO -----------------------------------------------------------------------------
Echo Hardware Keys has been uploaded to USB DRIVE
reg import "%~dp0\disableST.reg"
ECHO --------------------------------------------------------------------------
ECHO Microsoft Store updates have been disabled.
powershell -executionpolicy Bypass -Command "Get-AppxPackage -AllUsers | Remove-AppxPackage"
ECHO -------------------------------------------------------------------------------
ECHO All Microsoft Store Applications have been removed.
ECHO -------------------------------------------------------------------------------
ECHO Press any key to sysprep computer and shutdown.
ECHO ---------------------------------------------------------------------------
pause
Echo ---------------------------------------------------------------------------
ECHO Executing SYSPREP...System will go down shortly. DO
ECHO DO NOT SHUTDOWN SYSTEM
C:\Windows\System32\Sysprep\Sysprep.exe /generalize /oobe /shutdown /quiet

TIMEOUT 5

Get-WindowsAutoPilotInfo.ps1

Download Get-WindowsAutoPilotInfo.ps1 from the following location
https://www.powershellgallery.com/packages/Get-WindowsAutoPilotInfo/1.6 

Run a file to export key

Boot up workstation.
Pick up region

Pick up Keyboard

Skip keyboard layout

On next screen, you will get customized message welcoming  you to your domain
This is a sign that workstation got Auto Pilot Profile from Azure.

Type your Office 365 ID.

After you authenticate, you will receive Enrollment page with status of enrollment.

As you can see , workstation has been joined to local AD Domain.

1. The Autopilot Devices pane in the Intune in the Azure portal. Select Device enrollment > Windows enrollment > Devices.
2. The Azure AD devices pane in the Intune in the Azure portal. Select Devices > Azure AD Devices.
3. The Azure AD All Devices pane in Azure Active Directory in the Azure portal by selecting Devices > All Devices.

1. The Autopilot Devices pane in the Intune in the Azure portal. Select Device enrollment > Windows enrollment > Devices.
2. The Azure AD devices pane in the Intune in the Azure portal. Select Devices > Azure AD Devices.
3. The Azure AD All Devices pane in Azure Active Directory in the Azure portal. Select Devices > All Devices.
4. The All Devices pane in the Intune in the Azure portal. Select Devices > All Devices.