While ConfigMgr has a ready-made task sequence template for the Windows Autopilot for Existing Devices scenario, MDT Lite Touch does not have one. Well, until now that is 🙂
On the link below you can download a new task sequence template for Windows Autopilot as well as the needed scripts and unattend.xml file:
Download link: https://github.com/DeploymentResearch/DRFiles/tree/master/Scripts/AutoPilot/MDT
Note #1: The Windows Autopilot for Existing Devices scenario requires that you download your Autopilot deployment profile as a JSON file. If you need a guide for downloading the profile, check this post: Windows Autopilot for Existing Devices – Downloading the Deployment Profile
Note #2:Â Ensure that your Windows Autopilot deployment profile is configured for either user-driven Microsoft Entra ID or user-driven hybrid Microsoft Entra Autopilot profiles. These are the only supported scenarios. For example, Self-deploying or pre-provisioning Autopilot profiles are not supported for this scenario.
The Task Sequence template and scripts
Download the files in from this GitHub repository, as well as your Windows Autopilot profile (AutopilotConfigurationFile.json). Then copy the files to the right locations:
1. Copy the downloaded AutopilotConfigurationFile.json to the <deployment share>\Autopilot folder (create the folder if needed).
2. Copy the CleanupForAutopilot.ps1 script to the <deployment share>\scripts folder.
3. Copy the WindowsAutoPilotForExistingDevices.xml template to the <deployment share>\Templates folder.
Using the new Task Sequence template
To use the new task sequence template, select the Windows Autopilot for Existing Devices template when creating a new task sequence.
1. After you created a new task sequence using the Windows Autopilot for Existing Devices template, make a note of the task sequence id, and copy the unattend.xml from the GitHub repository to the <deployment share>\control\<task sequence id> folder.
Reviewing the Task Sequence.
This is what the new task sequence should like when created using the Windows Autopilot for Existing Devices template.
Hi Johan
Thank you for sharing this awsome article. It helped me learn alot. These steps executed well.
One thing i am still finding a solution for is Applications installs(Chrome Enterprise, Slack) or BIOS Updates(Not important but good to have) before the system goes to AutoPilot Screen. I already tried editing the task sequence and unattend.xml but those did not work and always do something messy. Could you share some steps i can follow to achieve(Windows installation-> apps using exe installation -> BIOS installation/updating -> AutoPilot Screen)
Thanks again
You can do BIOS updates during the WinPE phase, and apps can be installed via the Enrollment Status Page feature in Intune.
Can we do Lenovo BIOS updates with custom logo installation (exe file)? I also want to install the apps(Google Chrome, Lenovo System Update) using MDT. I have tried different standard task sequences to land on OOBE screen similar to this but they always run into some script issues.
Can you please help me to include apps and Custom BIOS updates in this Task Sequence? or if there are some guides i may have missed?
Thanks again
In this task sequence template, BIOS Updates can be performed in the WinPE phase but not in the full Windows phase. You want to avoid reboots during the OOBE phases.
Hello,John. Your post as always are very useful. My question would sound funny but i need to ask you this before trying to break some things. So currently have our MDT server where we prepare our devices – custom ISO, apps, domain join etc. Will this approach Windows Autopilot for Existing Devices will allow me to join device to domain and then kick in OOBE?
Shorthand: No…
Longer answer, if you want to do hybrid deployments, you should setup Entra Connect and a GPO to enroll devices to Entra/Intune. Autopilot and Hybrid without line-of-sight to a domain controller is a royally painful scenario
I got the following error during OOBE:
80180014 – This feature is not supported.
Since I wrote this post, Microsoft has added restrictions to this scenario. You can read more about this here: https://msendpointmgr.com/2024/03/25/autopilot-tenant-security-risk/
Hi John. Thank you for this article, almost exactly what we're looking for. We're moving to Intune over the summer and currently use MDT to image IT suites in a school environment. So with all these existing computers, we'd like to continue to reimage them using MDT and use your method to then enrol them to Intune. However, because these computers are shared classroom devices, we'd ideally like to use our Self-deploying Autopilot profile. Is this not possible at all? Thanks in advance.
No, per the docs: The JSON file for Windows Autopilot for existing devices only supports user-driven Microsoft Entra ID and user-driven hybrid Microsoft Entra Autopilot profiles. Self-deploying and pre-provisioning Autopilot profiles aren't supported with JSON files due to these scenarios requiring TPM attestation.
However, you can still automate that scenario by having MDT register the device in Autopilot via a web service.
Thank you for the response. Are you able to recommend any place to look into Autopilot via web service?
We have that as part of our training on the ViaMonstra online academy, but I'll see if I can get something published to the community.
Thanks again Johan
Any chance you were able to get anything published to the community on this? Thanks for all your hardwork!!!!!
It took forever to get it published, but yes, it's here: https://www.deploymentresearch.com/cloud-os-deployment-part-4-imaging-over-internet-directly-into-windows-autopilot/
I notice that I have a MININT and LTIBootstrap.VBS still in the root of C: Should this have not been cleaned up?
Yes, they should be removed by the CleanupForAutopilot.ps1 script once the specialize pass run
This works wonderfully! Thank you so much for your help. I do have one question: my deployment seems to be skipping the "setting up for work or school" portion, which includes device preparation, device setup, and account setup. Overall, this isn't a big deal, but I was curious if there’s a way to restore that process. It’s been helpful for our build techs to use the deployment status page to know when a PC is fully configured. Currently, it prompts for credentials, logs into Windows, and then completes the deployment in the background.
If you want the complete Autopilot experience, included ESP etc. it's better to have the setup register the device in Autopilot, and wait for the assignment to finish.
I apologize if this is a silly question, but how would I go about doing this?
Which step in the guide is it that could use some clarification?
This is a lifesaver. I have a question though. I'm currently using this but the apps installing from InTune are taking forever. Is it possible to add the steps to install certain apps in the task sequence that are going to deploy to every single machine anyway? Or will it break the process?
For this scenario it won't work since MDT install apps after automatic login (as administrator)
This is a really great guide. Works great!
Dear Johan, Thank you very much, for this very useful information, regarding autopilot. I just have one question, at the moment. I captured a wim from a Virtual Machine and whenever, I try to deploy that wim, to a PC, using the above solution, the startup menu on the PC, seems to get stuck at "Getting Ready" screen. Initially, the image copies down ok and then, the task gets as far as running the powershell script and after that, nothing else happens. The "Getting Ready" message appears constantly, on the screen, until the PC is manually turned off. Would anyone… Read more »
It sounds like the unattend.xml files were not deleted. Can you deploy this captured WIM with a default task sequence? (no changes).
This is super cool stuff! This solution is very beneficial in my hybrid manufacturing environment! Thank you so much for putting this together! I will be following this page closely for future solutions.
Hello Johan,
Thanks for the marvellous work!
Do you think this task sequence can be used for Hybrid AutoPilot scenarios?
Local PS scripts work well but my last attempts using MDT give the PC/VM WAP profile status as "Not assigned".
I haven't tried this for Hybrid, but it's listed as a supported scenario for the existing devices scenario.
Great Job Johan!! Got this working on my end. Question? I have a custom wim that I use for my client. Do you have any article and tips on OOBE to prompt the self deploy user to connect to his/her wireless network before autopilot starts. Just like when a regular use buys a brand new laptop from manufactures. On first boot, they are presented to connect to their home wireless network before language and keyboard prompts.
You can always teach the users to press Shift-F10 and run: start ms-availablenetworks:
Thank you. I got it to work. After rebooting using your TS, and unplugging from the network, the users was prompted w/ wireless options. Thanks. 🙂
Will this work if device is already in autopilot? It seems that after the Install Operating system reboot, the next OOBE is interrupted by autopilot. At this point, the task sequence is abandoned, and the completion of driver injection never happens. Or am I missing something.
Drivers are injected in the WinPE phase, before the machines is rebooted into OOBE. This setup is purposely configured so it won't continue the task sequence after the first reboot.
Existing Autopilot objects should be ok, but I worked with one company they did MANY tests on the same device, over and over again, and eventually Autopilot gave up. For them we implemented logic in the task sequence that would use MS Graph, via a web service, to go in and remove the existing devices from Intune/Autopilot, and Entra ID.
Gutted – got to the 'Setting up for work or school' page and it fails with:
Device Preparation:
Error
Securing your hardware (0x800705b4)
Any ideas? I thought I was there.
Cheers as always
Gareth
That's most likely due to TPM 2.0 not being enabled… Please ensure that your Autopilot deployment profile is configured for either user-driven Microsoft Entra ID or user-driven hybrid Microsoft Entra Autopilot profiles. These are the only supported scenarios. For example, Self-deploying or pre-provisioning Autopilot profiles are not supported for this scenario.
Got it all working, but are there meant to be manual steps? I'm probably wrong, but it would be great if certain things were hard coded – such as the Country (which is where it stops). Once I choose that, it then stops at the network choice screen. Once we pass through the various stops – away it goes.
The Autopilot module dated before today (December 26, 2023), did not write the CloudAssignedRegion value into the JSON file, but the 2.5 version of the WindowsAutopilotIntuneCommunity module does thanks to a pull request from Michael Nieahus: https://www.powershellgallery.com/packages/WindowsAutopilotIntuneCommunity/2.5
Hi Johan – this is great. My biggest issue at the moment is the IT Tech people do not allow us access to MS Graph. I've looked at the older methods but the command Connect-AutopilotiIntune has been depreciated so I cannot find a way of downloading the profiles or turning them into JSON files.
I'm also getting an error when creating the task sequence when selecting the template:
'>' is an unexpected token. The expected token is '-'. Line 19, position 76.
I have no idea how to fix it.
Any ideas would be appreciated as always.
Gareth
Well, the IT staff must give you permission to download the Autopilot profiles, or download them for you. As far as the template goes, make sure to download the file (raw). I just tested on a brand new deployment share, downloaded the template from GitHub, and could create a TS using it just fine.
I have been following your guides for years starting with the Deployment Fundamentals Vol 1 book. I implemented the scripts in this article on my MDT VM but have some issues. The test laptop I tried it on effectively became an orphaned machine object that is part of no autopilot groups on our tenant. There is no way that I can see to add the laptop to a provisioned group manual or dynamic. This means no provisioned autopilot group, no VPN. I had to manually install the company portal to load apps. It seemed to load some things but not… Read more »
I created a post on how to use the ZtdCorrelationId from the JSON file in a dynamic group. Works well: https://www.deploymentresearch.com/windows-autopilot-for-existing-devices-creating-a-dynamic-group/
Excellent as always Johan. I will work on your linked suggestion. I appreciate the assist!
This process will still require a human to finish the OOBE right?
Yes, that's correct. If you need that part fully automated, there are other enrollment solutions, like using a bulk enrollment provisioning package.
Yea that's what we use now. Just hate renewing ppkgs.