Windows Autopilot

---

Hi, I just completed the Windows Autopilot with Mike. It was great he showed how to deploy windows without any work from IT. My question is it didn't show how to add software packages to the system being deployed. Is there another course that will show that or how do we go about doing that.

In my organization we are currently in hybird mode for AD, We have a Microsoft 365 Subscription.

I work at university and have a lot of different software packages that are required to be installed. Currently I am using SCCM to deploy task sequences to install the OS and any of the software packages required.

I am assuming In-Tune can do this but i have no experience using In-Tune at the moment. Or is there something i can leverage from Microsoft 365 or SCCM to do this.

For example we have a laptop program that each of our students purchase for their programs. Traditionally we would have to deploy a task sequence in the workshop and have a IT Staff member involved in that process.

I would like to ship the laptop right to the student and they could connect to their home internet or on campus they would login and autopilot would start to configure windows and install all of the applications required.

Any suggestions on how that can be done or if there is a course here on ITProTV that i can take.

Thanks for you help...

Craig

@Craig-Lush ,

I'm glad you liked the Windows Autopilot course!

Installing software packages can be done using a couple of methods, depending on what type of applications you are trying to deploy.

If they are Microsoft Store, Google Play, or Apple App Store apps, Microsoft Intune would probably be the easiest. You would add the apps to Intune, and create assignments. Once the devices enrolled in Intune, as part of your Autopilot deployment, the apps would be deployed. We demonstrate how to deploy store apps in the MD-101 course, specifically the last section, Manage Apps and Data. Take a look here:

https://app.itpro.tv/course-library/managing-modern-desktops-md101

If the apps you are deploying are Winn32 apps, you can still use Intune, but will need to prepare the applications using the Microsoft Win32 Content Prep Tool. We don't have any shows on this currently (but you've given me ideas). Take a look at the Microsoft Documentation

https://docs.microsoft.com/en-us/mem/intune/apps/apps-win32-app-management

Since you already have SCCM task sequences set up, you might prefer to leverage them. You can use Autopilot to provision the new device and auto-enroll it to Microsoft Intune. Then use Intune to install the ConfigMgr client for co-management. Then you have the option to immediately run a task sequence, that would install your software.

Take a look at these two links:

https://docs.microsoft.com/en-us/mem/configmgr/core/get-started/2019/technical-preview-1912#bkmk_provisionts

https://docs.microsoft.com/en-us/mem/configmgr/comanage/how-to-prepare-Win10

Let me know what you think,

Mike
mike@itpro.tv

@Mike-Rodrick Thank you Mike, I will check that out. If i have any questions i may reach out to you. Do you know if you guys will be offering a Intune course at some point in the future?

Craig

@Mike-Rodrick Hi Mike, I should have mentioned the type of applications we are installing for our students are specifically related it engineering software such as Autocad, Automation Studio, Solidworks and the list goes on.

So i guess you are saying the best method would be through SCCM using Intune as a connector. I have to read up more on this and hopefully there will be a course as i have very limited knowledge with Intune.

I did notice in SCCM there is a Intune icon. Maybe i can connect it to intune in azure. Just a thought right now with my limited knowledge.

Thank you,

Craig

@Craig-Lush ,

You're welcome, and feel free to reach out any time. You can post here or email me directly at mike@itpro.tv.

I do think that using co-management with SCCM and Intune would be your best bet at this point. This would allow you to leverage your working solution, and move to a full cloud-based solution a little at a time. Once you have SCCM and Intune configured for co-management, migrating workloads to Intune is pretty easy.

I will dig through the library and see what episodes we have that might help. I know Adam has done a couple of SCCM courses, and I believe MD-101 covers a little co-management.

As for the app type, I should have been more specific, Are they .exe, .msi, .msix, .appx, etc? The app type will determine what deployment methods are available.

Hi Mike,

Thanks for the response. If you can send me the course sections to take a look that would be great. Most of the apps are msi which make things easier and others are exe which can be more tedious to get into SCCM which i am currently working on.

On another topic I am new to powershell and just starting your beginners powershell course. I am trying to get some software into the software centre that requires either a username and password from the vendor as part of the installation. I was thinking if i can have that in a text file and somehow be able to read that information from the textfile by a powershell script.

Thanks,

Craig

@Craig-Lush ,

There are a couple of was to work with username/passwords in PowerShell. Reading the creds from a file will work, but will not be secure.

ConvertTo-SecureString can be used to save the password in a secure fashion. This cmdlet uses the Windows Data Protection API to encrypt the data. The downside is, only the original user on the original machine the encryption was performed on can decrypt the string to be reused.

I believe in your scenario, this will need to be performed on different machines. This will require you to provide a key to the ConvertTo-SecureString cmdlet. Something like this:

# Generate a random AES Encryption Key.
$AESKey = New-Object Byte[] 32
[Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($AESKey)

This key could be retrieved when needed. It would need to be protected using the ACL. But this would allow you to decrypt a stored secure string from multiple computers.

Thanks...

The way it should work is i have the install files up on our sccm server file share and create a application when the application is installing it will get the password from our server in one place for all machines.

We have a sccm account that is used when applications are being installed either from the software center or from a task sequence.

Another question do you know how to get around the UAC prompt by scripting when trying to do a quite install on a application.

Thanks for you help. I am going to have to sit down and go through your powershell basics course. Can you give me any reference sections in the course where i can look this up?

Thanks Again,

Craig