Category Filter

How to enroll Windows 10 devices using provisioning package files

What is Windows provisioning package (ppkg)?

To configure end-users’ devices without imaging, Windows provisioning is the best way to go. Using Windows provisioning, administrators can quickly and seamlessly set up the configurations and settings for the enrollment process and deploy the configurations to bulk devices.

A provisioning package file (.ppkg) is a container for a collection of configuration settings. It can be created using a Windows 10 device, which can later be used for the bulk enrollment of Windows devices without any user intervention.

Benefits of enrolling devices using provisioning package

  • One-time setup – It is a one-time setup where the end-users need to just power on the device, get connected to the network and install the ppkg file to get enrolled with Hexnode UEM.
  • Bulk Enrollment of devices – It allows large scale roll-out of corporate-owned devices.

Before you begin

Ensure you have configured the enrollment settings under Enroll > Platform-Specific > Windows > Windows PCs & Tablets on the Hexnode portal.

Create ppkg file using Windows Configuration Designer

Create a Project

  1. Download and Install Windows Configuration Designer on a Windows 10 device.
  2. Open Windows Configuration Designer.
  3. Click on File and choose New project.
  4. Provide the project details.
    • Name: Provide a suitable name to identify the project.
    • Project folder: Choose the destination path for the file to be saved.
    • Description: Provide a suitable description regarding the package.
  5. Select project workflow as Provisioning package and click on Next.
  6. Choose the type of Windows edition and click on Next.
  7. If you want, you can import an existing provisional package to your project or click on Finish to create your project.

Customize the provisioning package

Once the project is created, you can select the desired customizations from the Available customizations.

  1. Expand Runtime settings and choose Workplace.
  2. Click on Enrollments.
  3. Provide your User Principal Name (UPN) and click on Add.
  4. Note:

    • The UPN is a unique identifier for the user under which the device is being enrolled. Provide the email address of the corresponding user in Hexnode as the UPN.
    • You can also provide a UPN having username different than the one you selected previously on the Hexnode enrollment settings. However, for authenticated enrollments, the enrollment will proceed under the username specified in the UPN.
    • For bulk enrollment, this must be a service account that is allowed to enroll multiple users, such as “enroll@mydomain.com”.

  5. On the left navigation page, click on the UPN and provide the following details for the enrollment process.
    • AuthPolicy: Select On-Premise.
    • DiscoveryServiceFullUrl: Provide the complete URL for the discovery service.(https://yourportal.hexnodemdm.com/enroll/)
    • EnrollmentServiceFullUrl: Provide the complete URL here.(https://yourportal.hexnodemdm.com/windowsenroll/)
    • PolicyServiceFullUrl: Provide the complete URL here.(https://yourportal.hexnodemdm.com/windowsenroll/)
    • Secret: Provide the secret key for the Windows enrollment here.
      • For Open Enrollment, you can get the secret-key from your Hexnode UEM console by going to Enroll > Settings > Authentication Modes > Open Enrollment. Click on the unhide icon to view and note the Default Password.
      • For Authenticated Enrollment, the password of the corresponding user should be provided as the secret-key.
  6. Save the project once you are done with adding all the settings (File > Save).

Build the provisioning package

Once you have customized the provisioning package,

  1. Click on Export and select Provisioning package.
  2. Provide the following details and click on Next.
    • Name: This field will be pre-filled with the Project Name. However, you can change this name to a required one.
    • Version (in Major.Minor format): This field represents the default package version. You can change the current version by specifying a new value. (Optional)
    • Owner: Choose the package owner type here.
    • Rank (between 0-99): Choose a package rank between 0-99. The default rank is 0.
  3. If the package contains sensitive data that cannot be compromised, you can select the required security type.
    • Encrypt package: Select the option to encrypt the package. An encryption password will have to be provided.
    • Sign package: If you are signing the package, you need to provide a valid certificate.
  4. Provide the destination path to save the package and click on Next.
  5. Click on Build to build the package.
  6. If your build is successful, the package name along with the project and output locations will be displayed.
  7. Click on Finish.

Apply the provisioning package to the devices

Once the ppkg file is created, you can use this file to enroll Windows devices without any user intervention.

  1. On a Windows PC/Tablet, navigate to Settings > Accounts > Access work or school > Add or remove a provisioning package and click on Add a package.
  2. From the removable media that contains the ppkg file, select the package to install.
  3. The device gets enrolled with Hexnode UEM.
Note:

  • ppkg file can be shared by any means, and you need to click on the file to install and the device gets enrolled with Hexnode UEM.


Note:

  • You can verify the enrollment process by navigating to Settings > Accounts > Access work or school > Add or remove a provisioning package. The provisional package will be listed here.