Provisioning Windows devices with Windows Autopilot

Windows Autopilot helps IT admins prepare new devices for use by pre-configuring and making them ready for work within minutes of unboxing. With Windows Autopilot, enrolling and configuring Windows devices will become much simpler and faster. This device will be automatically enrolled in Hexnode when the user powers on the device for the first time. Autopilot enrollment allows new devices to be set up automatically with predefined configurations and policies. This is especially useful for large organizations that need to deploy a significant number of devices efficiently.

Step 1: Configuring Microsoft Entra ID

1. On your Hexnode UEM console, navigate to Enroll > Platform-Specific. Under Windows, choose Windows Autopilot.
2. Start by configuring Microsoft Entra ID and provide the Custom domain/Directory (Tenant) ID and then click on Configure.
3. Select either Allow self enroll or Map UPN to email address.
4. Under Scheduled sync choose how often the AD domain should be synced with Hexnode. Specify the hours and minutes at which the sync to be initiated. Also, choose the frequency of sync (Weekly/Daily).
5. Click Save.

Configuring Autopilot settings:

Policies are applied after enrollment. You can choose to associate policies with the devices from the Hexnode UEM console.

1. Under Configure Autopilot Settings, click Select Default Policy > Associate policies.
2. Select the policies that should be applied to the devices.
3. Click Associate when you are done adding the devices.

Step 2: Creating a Deployment Profile

1. Log in to your Azure portal.
2. Click on the menu bar on the top left
3. Navigate to Microsoft Entra ID.
4. Navigate to the Mobility (MDM & WIP) tab within the Manage section. Click the + Add application option on the top and select Hexnode UEM app from the available applications.
5. The app will be added to the list.
6. Now click on the Hexnode UEM app from the list.
   Note:

   • The installation of the Hexnode UEM agent app does not occur when devices are enrolled through Autopilot.
   • Make sure the MDM user scope is set to:
   • ‘All’ or ‘Some’ for the Hexnode UEM app
   • And ‘None’ for the Microsoft Intune app

   Choosing the option ‘All’ allows all users to proceed with automatic enrollment for their Windows devices, whereas the option ‘Some’ lets you choose the groups that can automatically enroll the devices.
   

7. Copy the URLs for both MDM terms of use URL and MDM discovery URL from the Hexnode portal (Enroll > Platform-Specific > Windows > Windows Autopilot) and paste it here.
8. Login to Microsoft Store for Business.
9. Click Manage > Devices.
10. Click Autopilot deployment. Select Create new profile.
11. Provide a name for the profile, configure the settings to include, and then click Create.

The new profile is added to the Autopilot deployment list.

Step 3: Extracting the hardware IDs of the Windows devices

After you create the Deployment Profile, the next step is to extract the hardware IDs of the devices. You can get the hardware IDs of the devices using either of the following two ways:

• From vendor: You can get the hardware IDs from the vendor or reseller from where you have procured the devices. The vendor will provide you a CSV file that can be uploaded to the Azure portal.
• Using script: If you want to enroll your devices to Autopilot, then you can use the script provided below. Please follow the steps below to extract the Hardware IDs.
  1. Copy this script file to the PC.
  2. Once copied, on the target device open the command prompt with administrator privileges and execute the PowerShell file.
     
     [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 New-Item -Type Directory -Path "C:\HWID" Set-Location -Path "C:\HWID" $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts" Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned Install-Script -Name Get-WindowsAutopilotInfo Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv

     1 2 3 4 5 6 7

     [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 New-Item -Type Directory -Path "C:\HWID" Set-Location -Path "C:\HWID" $env:Path += ";C:\Program Files\WindowsPowerShell\Scripts" Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned Install-Script -Name Get-WindowsAutopilotInfo Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv

  Once the PowerShell file is executed, it generates a CSV file with name AutopilotHWID.csv that is copied to the current directory where the PowerShell file was executed.

  This CSV file has 3 columns: Device Serial Number, Windows Product ID and Hardware Hash.

Step 4: Add devices and apply the profile

Once you get the CSV file, the next step is to add it. Follow the steps below,

1. Login in to Microsoft Store for Business.
2. Click Manage > Devices.
3. Click Add devices. Navigate to the *.csv file and select it.
4. Provide a name for a new Autopilot deployment group. You can also choose one from the list. Click Add.
5. If you don’t want to add devices to a group, you can select the individual devices to apply the profile to.
6. Click the devices or Autopilot deployment group that you want to manage. You need to select devices before you can apply an Autopilot deployment profile.
7. After you have selected the devices, click Autopilot deployment.
8. Choose the Autopilot deployment profile to apply to the selected devices.

Step 5: Assign Users to hardware IDs

Once you have uploaded the hardware IDs, you can assign the users. This will make sure that only the assigned user can complete the enrollment on the Windows device using their credentials.

If you choose to assign a user, you need to make sure that the user is a licensed Intune user.

Follow the steps below to assign a user,

1. Navigate to Devices > By platform > Windows > Windows enrollment. Under Windows Autopilot Deployment Program, click on Devices. Choose the device and click Assign user.
2. From the list of users, select the user and click Select.

Checking the Autopilot devices in the Hexnode portal

After the configuration are applied, the details of the devices that are synced from your Azure portal will be listed in the Hexnode UEM console under Enroll > Platform-Specific > Windows > Windows Autopilot. From this list, you can manage and associate the policies with devices. To modify/delete the Autopilot configuration, click on the Actions menu in the upper right corner.