mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-16 19:03:46 +00:00
Merge branch 'master' of https://github.com/MicrosoftDocs/windows-docs-pr into wtg
This commit is contained in:
Greg Lindsay
@ -23,13 +23,13 @@ ms.topic: article
|
||||
|
||||
This topic provides an overview of new solutions and online content related to deploying Windows 10 in your organization.
|
||||
|
||||
- For an all-up overview of new features in Windows 10, see [What's new in Windows 10](https://docs.microsoft.com/en-us/windows/whats-new/index).
|
||||
- For an all-up overview of new features in Windows 10, see [What's new in Windows 10](https://docs.microsoft.com/windows/whats-new/index).
|
||||
- For a detailed list of changes to Windows 10 ITPro TechNet library content, see [Online content change history](#online-content-change-history).
|
||||
|
||||
## Recent additions to this page
|
||||
|
||||
[SetupDiag](#setupdiag) 1.4.1 is released.<br>
|
||||
The [Windows ADK for Windows 10, version 1903](https://docs.microsoft.com/en-us/windows-hardware/get-started/adk-install) is available.<br>
|
||||
The [Windows ADK for Windows 10, version 1903](https://docs.microsoft.com/windows-hardware/get-started/adk-install) is available.<br>
|
||||
New [Windows Autopilot](#windows-autopilot) content is available.<br>
|
||||
[Windows 10 Subscription Activation](#windows-10-subscription-activation) now supports Windows 10 Education.
|
||||
|
||||
@ -49,7 +49,7 @@ See [Deploy Windows 10 with Microsoft 365](deploy-m365.md) for an overview, whic
|
||||
## Windows 10 servicing and support
|
||||
|
||||
- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Office 365 ProPlus updates, and Intune content, with System Center Configuration Manager content coming soon!
|
||||
- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/en-us/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed.
|
||||
- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically logon as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed.
|
||||
- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period.
|
||||
- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally.
|
||||
- **Pause updates**: We have extended the ability to pause updates for both feature and monthly updates. This extension ability is for all editions of Windows 10, including Home. You can pause both feature and monthly updates for up to 35 days (seven days at a time, up to five times). Once the 35-day pause period is reached, you will need to update your device before pausing again.
|
||||
@ -88,7 +88,7 @@ The following Windows Autopilot features are available in Windows 10, version 19
|
||||
|
||||
Windows 10 Education support has been added to Windows 10 Subscription Activation.
|
||||
|
||||
With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to the enterprise-grade edition for educational institutions – Windows 10 Education. For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/en-us/windows/deployment/windows-10-subscription-activation).
|
||||
With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to the enterprise-grade edition for educational institutions – Windows 10 Education. For more information, see [Windows 10 Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-subscription-activation).
|
||||
|
||||
### SetupDiag
|
||||
|
||||
@ -135,14 +135,14 @@ For more information, see [MBR2GPT.EXE](mbr-to-gpt.md).
|
||||
|
||||
MDT build 8456 (12/19/2018) is available, including support for Windows 10, version 1809, and Windows Server 2019.
|
||||
|
||||
For more information about MDT, see the [MDT resource page](https://docs.microsoft.com/en-us/sccm/mdt/).
|
||||
For more information about MDT, see the [MDT resource page](https://docs.microsoft.com/sccm/mdt/).
|
||||
|
||||
|
||||
### Windows Assessment and Deployment Kit (ADK)
|
||||
|
||||
The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. See the following topics:
|
||||
|
||||
- [What's new in ADK kits and tools](https://docs.microsoft.com/en-us/windows-hardware/get-started/what-s-new-in-kits-and-tools)
|
||||
- [What's new in ADK kits and tools](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools)
|
||||
- [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md)
|
||||
|
||||
|
||||
@ -178,7 +178,7 @@ The following topics provide a change history for Windows 10 ITPro TechNet libra
|
||||
|
||||
[Overview of Windows as a service](update/waas-overview.md)
|
||||
<BR>[Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md)
|
||||
<BR>[Windows 10 release information](https://docs.microsoft.com/en-us/windows/windows-10/release-information)
|
||||
<BR>[Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information)
|
||||
<BR>[Windows 10 Specifications & Systems Requirements](https://www.microsoft.com/en-us/windows/windows-10-specifications)
|
||||
<BR>[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md)
|
||||
<BR>[Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)
|
||||
|
||||
@ -16,6 +16,12 @@ ms.topic: article
|
||||
Here's more news about [Windows as a service](windows-as-a-service.md):
|
||||
|
||||
<ul>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540">Windows 10, version 1809 designated for broad deployment</a> - March 28, 2019</li>
|
||||
<li><a href="https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience">Data, insights and listening to improve the customer experience</a> - March 6, 2019</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Getting-to-know-the-Windows-update-history-pages/ba-p/355079">Getting to know the Windows update history pages</a> - February 21, 2019</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523">Windows Update for Business and the retirement of SAC-T</a> - February 14, 2019</li>
|
||||
<li><a href="https://blogs.windows.com/windowsexperience/2019/01/15/application-compatibility-in-the-windows-ecosystem/#A8urpp1QEp6DHzmP.97">Application compatibility in the Windows ecosystem</a> - January 15, 2019</li>
|
||||
<li><a href="https://blogs.windows.com/windowsexperience/2018/12/10/windows-monthly-security-and-quality-updates-overview/#UJJpisSpvyLokbHm.97">Windows monthly security and quality updates overview</a> - January 10, 2019</li>
|
||||
<li><a href="https://blogs.windows.com/windowsexperience/2018/12/19/driver-quality-in-the-windows-ecosystem/#ktuodfovWAMAkssM.97">Driver quality in the Windows ecosystem</a> - December 19, 2018</li>
|
||||
<li><a href="http://m365mdp.mpsn.libsynpro.com/001-windows-10-monthly-quality-updates">Modern Desktop Podcast - Episode 001 – Windows 10 Monthly Quality Updates</a> - December 18, 2018</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Measuring-Delivery-Optimization-and-its-impact-to-your-network/ba-p/301809#M409">Measuring Delivery Optimization and its impact to your network</a> - December 13, 2018</li>
|
||||
|
||||
@ -104,7 +104,7 @@ At this point, the IT administrator can set a policy to pause the update. In thi
|
||||
|
||||
|
||||
|
||||
Now all devices are paused from updating for 35 days. When the the pause is removed, they will be offered the *next* quality update, which ideally will not have the same issue. If there is still an issue, the IT admin can pause updates again.
|
||||
Now all devices are paused from updating for 35 days. When the pause is removed, they will be offered the *next* quality update, which ideally will not have the same issue. If there is still an issue, the IT admin can pause updates again.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -21,20 +21,19 @@ Find the tools and resources you need to help deploy and support Windows as a se
|
||||
Find the latest and greatest news on Windows 10 deployment and servicing.
|
||||
|
||||
**Discovering the Windows 10 Update history pages**
|
||||
> [!VIDEO https://www.youtube-nocookie.com/embed/GADIXBf9R58]
|
||||
> [!VIDEO https://www.youtube-nocookie.com/embed/mTnAb9XjMPY]
|
||||
|
||||
Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. The Windows update history page is for anyone looking to gain an immediate, precise understanding of particular Windows update issues.
|
||||
Everyone wins when transparency is a top priority. We want you to know when updates are available, as well as alert you to any potential issues you may encounter during or after you install an update. Bookmark the <a href="https://aka.ms/WindowsReleaseHealth">Windows release health dashboard</a> for near real-time information on known issues, workarounds, and resolutions--as well as the current status of the latest feature update rollout.
|
||||
|
||||
The latest news:
|
||||
<ul compact style="list-style: none">
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Updating-Windows-10-version-1903-using-Configuration-Manager-or/ba-p/639100">Updating Windows 10, version 1903 using Configuration Manager or WSUS</a> - May 23, 2019</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-in-Windows-Update-for-Business-in-Windows-10-version/ba-p/622064">What’s new in Windows Update for Business in Windows 10, version 1903</a> - May 21, 2019</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/What-s-new-for-IT-pros-in-Windows-10-version-1903/ba-p/622024">What’s new for IT pros in Windows 10, version 1903</a> - May 21, 2019</li>
|
||||
<li><a href="https://blogs.windows.com/windowsexperience/2019/05/21/how-to-get-the-windows-10-may-2019-update">How to get the Windows 10 May 2019 Update</a> - May 21, 2019</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/The-benefits-of-Windows-10-Dynamic-Update/ba-p/467847">The benefits of Windows 10 Dynamic Update</a> - April 17, 2019</li>
|
||||
<li><a href="https://blogs.windows.com/windowsexperience/2019/04/04/improving-the-windows-10-update-experience-with-control-quality-and-transparency">Improving the Windows 10 update experience with control, quality and transparency</a> - April 4, 2019</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Call-to-action-review-your-Windows-Update-for-Business-deferral/ba-p/394244">Call to action: review your Windows Update for Business deferral values</a> - April 3, 2019</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-10-version-1809-designated-for-broad-deployment/ba-p/389540">Windows 10, version 1809 designated for broad deployment</a> - March 28, 2019</li>
|
||||
<li><a href="https://blogs.windows.com/windowsexperience/2019/03/06/data-insights-and-listening-to-improve-the-customer-experience">Data, insights and listening to improve the customer experience</a> - March 6, 2019</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Getting-to-know-the-Windows-update-history-pages/ba-p/355079">Getting to know the Windows update history pages</a> - February 21, 2019</li>
|
||||
<li><a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523">Windows Update for Business and the retirement of SAC-T</a> - February 14, 2019</li>
|
||||
<li><a href="https://blogs.windows.com/windowsexperience/2019/01/15/application-compatibility-in-the-windows-ecosystem/#A8urpp1QEp6DHzmP.97">Application compatibility in the Windows ecosystem</a> - January 15, 2019</li>
|
||||
<li><a href="https://blogs.windows.com/windowsexperience/2018/12/10/windows-monthly-security-and-quality-updates-overview/#UJJpisSpvyLokbHm.97">Windows monthly security and quality updates overview</a> - January 10, 2019</li>
|
||||
</ul>
|
||||
|
||||
[See more news](waas-morenews.md). You can also check out the [Windows 10 blog](https://techcommunity.microsoft.com/t5/Windows-10-Blog/bg-p/Windows10Blog).
|
||||
@ -44,9 +43,11 @@ Written by IT pros for IT pros, sharing real world examples and scenarios for Wi
|
||||
|
||||
<img src="images/champs-2.png" alt="" width="640" height="320">
|
||||
|
||||
<a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Classifying-Windows-updates-in-common-deployment-tools/ba-p/331175">**NEW** Classifying Windows updates in common deployment tools</a>
|
||||
<a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Deployment-rings-The-hidden-strategic-gem-of-Windows-as-a/ba-p/659622">**NEW** Deployment rings: The hidden [strategic] gem of Windows as a service</a>
|
||||
|
||||
<a href="https://docs.microsoft.com/windows-server/get-started/express-updates"><b>NEW</b> Express updates for Windows Server 2016 re-enabled for November 2018 update
|
||||
<a href="https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Classifying-Windows-updates-in-common-deployment-tools/ba-p/331175">Classifying Windows updates in common deployment tools</a>
|
||||
|
||||
<a href="https://docs.microsoft.com/windows-server/get-started/express-updates">Express updates for Windows Server 2016 re-enabled for November 2018 update
|
||||
</a>
|
||||
|
||||
<a href="https://support.microsoft.com/help/4472027/">2019 SHA-2 Code Signing Support requirement for Windows and WSUS</a>
|
||||
|
||||
@ -28,13 +28,13 @@ Before deploying a device using Windows Autopilot, the device must be registered
|
||||
|
||||
When you purchase devices directly from an OEM, that OEM can automatically register the devices with the Windows Autopilot deployment service. For the list of OEMs that currently support this, see the "Participant device manufacturers" section of the [Windows Autopilot information page](https://www.microsoft.com/en-us/windowsforbusiness/windows-autopilot).
|
||||
|
||||
Before an OEM can register devices on behalf of an organization, the organization must grant the OEM permission to do so. This process is initiated by the OEM, with approval granted by an Azure AD global administrator from the organization. See the "Customer Consent" section of the [Customer consent page](https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/registration-auth#oem-authorization).
|
||||
Before an OEM can register devices on behalf of an organization, the organization must grant the OEM permission to do so. This process is initiated by the OEM, with approval granted by an Azure AD global administrator from the organization. See the "Customer Consent" section of the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#oem-authorization).
|
||||
|
||||
## Reseller, distributor, or partner registration
|
||||
|
||||
Customers may purchase devices from resellers, distributors, or other partners. As long as these resellers, distributors, and partners are part of the [Cloud Solution Partners (CSP) program](https://partner.microsoft.com/en-us/cloud-solution-provider), they too can register devices on behalf of the customer.
|
||||
|
||||
As with OEMs, CSP parnters must be granted permission to register devices on behalf of an organization. This follows the process described on the [Customer consent page](https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/registration-auth#csp-authorization). The CSP partner initiates a request to establish a relationship with the organization, with approval granted by a global administrator from the organization. Once approved, CSP partners add devices using [Partner Center](https://partner.microsoft.com/en-us/pcv/dashboard/overview), either directly through the web site or via available APIs that can automate the same tasks.
|
||||
As with OEMs, CSP parnters must be granted permission to register devices on behalf of an organization. This follows the process described on the [Customer consent page](https://docs.microsoft.com/windows/deployment/windows-autopilot/registration-auth#csp-authorization). The CSP partner initiates a request to establish a relationship with the organization, with approval granted by a global administrator from the organization. Once approved, CSP partners add devices using [Partner Center](https://partner.microsoft.com/en-us/pcv/dashboard/overview), either directly through the web site or via available APIs that can automate the same tasks.
|
||||
|
||||
Windows Autopilot does not require delegated administrator permissions when establishing the relationship between the CSP partner and the organization. As part of the approval process performed by the global administrator, the global administrator can choose to uncheck the "Include delegated administration permissions" checkbox.
|
||||
|
||||
@ -42,9 +42,9 @@ Windows Autopilot does not require delegated administrator permissions when esta
|
||||
|
||||
If an existing device is already running Windows 10 version 1703 or later and enrolled in an MDM service such an Intune, that MDM service can ask the device for the hardwareh ID (also known as a hardware hash). Once it has that, it can automatically register the device with Windows Autopilot.
|
||||
|
||||
For instructions on how to do this with Microsoft Intune, see [Create an Autopilot deployment profile](https://docs.microsoft.com/en-us/intune/enrollment-autopilot#create-an-autopilot-deployment-profile) documentation describing the "Convert all targeted devices to Autopilot" setting.
|
||||
For instructions on how to do this with Microsoft Intune, see [Create an Autopilot deployment profile](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-deployment-profile) documentation describing the "Convert all targeted devices to Autopilot" setting.
|
||||
|
||||
Also note that when using the [Windows Autopilot for existing devices](https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/existing-devices) scenario, it is not necessary to pre-register the devices with Windows Autopilot. Instead, a configuration file (AutopilotConfigurationFile.json) containing all the Windows Autopilot profile settings is used; the device can be registered with Windows Autopilot after the fact using the same "Convert all targeted devices to Autopilot" setting.
|
||||
Also note that when using the [Windows Autopilot for existing devices](https://docs.microsoft.com/windows/deployment/windows-autopilot/existing-devices) scenario, it is not necessary to pre-register the devices with Windows Autopilot. Instead, a configuration file (AutopilotConfigurationFile.json) containing all the Windows Autopilot profile settings is used; the device can be registered with Windows Autopilot after the fact using the same "Convert all targeted devices to Autopilot" setting.
|
||||
|
||||
## Manual registration
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.topic: article
|
||||
|
||||
With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. This ensures that the default encrytion algorithm is not applied automatically when this is not the desired setting. Other BitLocker policies that must be applied prior to encryption can also be delivered before automatic BitLocker encryption begins.
|
||||
|
||||
The BitLocker encryption algorithm is used when BitLocker is first enabled, and sets the strength to which full volume encryption should occur. Available encryption algorithms are: AES-CBC 128-bit, AES-CBC 256-bit, XTS-AES 128-bit or XTS-AES 256-bit encryption. The default value is XTS-AES 128-bit encryption. See [BitLocker CSP](https://docs.microsoft.com/en-us/windows/client-management/mdm/bitlocker-csp) for information about the recommended encryption algorithms to use.
|
||||
The BitLocker encryption algorithm is used when BitLocker is first enabled, and sets the strength to which full volume encryption should occur. Available encryption algorithms are: AES-CBC 128-bit, AES-CBC 256-bit, XTS-AES 128-bit or XTS-AES 256-bit encryption. The default value is XTS-AES 128-bit encryption. See [BitLocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp) for information about the recommended encryption algorithms to use.
|
||||
|
||||
To ensure the desired BitLocker encryption algorithm is set before automatic encryption occurs for Autopilot devices:
|
||||
|
||||
@ -51,4 +51,4 @@ Windows 10, version 1809 or later.
|
||||
|
||||
## See also
|
||||
|
||||
[Bitlocker overview](https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-overview)
|
||||
[Bitlocker overview](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-overview)
|
||||
|
||||
@ -394,7 +394,7 @@ Optional: see the following video for an overview of the process.
|
||||
|
||||
> [!video https://www.youtube.com/embed/IpLIZU_j7Z0]
|
||||
|
||||
First, you need a MSfB account. You can use the same one you created above for Intune, or follow [these instructions](https://docs.microsoft.com/en-us/microsoft-store/windows-store-for-business-overview) to create a new one.
|
||||
First, you need a MSfB account. You can use the same one you created above for Intune, or follow [these instructions](https://docs.microsoft.com/microsoft-store/windows-store-for-business-overview) to create a new one.
|
||||
|
||||
Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) using your test account by clicking **Sign in** in the upper-right-corner of the main page.
|
||||
|
||||
@ -462,7 +462,7 @@ Click on **OK** and then click on **Create**.
|
||||
|
||||
#### Assign the profile
|
||||
|
||||
Profiles can only be assigned to Groups, so first you must create a group that contains the devices to which the profile should be applied. This guide will provide simple instructions to assign a profile, for more detailed instructions, see [Create an Autopilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an Autopilot deployment profile to a device group](https://docs.microsoft.com/en-us/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group), as optional reading.
|
||||
Profiles can only be assigned to Groups, so first you must create a group that contains the devices to which the profile should be applied. This guide will provide simple instructions to assign a profile, for more detailed instructions, see [Create an Autopilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an Autopilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group), as optional reading.
|
||||
|
||||
To create a Group, open the Azure Portal and select **Azure Active Directory** > **Groups** > **All groups**:
|
||||
|
||||
@ -564,7 +564,7 @@ Windows Autopilot will now take over to automatically join your device into Azur
|
||||
|
||||
## Remove devices from Autopilot
|
||||
|
||||
To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found [here](https://docs.microsoft.com/en-us/intune/enrollment-autopilot#create-an-autopilot-device-group) and [here](https://docs.microsoft.com/en-us/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below.
|
||||
To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it. Instructions for deregistering devices can be found [here](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [here](https://docs.microsoft.com/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below.
|
||||
|
||||
### Delete (deregister) Autopilot device
|
||||
|
||||
@ -758,7 +758,7 @@ In the app **Assignments** pane, select **Save**.
|
||||
|
||||
At this point, you have completed steps to add a Win32 app to Intune.
|
||||
|
||||
For more information on adding adds to Intune, see [Intune Standalone - Win32 app management](https://docs.microsoft.com/en-us/intune/apps-win32-app-management).
|
||||
For more information on adding adds to Intune, see [Intune Standalone - Win32 app management](https://docs.microsoft.com/intune/apps-win32-app-management).
|
||||
|
||||
### Add Office 365
|
||||
|
||||
@ -826,7 +826,7 @@ In the app **Assignments** pane, select **Save**.
|
||||
|
||||
At this point, you have completed steps to add Office to Intune.
|
||||
|
||||
For more information on adding Office apps to Intune, see [Assign Office 365 apps to Windows 10 devices with Microsoft Intune](https://docs.microsoft.com/en-us/intune/apps-add-office365).
|
||||
For more information on adding Office apps to Intune, see [Assign Office 365 apps to Windows 10 devices with Microsoft Intune](https://docs.microsoft.com/intune/apps-add-office365).
|
||||
|
||||
If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate:
|
||||
|
||||
|
||||
@ -1,76 +1,56 @@
|
||||
---
|
||||
title: Windows Autopilot Enrollment Status page
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
description: Gives an overview of the enrollment status page capabilities, configuration
|
||||
keywords: Autopilot Plug and Forget, Windows 10
|
||||
ms.prod: w10
|
||||
ms.technology: Windows
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
ms.localizationpriority: medium
|
||||
author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
|
||||
# Windows Autopilot Enrollment Status page
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10
|
||||
|
||||
The Windows Autopilot Enrollment Status Page displays the status of the complete device configuration process. Incorporating feedback from customers, this provides information to the user to show that the device is being configured. The Enrollment Status Page can be also configured to prevent access to the desktop until the configuration process is complete.
|
||||
|
||||
|
||||
|
||||
From Windows 10 version 1803 onwards, you can opt out of the account setup phase. If it is skipped, settings will be applied for users when they access their desktop for the first time.
|
||||
|
||||
## Available settings
|
||||
|
||||
The following settings can be configured to customize behavior of the enrollment status page:
|
||||
|
||||
<table>
|
||||
<th align="left">Setting<th align="left">Yes<th align="left">No
|
||||
<tr><td>Show app and profile installation progress<td>The enrollment status page is displayed.<td>The enrollment status page is not displayed.
|
||||
<tr><td>Block device use until all apps and profiles are installed<td>The settings in this table are made available to customize behavior of the enrollment status page, so that the user can address potential installation issues.
|
||||
<td>The enrollment status page is displayed with no additional options to address installation failures.
|
||||
<tr><td>Allow users to reset device if installation error occurs<td>A <b>Reset device</b> button is displayed if there is an installation failure.<td>The <b>Reset device</b> button is not displayed if there is an installation failure.
|
||||
<tr><td>Allow users to use device if installation error occurs<td>A <b>Continue anyway</b> button is displayed if there is an installation failure.<td>The <b>Continue anyway</b> button is not displayed if there is an installation failure.
|
||||
<tr><td>Show error when installation takes longer than specified number of minutes<td colspan="2">Specify the number of minutes to wait for installation to complete. A default value of 60 minutes is entered.
|
||||
<tr><td>Show custom message when an error occurs<td>A text box is provided where you can specify a custom message to display in case of an installation error.<td>The default message is displayed: <br><b>Oh no! Something didn't do what it was supposed to. Please contact your IT department.<b>
|
||||
<tr><td>Allow users to collect logs about installation errors<td>If there is an installation error, a <b>Collect logs</b> button is displayed. <br>If the user clicks this button they are asked to choose a location to save the log file <b>MDMDiagReport.cab</b><td>The <b>Collect logs</b> button is not displayed if there is an installation error.
|
||||
<tr><td>Block device use until these required apps are installed if they are assigned to the user/device<td colspan="2">Choose <b>All</b> or <b>Selected</b>. <br><br>If <b>Selected</b> is chosen, a <b>Select apps</b> button is displayed that enables you to choose which apps must be installed prior to enabling device use.
|
||||
</table>
|
||||
|
||||
See the following example:
|
||||
|
||||
|
||||
|
||||
## Installation progress tracking
|
||||
|
||||
The Enrollment Status page tracks a subset of the available MDM CSP policies that are delivered to the device as part of the complete device configuration process. The specific types of policies that are tracked include:
|
||||
|
||||
- Certain types of app installations.
|
||||
- Enterprise modern apps (Appx/MSIX) installed by the [Enterprise Modern App Managment CSP](https://docs.microsoft.com/windows/client-management/mdm/enterprisemodernappmanagement-csp).
|
||||
- Enterprise desktop apps (single-file MSIs) installed by the [Enterprise Desktop App Management CSP](https://docs.microsoft.com/windows/client-management/mdm/enterprisedesktopappmanagement-csp).
|
||||
- Certain device configuration policies.
|
||||
|
||||
The following types of policies and installations are not tracked:
|
||||
|
||||
- Intune Management Extensions PowerShell scripts
|
||||
- Office 365 ProPlus installations<sup>**</sup>
|
||||
- System Center Configuration Manager apps, packages, and task sequences
|
||||
|
||||
<sup>**</sup>The ability to track Office 365 ProPlus installations was added with Windows 10, version 1809.<br>
|
||||
|
||||
## More information
|
||||
|
||||
For more information on configuring the Enrollment Status page, see the [Microsoft Intune documentation](https://docs.microsoft.com/intune/windows-enrollment-status).<br>
|
||||
For details about the underlying implementation, see the [FirstSyncStatus details in the DMClient CSP documentation](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp).<br>
|
||||
For more information about blocking for app installation:
|
||||
- [Blocking for app installation using Enrollment Status Page](https://blogs.technet.microsoft.com/mniehaus/2018/12/06/blocking-for-app-installation-using-enrollment-status-page/).
|
||||
- [Support Tip: Office C2R installation is now tracked during ESP](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Office-C2R-installation-is-now-tracked-during-ESP/ba-p/295514).
|
||||
---
|
||||
title: Windows Autopilot Enrollment Status page
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
description: Gives an overview of the enrollment status page capabilities, configuration
|
||||
keywords: Autopilot Plug and Forget, Windows 10
|
||||
ms.prod: w10
|
||||
ms.technology: Windows
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
ms.localizationpriority: medium
|
||||
author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
|
||||
# Windows Autopilot Enrollment Status page
|
||||
|
||||
**Applies to**
|
||||
|
||||
- Windows 10, version 1803 and later
|
||||
|
||||
The Enrollment Status Page (ESP) displays the status of the complete device configuration process when an MDM managed user signs into a device for the very first time. The ESP will help users understand the progress of device provisioning and ensures the device has met the organizations desired state before the user can access the desktop for the first time.
|
||||
|
||||
The ESP will track the installation of applications, security policies, certificates and network connections. Within Intune, an administrator can deploy ESP profiles to a licensed Intune user and configure specific settings within the ESP profile; a few of these settings are: force the installation of specified applications, allow users to collect troubleshooting logs, specify what a user can do if device setup fails. For more information, see [how to setup the Enrollment Status Page in Intune.] (https://docs.microsoft.com/en-us/intune/windows-enrollment-status).
|
||||
|
||||
|
||||
|
||||
|
||||
## Installation progress tracking
|
||||
|
||||
The Enrollment Status page tracks a subset of the available MDM CSP policies that are delivered to the device as part of the complete device configuration process. The specific types of policies that are tracked include:
|
||||
|
||||
- Certain types of app installations.
|
||||
- Enterprise modern apps (Appx/MSIX) installed by the [Enterprise Modern App Managment CSP](https://docs.microsoft.com/windows/client-management/mdm/enterprisemodernappmanagement-csp).
|
||||
- Enterprise desktop apps (single-file MSIs) installed by the [Enterprise Desktop App Management CSP](https://docs.microsoft.com/windows/client-management/mdm/enterprisedesktopappmanagement-csp).
|
||||
- Certain device configuration policies.
|
||||
|
||||
The following types of policies and installations are not tracked:
|
||||
|
||||
- Intune Management Extensions PowerShell scripts
|
||||
- Office 365 ProPlus installations<sup>**</sup>
|
||||
- System Center Configuration Manager apps, packages, and task sequences
|
||||
|
||||
<sup>**</sup>The ability to track Office 365 ProPlus installations was added with Windows 10, version 1809.<br>
|
||||
|
||||
## More information
|
||||
|
||||
For more information on configuring the Enrollment Status Page, see the [Microsoft Intune documentation](https://docs.microsoft.com/intune/windows-enrollment-status).<br>
|
||||
For details about the underlying implementation, see the [FirstSyncStatus details in the DMClient CSP documentation](https://docs.microsoft.com/windows/client-management/mdm/dmclient-csp).<br>
|
||||
For more information about blocking for app installation:
|
||||
- [Blocking for app installation using Enrollment Status Page](https://blogs.technet.microsoft.com/mniehaus/2018/12/06/blocking-for-app-installation-using-enrollment-status-page/).
|
||||
- [Support Tip: Office C2R installation is now tracked during ESP](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Office-C2R-installation-is-now-tracked-during-ESP/ba-p/295514).
|
||||
|
||||
@ -303,7 +303,7 @@ The Task Sequence will download content, reboot, format the drives and install W
|
||||
|
||||
### Register the device for Windows Autopilot
|
||||
|
||||
Devices provisioned through Autopilot will only receive the guided OOBE Autopilot experience on first boot. Once updated to Windows 10, the device should be registered to ensure a continued Autopilot experience in the event of PC reset. You can enable automatic registration for an assigned group using the **Convert all targeted devices to Autopilot** setting. For more information, see [Create an Autopilot deployment profile](https://docs.microsoft.com/en-us/intune/enrollment-autopilot#create-an-autopilot-deployment-profile).
|
||||
Devices provisioned through Autopilot will only receive the guided OOBE Autopilot experience on first boot. Once updated to Windows 10, the device should be registered to ensure a continued Autopilot experience in the event of PC reset. You can enable automatic registration for an assigned group using the **Convert all targeted devices to Autopilot** setting. For more information, see [Create an Autopilot deployment profile](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-deployment-profile).
|
||||
|
||||
Also see [Adding devices to Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/add-devices).
|
||||
|
||||
|
||||
@ -45,7 +45,7 @@ This guide is intended for use by an IT-specialist, system architect, or busines
|
||||
|
||||
<table>
|
||||
<tr><td><a href="user-driven.md">User-driven mode</a><td>Requirements and validation steps for deploying a new Azure Active Directory (AAD) joined or hybrid AAD-joined Windows 10 device are provided.
|
||||
<tr><td><a href="self-deploying.md">Self-deploying mode</a><td>Requirements and validation steps for deploying a new Windows 10 device device with little to no user interaction are provided.
|
||||
<tr><td><a href="self-deploying.md">Self-deploying mode</a><td>Requirements and validation steps for deploying a new Windows 10 device with little to no user interaction are provided.
|
||||
<tr><td><a href="windows-autopilot-reset.md">Windows Autopilot Reset</a><td>Using Windows Autopilot Reset, a device can be restored to its original settings, taking it back to a business-ready state. Both local and remote reset scenarios are discussed.
|
||||
<tr><td><a href="white-glove.md">Windows Autopilot for white glove deployment</a><td>Requirements and procedures are described that enable additional policies and apps to be delivered to a Windows Autopilot device.
|
||||
<tr><td><a href="existing-devices.md">Support for existing devices</a><td>This topic describes how Windows Autopilot can be used to convert Windows 7 or Windows 8.1 domain-joined computers to AAD-joined computers running Windows 10.
|
||||
|
||||
@ -44,7 +44,7 @@ For a CSP to register Windows Autopilot devices on behalf of a customer, the cus
|
||||
|
||||
- Select the checkbox indicating whether or not you want delegated admin rights:
|
||||
|
||||
- NOTE: Depending on your partner, they might request Delegated Admin Permissions (DAP) when requesting this consent. You should ask them to use the newer DAP-free process (shown in this document) if possible. If not, you can easily remove their DAP status either from Microsoft Store for Business or the Office 365 admin portal: https://docs.microsoft.com/en-us/partner-center/customers_revoke_admin_privileges
|
||||
- NOTE: Depending on your partner, they might request Delegated Admin Permissions (DAP) when requesting this consent. You should ask them to use the newer DAP-free process (shown in this document) if possible. If not, you can easily remove their DAP status either from Microsoft Store for Business or the Office 365 admin portal: https://docs.microsoft.com/partner-center/customers_revoke_admin_privileges
|
||||
- Send the template above to the customer via email.
|
||||
2. Customer with global administrator privileges in Microsoft Store for Business (MSfB) clicks the link in the body of the email once they receive it from the CSP, which takes them directly to the following MSfB page:
|
||||
|
||||
|
||||
@ -1,71 +1,71 @@
|
||||
---
|
||||
title: Windows Autopilot Self-Deploying mode (Preview)
|
||||
description: Windows Autopilot deployment
|
||||
keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
|
||||
ms.reviewer: mniehaus
|
||||
manager: laurawi
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
|
||||
# Windows Autopilot Self-Deploying mode
|
||||
|
||||
**Applies to: Windows 10, version 1809 or later**
|
||||
|
||||
Windows Autopilot self-deploying mode enables a device to be deployed with little to no user interaction. For devices with an Ethernet connection, no user interaction is required; for devices connected via Wi-fi, no interaction is required after making the Wi-fi connection (choosing the language, locale, and keyboard, then making a network connection).
|
||||
|
||||
Self-deploying mode joins the device into Azure Active Directory, enrolls the device in Intune (or another MDM service) leveraging Azure AD for automatic MDM enrollment, and ensures that all policies, applications, certificates, and networking profiles are provisioned on the device, leveraging the enrollment status page to prevent access to the desktop until the device is fully provisioned.
|
||||
|
||||
>[!NOTE]
|
||||
>Self-deploying mode does not support Active Directory Join or Hybrid Azure AD Join. All devices will be joined to Azure Active Directory.
|
||||
|
||||
Self-deploying mode is designed to deploy Windows 10 as a kiosk, digital signage device, or a shared device. When setting up a kiosk, you can leverage the new Kiosk Browser, an app built on Microsoft Edge that can be used to create a tailored, MDM-managed browsing experience. When combined with MDM policies to create a local account and configure it to automatically log on, the complete configuration of the device can be automated. Find out more about these options by reading simplifying kiosk management for IT with Windows 10. See [Set up a kiosk or digital sign in Intune or other MDM service](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage#set-up-a-kiosk-or-digital-sign-in-intune-or-other-mdm-service) for additional details.
|
||||
|
||||
>[!NOTE]
|
||||
>Self-deploying mode does not presently associate a user with the device (since no user ID or password is specified as part of the process). As a result, some Azure AD and Intune capabilities (such as BitLocker recovery, installation of apps from the Company Portal, or Conditional Access) may not be available to a user that signs into the device.
|
||||
|
||||
|
||||
|
||||
## Requirements
|
||||
|
||||
Because self-deploying mode uses a device’s TPM 2.0 hardware to authenticate the device into an organization’s Azure AD tenant, devices without TPM 2.0 cannot be used with this mode. The devices must also support TPM device attestation. (All newly-manufactured Windows devices should meet these requirements.)
|
||||
|
||||
>[!NOTE]
|
||||
>If you attempt a self-deploying mode deployment on a device that does not have support TPM 2.0 or on a virtual machine, the process will fail when verifying the device with an 0x800705B4 timeout error. (Hyper-V virtual TPMs are not supported.)
|
||||
|
||||
In order to display an organization-specific logo and organization name during the Autopilot process, Azure Active Directory Company Branding needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details.
|
||||
|
||||
## Step by step
|
||||
|
||||
In order to perform a self-deploying mode deployment using Windows Autopilot, the following preparation steps need to be completed:
|
||||
|
||||
- Create an Autopilot profile for self-deploying mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. (Note that it is not possible to create a profile in the Microsoft Store for Business or Partner Center for self-deploying mode.)
|
||||
- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. Ensure that the profile has been assigned to the device before attempting to deploy that device.
|
||||
- Boot the device, connecting it to Wi-fi if required, then wait for the provisioning process to complete.
|
||||
|
||||
## Validation
|
||||
|
||||
When performing a self-deploying mode deployment using Windows Autopilot, the following end-user experience should be observed:
|
||||
|
||||
- Once connected to a network, the Autopilot profile will be downloaded.
|
||||
- If the Autopilot profile has been configured to automatically configure the language, locale, and keyboard layout, these OOBE screens should be skipped as long as Ethernet connectivity is available. Otherwise, manual steps are required:
|
||||
- If multiple languages are preinstalled in Windows 10, the user must pick a language.
|
||||
- The user must pick a locale and a keyboard layout, and optionally a second keyboard layout.
|
||||
- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network.
|
||||
- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required).
|
||||
- The device will join Azure Active Directory.
|
||||
- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services).
|
||||
- The [enrollment status page](enrollment-status.md) will be displayed.
|
||||
- Depending on the device settings deployed, the device will either:
|
||||
- Remain at the logon screen, where any member of the organization can log on by specifying their Azure AD credentials.
|
||||
- Automatically sign in as a local account, for devices configured as a kiosk or digital signage.
|
||||
|
||||
In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation.
|
||||
---
|
||||
title: Windows Autopilot Self-Deploying mode (Preview)
|
||||
description: Windows Autopilot deployment
|
||||
keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
|
||||
ms.reviewer: mniehaus
|
||||
manager: laurawi
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
|
||||
# Windows Autopilot Self-Deploying mode
|
||||
|
||||
**Applies to: Windows 10, version 1809 or later**
|
||||
|
||||
Windows Autopilot self-deploying mode enables a device to be deployed with little to no user interaction. For devices with an Ethernet connection, no user interaction is required; for devices connected via Wi-fi, no interaction is required after making the Wi-fi connection (choosing the language, locale, and keyboard, then making a network connection).
|
||||
|
||||
Self-deploying mode joins the device into Azure Active Directory, enrolls the device in Intune (or another MDM service) leveraging Azure AD for automatic MDM enrollment, and ensures that all policies, applications, certificates, and networking profiles are provisioned on the device, leveraging the enrollment status page to prevent access to the desktop until the device is fully provisioned.
|
||||
|
||||
>[!NOTE]
|
||||
>Self-deploying mode does not support Active Directory Join or Hybrid Azure AD Join. All devices will be joined to Azure Active Directory.
|
||||
|
||||
Self-deploying mode is designed to deploy Windows 10 as a kiosk, digital signage device, or a shared device. When setting up a kiosk, you can leverage the new Kiosk Browser, an app built on Microsoft Edge that can be used to create a tailored, MDM-managed browsing experience. When combined with MDM policies to create a local account and configure it to automatically log on, the complete configuration of the device can be automated. Find out more about these options by reading simplifying kiosk management for IT with Windows 10. See [Set up a kiosk or digital sign in Intune or other MDM service](https://docs.microsoft.com/windows/configuration/setup-kiosk-digital-signage#set-up-a-kiosk-or-digital-sign-in-intune-or-other-mdm-service) for additional details.
|
||||
|
||||
>[!NOTE]
|
||||
>Self-deploying mode does not presently associate a user with the device (since no user ID or password is specified as part of the process). As a result, some Azure AD and Intune capabilities (such as BitLocker recovery, installation of apps from the Company Portal, or Conditional Access) may not be available to a user that signs into the device.
|
||||
|
||||
|
||||
|
||||
## Requirements
|
||||
|
||||
Because self-deploying mode uses a device’s TPM 2.0 hardware to authenticate the device into an organization’s Azure AD tenant, devices without TPM 2.0 cannot be used with this mode. The devices must also support TPM device attestation. (All newly-manufactured Windows devices should meet these requirements.)
|
||||
|
||||
>[!NOTE]
|
||||
>If you attempt a self-deploying mode deployment on a device that does not have support TPM 2.0 or on a virtual machine, the process will fail when verifying the device with an 0x800705B4 timeout error. (Hyper-V virtual TPMs are not supported.)
|
||||
|
||||
In order to display an organization-specific logo and organization name during the Autopilot process, Azure Active Directory Company Branding needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details.
|
||||
|
||||
## Step by step
|
||||
|
||||
In order to perform a self-deploying mode deployment using Windows Autopilot, the following preparation steps need to be completed:
|
||||
|
||||
- Create an Autopilot profile for self-deploying mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. (Note that it is not possible to create a profile in the Microsoft Store for Business or Partner Center for self-deploying mode.)
|
||||
- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group. Ensure that the profile has been assigned to the device before attempting to deploy that device.
|
||||
- Boot the device, connecting it to Wi-fi if required, then wait for the provisioning process to complete.
|
||||
|
||||
## Validation
|
||||
|
||||
When performing a self-deploying mode deployment using Windows Autopilot, the following end-user experience should be observed:
|
||||
|
||||
- Once connected to a network, the Autopilot profile will be downloaded.
|
||||
- If the Autopilot profile has been configured to automatically configure the language, locale, and keyboard layout, these OOBE screens should be skipped as long as Ethernet connectivity is available. Otherwise, manual steps are required:
|
||||
- If multiple languages are preinstalled in Windows 10, the user must pick a language.
|
||||
- The user must pick a locale and a keyboard layout, and optionally a second keyboard layout.
|
||||
- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network.
|
||||
- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required).
|
||||
- The device will join Azure Active Directory.
|
||||
- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services).
|
||||
- The [enrollment status page](enrollment-status.md) will be displayed.
|
||||
- Depending on the device settings deployed, the device will either:
|
||||
- Remain at the logon screen, where any member of the organization can log on by specifying their Azure AD credentials.
|
||||
- Automatically sign in as a local account, for devices configured as a kiosk or digital signage.
|
||||
|
||||
In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation.
|
||||
|
||||
@ -1,99 +1,99 @@
|
||||
---
|
||||
title: Windows Autopilot User-Driven Mode
|
||||
description: Windows Autopilot deployment
|
||||
keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
|
||||
ms.reviewer: mniehaus
|
||||
manager: laurawi
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
|
||||
# Windows Autopilot user-driven mode
|
||||
|
||||
Windows Autopilot user-driven mode is designed to enable new Windows 10 devices to be transformed from their initial state, directly from the factory, into a ready-to-use state without requiring that IT personnel ever touch the device. The process is designed to be simple so that anyone can complete it, enabling devices to be shipped or distributed to the end user directly with simple instructions:
|
||||
|
||||
- Unbox the device, plug it in, and turn it on.
|
||||
- Choose a language, locale and keyboard.
|
||||
- Connect it to a wireless or wired network with internet access.
|
||||
- Specify your e-mail address and password for your organization account.
|
||||
|
||||
After completing those simple steps, the remainder of the process is completely automated, with the device being joined to the organization, enrolled in Intune (or another MDM service), and fully configured as defined by the organization. Any additional prompts during the Out-of-Box Experience (OOBE) can be supressed; see [Configuring Autopilot Profiles](profiles.md) for options that are available.
|
||||
|
||||
Today, Windows Autopilot user-driven mode supports joining devices to Azure Active Directory. Support for Hybrid Azure Active Directory Join (with devices joined to an on-premises Active Directory domain) will be available in a future Windows 10 release. See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options.
|
||||
|
||||
## Available user-driven modes
|
||||
|
||||
The following options are available for user-driven deployment:
|
||||
|
||||
- [Azure Active Directory join](#user-driven-mode-for-azure-active-directory-join) is available if devices do not need to be joined to an on-prem Active Directory domain.
|
||||
- [Hybrid Azure Active Directory join](#user-driven-mode-for-hybrid-azure-active-directory-join) is available for devices that must be joined to both Azure Active Directory and your on-prem Active Directory domain.
|
||||
|
||||
### User-driven mode for Azure Active Directory join
|
||||
|
||||
In order to perform a user-driven deployment using Windows Autopilot, the following preparation steps need to be completed:
|
||||
|
||||
- Ensure that the users who will be performing user-driven mode deployments are able to join devices to Azure Active Directory. See [Configure device settings](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal#configure-device-settings) in the Azure Active Directory documentation for more information.
|
||||
- Create an Autopilot profile for user-driven mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. With Microsoft Store for Business and Partner Center, user-driven mode is the default and does not need to be selected.
|
||||
- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group.
|
||||
|
||||
For each device that will be deployed using user-driven deployment, these additional steps are needed:
|
||||
|
||||
- Ensure that the device has been added to Windows Autopilot. This can be done automatically by an OEM or partner at the time the device is purchased, or it can be done through a manual harvesting process later. See [Adding devices to Windows Autopilot](add-devices.md) for more information.
|
||||
- Ensure an Autopilot profile has been assigned to the device:
|
||||
- If using Intune and Azure Active Directory dynamic device groups, this can be done automatically.
|
||||
- If using Intune and Azure Active Directory static device groups, manually add the device to the device group.
|
||||
- If using other methods (e.g. Microsoft Store for Business or Partner Center), manually assign an Autopilot profile to the device.
|
||||
|
||||
Also see the [Validation](#validation) section below.
|
||||
|
||||
### User-driven mode for hybrid Azure Active Directory join
|
||||
|
||||
Windows Autopilot requires that devices be Azure Active Directory joined. If you have an on-premises Active Directory environment and want to also join devices to your on-premises domain, you can accomplish this by configuring Autopilot devices to be [hybrid Azure Active Directory (AAD) joined](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan).
|
||||
|
||||
#### Requirements
|
||||
|
||||
To perform a user-driven hybrid AAD joined deployment using Windows Autopilot:
|
||||
|
||||
- A Windows Autopilot profile for user-driven mode must be created and
|
||||
- **Hybrid Azure AD joined** must be specified as the selected option under **Join to Azure AD as** in the Autopilot profile.
|
||||
- If using Intune, a device group in Azure Active Directory must exist with the Windows Autopilot profile assigned to that group.
|
||||
- The device must be running Windows 10, version 1809 or later.
|
||||
- The device must be able to access an Active Directory domain controller, so it must be connected to the organization's network (where it can resolve the DNS records for the AD domain and the AD domain controller, and communicate with the domain controller to authenticate the user).
|
||||
- The device must be able to access the Internet, following the [documented Windows Autopilot network requirements](windows-autopilot-requirements.md).
|
||||
- The Intune Connector for Active Directory must be installed.
|
||||
- Note: The Intune Connector will perform an on-prem AD join, therefore users do not need on-prem AD-join permission, assuming the Connector is [configured to perform this action](https://docs.microsoft.com/intune/windows-autopilot-hybrid#increase-the-computer-account-limit-in-the-organizational-unit) on the user's behalf.
|
||||
- If using Proxy, WPAD Proxy settings option must be enabled and configured.
|
||||
|
||||
**AAD device join**: The hybrid AAD join process uses the system context to perform device AAD join, therefore it is not affected by user based AAD join permission settings. In addition, all users are enabled to join devices to AAD by default.
|
||||
|
||||
#### Step by step instructions
|
||||
|
||||
See [Deploy hybrid Azure AD joined devices using Intune and Windows Autopilot](https://docs.microsoft.com/intune/windows-autopilot-hybrid).
|
||||
|
||||
Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic.
|
||||
|
||||
## Validation
|
||||
|
||||
When performing a user-driven deployment using Windows Autopilot, the following end-user experience should be observed:
|
||||
|
||||
- If multiple languages are preinstalled in Windows 10, the user must pick a language.
|
||||
- The user must pick a locale and a keyboard layout, and optionally a second keyboard layout.
|
||||
- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network.
|
||||
- Once connected to a network, the Autopilot profile will be downloaded.
|
||||
- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required).
|
||||
- The user will be prompted for Azure Active Directory credentials, with a customized user experience showing the Azure AD tenant name, logo, and sign-in text.
|
||||
- Once correct credentials have been entered, the device will join Azure Active Directory.
|
||||
- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services).
|
||||
- If configured, the [enrollment status page](enrollment-status.md) will be displayed.
|
||||
- Once the device configuration tasks have completed, the user will be signed into Windows 10 using the credentials they previously provided.
|
||||
- Once signed in, the enrollment status page will again be displayed for user-targeted configuration tasks.
|
||||
|
||||
In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation.
|
||||
---
|
||||
title: Windows Autopilot User-Driven Mode
|
||||
description: Windows Autopilot deployment
|
||||
keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
|
||||
ms.reviewer: mniehaus
|
||||
manager: laurawi
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
|
||||
# Windows Autopilot user-driven mode
|
||||
|
||||
Windows Autopilot user-driven mode is designed to enable new Windows 10 devices to be transformed from their initial state, directly from the factory, into a ready-to-use state without requiring that IT personnel ever touch the device. The process is designed to be simple so that anyone can complete it, enabling devices to be shipped or distributed to the end user directly with simple instructions:
|
||||
|
||||
- Unbox the device, plug it in, and turn it on.
|
||||
- Choose a language, locale and keyboard.
|
||||
- Connect it to a wireless or wired network with internet access.
|
||||
- Specify your e-mail address and password for your organization account.
|
||||
|
||||
After completing those simple steps, the remainder of the process is completely automated, with the device being joined to the organization, enrolled in Intune (or another MDM service), and fully configured as defined by the organization. Any additional prompts during the Out-of-Box Experience (OOBE) can be supressed; see [Configuring Autopilot Profiles](profiles.md) for options that are available.
|
||||
|
||||
Today, Windows Autopilot user-driven mode supports joining devices to Azure Active Directory. Support for Hybrid Azure Active Directory Join (with devices joined to an on-premises Active Directory domain) will be available in a future Windows 10 release. See [Introduction to device management in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/device-management-introduction) for more information about the differences between these two join options.
|
||||
|
||||
## Available user-driven modes
|
||||
|
||||
The following options are available for user-driven deployment:
|
||||
|
||||
- [Azure Active Directory join](#user-driven-mode-for-azure-active-directory-join) is available if devices do not need to be joined to an on-prem Active Directory domain.
|
||||
- [Hybrid Azure Active Directory join](#user-driven-mode-for-hybrid-azure-active-directory-join) is available for devices that must be joined to both Azure Active Directory and your on-prem Active Directory domain.
|
||||
|
||||
### User-driven mode for Azure Active Directory join
|
||||
|
||||
In order to perform a user-driven deployment using Windows Autopilot, the following preparation steps need to be completed:
|
||||
|
||||
- Ensure that the users who will be performing user-driven mode deployments are able to join devices to Azure Active Directory. See [Configure device settings](https://docs.microsoft.com/azure/active-directory/device-management-azure-portal#configure-device-settings) in the Azure Active Directory documentation for more information.
|
||||
- Create an Autopilot profile for user-driven mode with the desired settings. In Microsoft Intune, this mode is explicitly chosen when creating the profile. With Microsoft Store for Business and Partner Center, user-driven mode is the default and does not need to be selected.
|
||||
- If using Intune, create a device group in Azure Active Directory and assign the Autopilot profile to that group.
|
||||
|
||||
For each device that will be deployed using user-driven deployment, these additional steps are needed:
|
||||
|
||||
- Ensure that the device has been added to Windows Autopilot. This can be done automatically by an OEM or partner at the time the device is purchased, or it can be done through a manual harvesting process later. See [Adding devices to Windows Autopilot](add-devices.md) for more information.
|
||||
- Ensure an Autopilot profile has been assigned to the device:
|
||||
- If using Intune and Azure Active Directory dynamic device groups, this can be done automatically.
|
||||
- If using Intune and Azure Active Directory static device groups, manually add the device to the device group.
|
||||
- If using other methods (e.g. Microsoft Store for Business or Partner Center), manually assign an Autopilot profile to the device.
|
||||
|
||||
Also see the [Validation](#validation) section below.
|
||||
|
||||
### User-driven mode for hybrid Azure Active Directory join
|
||||
|
||||
Windows Autopilot requires that devices be Azure Active Directory joined. If you have an on-premises Active Directory environment and want to also join devices to your on-premises domain, you can accomplish this by configuring Autopilot devices to be [hybrid Azure Active Directory (AAD) joined](https://docs.microsoft.com/azure/active-directory/devices/hybrid-azuread-join-plan).
|
||||
|
||||
#### Requirements
|
||||
|
||||
To perform a user-driven hybrid AAD joined deployment using Windows Autopilot:
|
||||
|
||||
- A Windows Autopilot profile for user-driven mode must be created and
|
||||
- **Hybrid Azure AD joined** must be specified as the selected option under **Join to Azure AD as** in the Autopilot profile.
|
||||
- If using Intune, a device group in Azure Active Directory must exist with the Windows Autopilot profile assigned to that group.
|
||||
- The device must be running Windows 10, version 1809 or later.
|
||||
- The device must be able to access an Active Directory domain controller, so it must be connected to the organization's network (where it can resolve the DNS records for the AD domain and the AD domain controller, and communicate with the domain controller to authenticate the user).
|
||||
- The device must be able to access the Internet, following the [documented Windows Autopilot network requirements](windows-autopilot-requirements.md).
|
||||
- The Intune Connector for Active Directory must be installed.
|
||||
- Note: The Intune Connector will perform an on-prem AD join, therefore users do not need on-prem AD-join permission, assuming the Connector is [configured to perform this action](https://docs.microsoft.com/intune/windows-autopilot-hybrid#increase-the-computer-account-limit-in-the-organizational-unit) on the user's behalf.
|
||||
- If using Proxy, WPAD Proxy settings option must be enabled and configured.
|
||||
|
||||
**AAD device join**: The hybrid AAD join process uses the system context to perform device AAD join, therefore it is not affected by user based AAD join permission settings. In addition, all users are enabled to join devices to AAD by default.
|
||||
|
||||
#### Step by step instructions
|
||||
|
||||
See [Deploy hybrid Azure AD joined devices using Intune and Windows Autopilot](https://docs.microsoft.com/intune/windows-autopilot-hybrid).
|
||||
|
||||
Also see the **Validation** section in the [Windows Autopilot user-driven mode](user-driven.md) topic.
|
||||
|
||||
## Validation
|
||||
|
||||
When performing a user-driven deployment using Windows Autopilot, the following end-user experience should be observed:
|
||||
|
||||
- If multiple languages are preinstalled in Windows 10, the user must pick a language.
|
||||
- The user must pick a locale and a keyboard layout, and optionally a second keyboard layout.
|
||||
- If connected via Ethernet, no network prompt is expected. If no Ethernet connection is available and Wi-fi is built in, the user needs to connect to a wireless network.
|
||||
- Once connected to a network, the Autopilot profile will be downloaded.
|
||||
- Windows 10 will check for critical OOBE updates, and if any are available they will be automatically installed (rebooting if required).
|
||||
- The user will be prompted for Azure Active Directory credentials, with a customized user experience showing the Azure AD tenant name, logo, and sign-in text.
|
||||
- Once correct credentials have been entered, the device will join Azure Active Directory.
|
||||
- After joining Azure Active Directory, the device will enroll in Intune (or other configured MDM services).
|
||||
- If configured, the [enrollment status page](enrollment-status.md) will be displayed.
|
||||
- Once the device configuration tasks have completed, the user will be signed into Windows 10 using the credentials they previously provided.
|
||||
- Once signed in, the enrollment status page will again be displayed for user-targeted configuration tasks.
|
||||
|
||||
In case the observed results do not match these expectations, consult the [Windows Autopilot Troubleshooting](troubleshooting.md) documentation.
|
||||
|
||||
@ -1,122 +1,121 @@
|
||||
---
|
||||
title: Windows Autopilot requirements
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
description: Windows Autopilot deployment
|
||||
keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
|
||||
# Windows Autopilot requirements
|
||||
|
||||
**Applies to: Windows 10**
|
||||
|
||||
Windows Autopilot depends on specific capabilities available in Windows 10, Azure Active Directory, and MDM services such as Microsoft Intune. In order to use Windows Autopilot and leverage these capabilities, some requirements must be met.
|
||||
|
||||
**Note**: For a list of OEMs that currently support Windows Autopilot, see the Participant device manufacturers section at [Windows Autopilot](https://aka.ms/windowsautopilot).
|
||||
|
||||
## Software requirements
|
||||
|
||||
- Windows 10 version 1703 (semi-annual channel) or higher is required.
|
||||
- The following editions are supported:
|
||||
- Windows 10 Pro
|
||||
- Windows 10 Pro Education
|
||||
- Windows 10 Pro for Workstations
|
||||
- Windows 10 Enterprise
|
||||
- Windows 10 Education
|
||||
- Windows 10 Enterprise 2019 LTSC
|
||||
|
||||
## Networking requirements
|
||||
|
||||
Windows Autopilot depends on a variety of internet-based services. Access to these services must be provided for Autopilot to function properly. In the simplest case, enabling proper functionality can be achieved by ensuring the following:
|
||||
|
||||
- Ensure DNS name resolution for internet DNS names
|
||||
- Allow access to all hosts via port 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP)
|
||||
|
||||
In environments that have more restrictive Internet access, or for those that require authentication before internet access can be obtained, additional configuration may be required to whitelist access to the required services. For additional details about each of these services and their specific requirements, review the following details:
|
||||
|
||||
<table><th>Service<th>Information
|
||||
<tr><td><b>Windows Autopilot Deployment Service and Windows Activation<b><td>After a network connection is in place, each Windows 10 device will contact the Windows Autopilot Deployment Service. With Windows 10 builds 18204 and above, the following URLs are used:<br>
|
||||
<ul><li>https://ztd.dds.microsoft.com </li>
|
||||
<li>https://cs.dds.microsoft.com </li></ul>
|
||||
|
||||
For all supported Windows 10 releases, Windows Autopilot also uses Windows Activation services. See <a href="https://support.microsoft.com/help/921471/windows-activation-or-validation-fails-with-error-code-0x8004fe33">Windows activation or validation fails with error code 0x8004FE33</a> for details about problems that might occur when you connect to the Internet through a proxy server.
|
||||
<tr><td><b>Azure Active Directory<b><td>User credentials are validated by Azure Active Directory, and the device can also be joined to Azure Active Directory. See <a href="https://docs.microsoft.com/en-us/office365/enterprise/office-365-ip-web-service">Office 365 IP Address and URL Web service</a> for more information.
|
||||
<tr><td><b>Intune<b><td>Once authenticated, Azure Active Directory will trigger enrollment of the device into the Intune MDM service. See the following link for details about network communication requirements: <a href="https://docs.microsoft.com/intune/network-bandwidth-use#network-communication-requirements">Intune network configuration requirements and bandwidth</a>.
|
||||
<tr><td><b>Windows Update<b><td>During the OOBE process, as well as after the Windows 10 OS is fully configured, the Windows Update service is leveraged to retrieve needed updates. If there are problems connecting to Windows Update, see <a href="https://support.microsoft.com/help/818018/how-to-solve-connection-problems-concerning-windows-update-or-microsof">How to solve connection problems concerning Windows Update or Microsoft Update</a>.<br>
|
||||
|
||||
If Windows Update is inaccessible, the AutoPilot process will still continue but critical updates will not be available.
|
||||
|
||||
<tr><td><b>Delivery Optimization<b><td>When downloading Windows Updates, Microsoft Store apps and app updates, Office Updates and Intune Win32 Apps, the <a href="https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization">Delivery Optimization</a> service is contacted to enable peer-to-peer sharing of content so that only a few devices need to download it from the internet.<br>
|
||||
|
||||
If the Delivery Optimization Service is inaccessible, the AutoPilot process will still continue with Delivery Optimization downloads from the cloud (without peer-to-peer).
|
||||
|
||||
<tr><td><b>Network Time Protocol (NTP) Sync<b><td>When a Windows device starts up, it will talk to a network time server to ensure that the time on the device is accurate. Ensure that UDP port 123 to time.windows.com is accessible.
|
||||
<tr><td><b>Domain Name Services (DNS)<b><td>To resolve DNS names for all services, the device communicates with a DNS server, typically provided via DHCP. This DNS server must be able to resolve internet names.
|
||||
<tr><td><b>Diagnostics data<b><td>To enable Windows Analytics and related diagnostics capabilities, see <a href="https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization">Configure Windows diagnostic data in your organization</a>.<br>
|
||||
|
||||
If diagnostic data cannot be sent, the Autopilot process will still continue, but services that depend on diagnostic data, such as Windows Analytics, will not work.
|
||||
<tr><td><b>Network Connection Status Indicator (NCSI)<b><td>Windows must be able to tell that the device is able to access the internet. For more information, see <a href="https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1709-endpoints#network-connection-status-indicator-ncsi">Network Connection Status Indicator (NCSI)</a>.
|
||||
|
||||
<a href="http://www.msftconnecttest.com">www.msftconnecttest.com</a> must be resolvable via DNS and accessible via HTTP.
|
||||
<tr><td><b>Windows Notification Services (WNS)<b><td>This service is used to enable Windows to receive notifications from apps and services. See <a href="https://docs.microsoft.com/en-us/windows/privacy/manage-windows-1809-endpoints#microsoft-store">Microsoft Store</a> for more information.<br>
|
||||
|
||||
If the WNS services are not available, the Autopilot process will still continue without notifications.
|
||||
<tr><td><b>Microsoft Store, Microsoft Store for Business<b><td>Apps in the Microsoft Store can be pushed to the device, triggered via Intune (MDM). App updates and additional apps may also be needed when the user first logs in. For more information, see <a href="https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business">Prerequisites for Microsoft Store for Business and Education</a> (also includes Azure AD and Windows Notification Services).<br>
|
||||
|
||||
If the Microsoft Store is not accessible, the AutoPilot process will still continue without Microsoft Store apps.
|
||||
|
||||
<tr><td><b>Office 365<b><td>As part of the Intune device configuration, installation of Office 365 ProPlus may be required. For more information, see <a href="https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2">Office 365 URLs and IP address ranges</a> (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above).
|
||||
<tr><td><b>Certificate revocation lists (CRLs)<b><td>Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services. A full list of these is documented at <a href="https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2#bkmk_crl">Office 365 URLs and IP address ranges</a> and <a href="https://aka.ms/o365chains">Office 365 Certificate Chains</a>.
|
||||
</table>
|
||||
|
||||
## Licensing requirements
|
||||
|
||||
Windows Autopilot depends on specific capabilities available in Windows 10 and Azure Active Directory. It also requires an MDM service such as Microsoft Intune. These capabilities can be obtained through various editions and subscription programs:
|
||||
|
||||
To provide needed Azure Active Directory (automatic MDM enrollment and company branding features) and MDM functionality, one of the following is required:
|
||||
- [Microsoft 365 Business subscriptions](https://www.microsoft.com/en-us/microsoft-365/business)
|
||||
- [Microsoft 365 F1 subscriptions](https://www.microsoft.com/en-us/microsoft-365/enterprise/firstline)
|
||||
- [Microsoft 365 Academic A1, A3, or A5 subscriptions](https://www.microsoft.com/en-us/education/buy-license/microsoft365/default.aspx)
|
||||
- [Microsoft 365 Enterprise E3 or E5 subscriptions](https://www.microsoft.com/en-us/microsoft-365/enterprise), which include all Windows 10, Office 365, and EM+S features (Azure AD and Intune).
|
||||
- [Enterprise Mobility + Security E3 or E5 subscriptions](https://www.microsoft.com/en-us/cloud-platform/enterprise-mobility-security), which include all needed Azure AD and Intune features.
|
||||
- [Intune for Education subscriptions](https://docs.microsoft.com/en-us/intune-education/what-is-intune-for-education), which include all needed Azure AD and Intune features.
|
||||
- [Azure Active Directory Premium P1 or P2](https://azure.microsoft.com/en-us/services/active-directory/) and [Microsoft Intune subscriptions](https://www.microsoft.com/en-us/cloud-platform/microsoft-intune) (or an alternative MDM service).
|
||||
|
||||
Additionally, the following are also recommended (but not required):
|
||||
- [Office 365 ProPlus](https://www.microsoft.com/en-us/p/office-365-proplus/CFQ7TTC0K8R0), which can be deployed easily via Intune (or other MDM services).
|
||||
- [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation), to automatically step up devices from Windows 10 Pro to Windows 10 Enterprise.
|
||||
|
||||
## Configuration requirements
|
||||
|
||||
Before Windows Autopilot can be used, some configuration tasks are required to support the common Autopilot scenarios.
|
||||
|
||||
- Configure Azure Active Directory automatic enrollment. For Microsoft Intune, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment) for details. If using a different MDM service, contact the vendor for the specific URLs or configuration needed for those services.
|
||||
- Configure Azure Active Directory custom branding. In order to display an organization-specific logon page during the Autopilot process, Azure Active Directory needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details. Note that the "square logo" and "sign-in page text" are the key elements for Autopilot, as well as the Azure Active Directory tenant name (configured separately in the Azure AD tenant properties).
|
||||
- Enable [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation) if desired, in order to automatically step up from Windows 10 Pro to Windows 10 Enterprise.
|
||||
|
||||
Specific scenarios will then have additional requirements. Generally, there are two specific tasks:
|
||||
|
||||
- Device registration. Devices need to be added to Windows Autopilot to support most Windows Autopilot scenarios. See [Adding devices to Windows Autopilot](add-devices.md) for more details.
|
||||
- Profile configuration. Once devices have been added to Windows Autopilot, a profile of settings needs to be applied to each device. See [Configure Autopilot profiles](profiles.md) for details. Note that Microsoft Intune can automate this profile assignment; see [Create an AutoPilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an AutoPilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group) for more information.
|
||||
|
||||
See [Windows Autopilot Scenarios](windows-autopilot-scenarios.md) for additional details.
|
||||
|
||||
For a walkthrough for some of these and related steps, see this video:
|
||||
<br> <br>
|
||||
<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/KYVptkpsOqs" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe>
|
||||
|
||||
There are no additional hardware requirements to use Windows 10 Autopilot, beyond the [requirements to run Windows 10](https://www.microsoft.com/windows/windows-10-specifications).
|
||||
|
||||
## Related topics
|
||||
|
||||
[Configure Autopilot deployment](configure-autopilot.md)
|
||||
---
|
||||
title: Windows Autopilot requirements
|
||||
ms.reviewer:
|
||||
manager: laurawi
|
||||
description: Windows Autopilot deployment
|
||||
keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
|
||||
# Windows Autopilot requirements
|
||||
|
||||
**Applies to: Windows 10**
|
||||
|
||||
Windows Autopilot depends on specific capabilities available in Windows 10, Azure Active Directory, and MDM services such as Microsoft Intune. In order to use Windows Autopilot and leverage these capabilities, some requirements must be met.
|
||||
|
||||
**Note**: For a list of OEMs that currently support Windows Autopilot, see the Participant device manufacturers section at [Windows Autopilot](https://aka.ms/windowsautopilot).
|
||||
|
||||
## Software requirements
|
||||
|
||||
- Windows 10 version 1703 (semi-annual channel) or higher is required.
|
||||
- The following editions are supported:
|
||||
- Windows 10 Pro
|
||||
- Windows 10 Pro Education
|
||||
- Windows 10 Pro for Workstations
|
||||
- Windows 10 Enterprise
|
||||
- Windows 10 Education
|
||||
- Windows 10 Enterprise 2019 LTSC
|
||||
|
||||
## Networking requirements
|
||||
|
||||
Windows Autopilot depends on a variety of internet-based services. Access to these services must be provided for Autopilot to function properly. In the simplest case, enabling proper functionality can be achieved by ensuring the following:
|
||||
|
||||
- Ensure DNS name resolution for internet DNS names
|
||||
- Allow access to all hosts via port 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP)
|
||||
|
||||
In environments that have more restrictive Internet access, or for those that require authentication before internet access can be obtained, additional configuration may be required to whitelist access to the required services. For additional details about each of these services and their specific requirements, review the following details:
|
||||
|
||||
<table><th>Service<th>Information
|
||||
<tr><td><b>Windows Autopilot Deployment Service and Windows Activation<b><td>After a network connection is in place, each Windows 10 device will contact the Windows Autopilot Deployment Service. With Windows 10 builds 18204 and above, the following URLs are used: https://ztd.dds.microsoft.com, https://cs.dds.microsoft.com. <br>
|
||||
|
||||
For all supported Windows 10 releases, Windows Autopilot also uses Windows Activation services. See <a href="https://support.microsoft.com/help/921471/windows-activation-or-validation-fails-with-error-code-0x8004fe33">Windows activation or validation fails with error code 0x8004FE33</a> for details about problems that might occur when you connect to the Internet through a proxy server.
|
||||
<tr><td><b>Azure Active Directory<b><td>User credentials are validated by Azure Active Directory, and the device can also be joined to Azure Active Directory. See <a href="https://docs.microsoft.com/office365/enterprise/office-365-ip-web-service">Office 365 IP Address and URL Web service</a> for more information.
|
||||
<tr><td><b>Intune<b><td>Once authenticated, Azure Active Directory will trigger enrollment of the device into the Intune MDM service. See the following link for details about network communication requirements: <a href="https://docs.microsoft.com/intune/network-bandwidth-use#network-communication-requirements">Intune network configuration requirements and bandwidth</a>.
|
||||
<tr><td><b>Windows Update<b><td>During the OOBE process, as well as after the Windows 10 OS is fully configured, the Windows Update service is leveraged to retrieve needed updates. If there are problems connecting to Windows Update, see <a href="https://support.microsoft.com/help/818018/how-to-solve-connection-problems-concerning-windows-update-or-microsof">How to solve connection problems concerning Windows Update or Microsoft Update</a>.<br>
|
||||
|
||||
If Windows Update is inaccessible, the AutoPilot process will still continue but critical updates will not be available.
|
||||
|
||||
<tr><td><b>Delivery Optimization<b><td>When downloading Windows Updates, Microsoft Store apps and app updates, Office Updates and Intune Win32 Apps, the <a href="https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization">Delivery Optimization</a> service is contacted to enable peer-to-peer sharing of content so that only a few devices need to download it from the internet.<br>
|
||||
|
||||
If the Delivery Optimization Service is inaccessible, the AutoPilot process will still continue with Delivery Optimization downloads from the cloud (without peer-to-peer).
|
||||
|
||||
<tr><td><b>Network Time Protocol (NTP) Sync<b><td>When a Windows device starts up, it will talk to a network time server to ensure that the time on the device is accurate. Ensure that UDP port 123 to time.windows.com is accessible.
|
||||
<tr><td><b>Domain Name Services (DNS)<b><td>To resolve DNS names for all services, the device communicates with a DNS server, typically provided via DHCP. This DNS server must be able to resolve internet names.
|
||||
<tr><td><b>Diagnostics data<b><td>To enable Windows Analytics and related diagnostics capabilities, see <a href="https://docs.microsoft.com/windows/configuration/configure-windows-diagnostic-data-in-your-organization">Configure Windows diagnostic data in your organization</a>.<br>
|
||||
|
||||
If diagnostic data cannot be sent, the Autopilot process will still continue, but services that depend on diagnostic data, such as Windows Analytics, will not work.
|
||||
<tr><td><b>Network Connection Status Indicator (NCSI)<b><td>Windows must be able to tell that the device is able to access the internet. For more information, see <a href="https://docs.microsoft.com/windows/privacy/manage-windows-1709-endpoints#network-connection-status-indicator-ncsi">Network Connection Status Indicator (NCSI)</a>.
|
||||
|
||||
<a href="http://www.msftconnecttest.com">www.msftconnecttest.com</a> must be resolvable via DNS and accessible via HTTP.
|
||||
<tr><td><b>Windows Notification Services (WNS)<b><td>This service is used to enable Windows to receive notifications from apps and services. See <a href="https://docs.microsoft.com/windows/privacy/manage-windows-1809-endpoints#microsoft-store">Microsoft Store</a> for more information.<br>
|
||||
|
||||
If the WNS services are not available, the Autopilot process will still continue without notifications.
|
||||
<tr><td><b>Microsoft Store, Microsoft Store for Business<b><td>Apps in the Microsoft Store can be pushed to the device, triggered via Intune (MDM). App updates and additional apps may also be needed when the user first logs in. For more information, see <a href="https://docs.microsoft.com/microsoft-store/prerequisites-microsoft-store-for-business">Prerequisites for Microsoft Store for Business and Education</a> (also includes Azure AD and Windows Notification Services).<br>
|
||||
|
||||
If the Microsoft Store is not accessible, the AutoPilot process will still continue without Microsoft Store apps.
|
||||
|
||||
<tr><td><b>Office 365<b><td>As part of the Intune device configuration, installation of Office 365 ProPlus may be required. For more information, see <a href="https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2">Office 365 URLs and IP address ranges</a> (includes all Office services, DNS names, IP addresses; includes Azure AD and other services that may overlap with those listed above).
|
||||
<tr><td><b>Certificate revocation lists (CRLs)<b><td>Some of these services will also need to check certificate revocation lists (CRLs) for certificates used in the services. A full list of these is documented at <a href="https://support.office.com/en-us/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2#bkmk_crl">Office 365 URLs and IP address ranges</a> and <a href="https://aka.ms/o365chains">Office 365 Certificate Chains</a>.
|
||||
<tr><td><b>Hybrid AAD join<b><td>Hybrid AAD can be join, the machine should be on corporate network for hybrid AAD join to work. See details at <a href="https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven-hybrid">Windows Autopilot user-driven mode</a>
|
||||
</table>
|
||||
|
||||
## Licensing requirements
|
||||
|
||||
Windows Autopilot depends on specific capabilities available in Windows 10 and Azure Active Directory. It also requires an MDM service such as Microsoft Intune. These capabilities can be obtained through various editions and subscription programs:
|
||||
|
||||
To provide needed Azure Active Directory (automatic MDM enrollment and company branding features) and MDM functionality, one of the following is required:
|
||||
- [Microsoft 365 Business subscriptions](https://www.microsoft.com/en-us/microsoft-365/business)
|
||||
- [Microsoft 365 F1 subscriptions](https://www.microsoft.com/en-us/microsoft-365/enterprise/firstline)
|
||||
- [Microsoft 365 Academic A1, A3, or A5 subscriptions](https://www.microsoft.com/en-us/education/buy-license/microsoft365/default.aspx)
|
||||
- [Microsoft 365 Enterprise E3 or E5 subscriptions](https://www.microsoft.com/en-us/microsoft-365/enterprise), which include all Windows 10, Office 365, and EM+S features (Azure AD and Intune).
|
||||
- [Enterprise Mobility + Security E3 or E5 subscriptions](https://www.microsoft.com/en-us/cloud-platform/enterprise-mobility-security), which include all needed Azure AD and Intune features.
|
||||
- [Intune for Education subscriptions](https://docs.microsoft.com/intune-education/what-is-intune-for-education), which include all needed Azure AD and Intune features.
|
||||
- [Azure Active Directory Premium P1 or P2](https://azure.microsoft.com/services/active-directory/) and [Microsoft Intune subscriptions](https://www.microsoft.com/en-us/cloud-platform/microsoft-intune) (or an alternative MDM service).
|
||||
|
||||
Additionally, the following are also recommended (but not required):
|
||||
- [Office 365 ProPlus](https://www.microsoft.com/en-us/p/office-365-proplus/CFQ7TTC0K8R0), which can be deployed easily via Intune (or other MDM services).
|
||||
- [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation), to automatically step up devices from Windows 10 Pro to Windows 10 Enterprise.
|
||||
|
||||
## Configuration requirements
|
||||
|
||||
Before Windows Autopilot can be used, some configuration tasks are required to support the common Autopilot scenarios.
|
||||
|
||||
- Configure Azure Active Directory automatic enrollment. For Microsoft Intune, see [Enable Windows 10 automatic enrollment](https://docs.microsoft.com/intune/windows-enroll#enable-windows-10-automatic-enrollment) for details. If using a different MDM service, contact the vendor for the specific URLs or configuration needed for those services.
|
||||
- Configure Azure Active Directory custom branding. In order to display an organization-specific logon page during the Autopilot process, Azure Active Directory needs to be configured with the images and text that should be displayed. See [Quickstart: Add company branding to your sign-in page in Azure AD](https://docs.microsoft.com/azure/active-directory/fundamentals/customize-branding) for more details. Note that the "square logo" and "sign-in page text" are the key elements for Autopilot, as well as the Azure Active Directory tenant name (configured separately in the Azure AD tenant properties).
|
||||
- Enable [Windows Subscription Activation](https://docs.microsoft.com/windows/deployment/windows-10-enterprise-subscription-activation) if desired, in order to automatically step up from Windows 10 Pro to Windows 10 Enterprise.
|
||||
|
||||
Specific scenarios will then have additional requirements. Generally, there are two specific tasks:
|
||||
|
||||
- Device registration. Devices need to be added to Windows Autopilot to support most Windows Autopilot scenarios. See [Adding devices to Windows Autopilot](add-devices.md) for more details.
|
||||
- Profile configuration. Once devices have been added to Windows Autopilot, a profile of settings needs to be applied to each device. See [Configure Autopilot profiles](profiles.md) for details. Note that Microsoft Intune can automate this profile assignment; see [Create an AutoPilot device group](https://docs.microsoft.com/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Assign an AutoPilot deployment profile to a device group](https://docs.microsoft.com/intune/enrollment-autopilot#assign-an-autopilot-deployment-profile-to-a-device-group) for more information.
|
||||
|
||||
See [Windows Autopilot Scenarios](windows-autopilot-scenarios.md) for additional details.
|
||||
|
||||
For a walkthrough for some of these and related steps, see this video:
|
||||
<br> <br>
|
||||
<iframe width="560" height="315" src="https://www.youtube-nocookie.com/embed/KYVptkpsOqs" frameborder="0" allow="autoplay; encrypted-media" allowfullscreen></iframe>
|
||||
|
||||
There are no additional hardware requirements to use Windows 10 Autopilot, beyond the [requirements to run Windows 10](https://www.microsoft.com/windows/windows-10-specifications).
|
||||
|
||||
## Related topics
|
||||
|
||||
[Configure Autopilot deployment](configure-autopilot.md)
|
||||
|
||||
@ -48,7 +48,7 @@ Additional requirements and configuration details apply with each scenario; see
|
||||
|
||||
**Applies to: Windows 10, version 1709 and above**
|
||||
|
||||
The Intune Service Administrator role is required to perform this task. For more information, see [Add users and grant administrative permission to Intune](https://docs.microsoft.com/en-us/intune/users-add).
|
||||
The Intune Service Administrator role is required to perform this task. For more information, see [Add users and grant administrative permission to Intune](https://docs.microsoft.com/intune/users-add).
|
||||
|
||||
IT admins can perform a local Windows Autopilot Reset to quickly remove personal files, apps, and settings, and reset Windows 10 devices from the lock screen any time and apply original settings and management enrollment (Azure Active Directory and device management) so the devices are ready to use. With a local Autopilot Reset, devices are returned to a fully configured or known IT-approved state.
|
||||
|
||||
|
||||
@ -1,68 +1,68 @@
|
||||
---
|
||||
title: Windows Autopilot scenarios and capabilities
|
||||
description: Windows Autopilot deployment
|
||||
keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
|
||||
ms.reviewer: mniehaus
|
||||
manager: laurawi
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
|
||||
# Windows Autopilot scenarios and capabilities
|
||||
|
||||
**Applies to: Windows 10**
|
||||
|
||||
## Scenarios
|
||||
|
||||
Windows Autopilot includes support for a growing list of scenarios, designed to support common organization needs which can vary based on the type of organization and their progress moving to Windows 10 and [transitioning to modern management](https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management).
|
||||
|
||||
The following Windows Autopilot scenarios are described in this guide:
|
||||
|
||||
<table>
|
||||
<th>Scenario<th>More information
|
||||
<tr><td>Deploy devices that will be set up by a member of the organization and configured for that person<td>[Windows Autopilot user-driven mode](user-driven.md)
|
||||
<tr><td>Deploy devices that will be automatically configured for shared use, as a kiosk, or as a digital signage device.<td>[Windows Autopilot self-deploying mode](self-deploying.md)
|
||||
<tr><td>Re-deploy a device in a business-ready state.<td>[Windows Autopilot Reset](windows-autopilot-reset.md)
|
||||
<tr><td>Pre-provision a device with up-to-date applications, policies and settings.<td>[White glove](white-glove.md)
|
||||
<tr><td>Deploy Windows 10 on an existing Windows 7 or 8.1 device<td>[Windows Autopilot for existing devices](existing-devices.md)
|
||||
</table>
|
||||
|
||||
## Windows Autopilot capabilities
|
||||
|
||||
### Windows Autopilot is self-updating during OOBE
|
||||
|
||||
Starting with the Windows 10, version 1903, Autopilot functional and critical updates will begin downloading automatically during OOBE after a device gets connected to a network and the [critical driver and Windows zero-day patch (ZDP) updates](https://docs.microsoft.com/windows-hardware/customize/desktop/windows-updates-during-oobe) have completed. The user or IT admin cannot opt-out of these Autopilot updates; they are required for Windows Autopilot deployment to operate properly. Windows will alert the user that the device is checking for, downloading and installing the updates.
|
||||
|
||||
### Cortana voiceover and speech recognition during OOBE
|
||||
|
||||
In Windows 10, version 1903 and later Cortana voiceover and speech recognition during OOBE is DISABLED by default for all Windows 10 Pro, Education and Enterprise SKUs.
|
||||
|
||||
If desired, you can enable Cortana voiceover and speech recognition during OOBE by creating the following registry key. This key does not exist by default.
|
||||
|
||||
HKLM\Software\Microsoft\Windows\CurrentVersion\OOBE\EnableVoiceForAllEditions
|
||||
|
||||
The key value is a DWORD with **0** = disabled and **1** = enabled.
|
||||
|
||||
| Value | Description |
|
||||
| --- | --- |
|
||||
| 0 | Cortana voiceover is disabled |
|
||||
| 1 | Cortana voiceover is enabled |
|
||||
| No value | Device will fall back to default behavior of the edition |
|
||||
|
||||
To change this key value, use WCD tool to create as PPKG as documented [here](https://docs.microsoft.com/windows/configuration/wcd/wcd-oobe#nforce).
|
||||
|
||||
### Bitlocker encryption
|
||||
|
||||
With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. For more information, see [Setting the BitLocker encryption algorithm for Autopilot devices](bitlocker.md)
|
||||
|
||||
## Related topics
|
||||
|
||||
[Windows Autopilot: What's new](windows-autopilot-whats-new.md)
|
||||
---
|
||||
title: Windows Autopilot scenarios and capabilities
|
||||
description: Windows Autopilot deployment
|
||||
keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune
|
||||
ms.reviewer: mniehaus
|
||||
manager: laurawi
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
ms.sitesec: library
|
||||
ms.pagetype: deploy
|
||||
author: greg-lindsay
|
||||
ms.author: greglin
|
||||
ms.collection: M365-modern-desktop
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
|
||||
# Windows Autopilot scenarios and capabilities
|
||||
|
||||
**Applies to: Windows 10**
|
||||
|
||||
## Scenarios
|
||||
|
||||
Windows Autopilot includes support for a growing list of scenarios, designed to support common organization needs which can vary based on the type of organization and their progress moving to Windows 10 and [transitioning to modern management](https://docs.microsoft.com/windows/client-management/manage-windows-10-in-your-organization-modern-management).
|
||||
|
||||
The following Windows Autopilot scenarios are described in this guide:
|
||||
|
||||
<table>
|
||||
<th>Scenario<th>More information
|
||||
<tr><td>Deploy devices that will be set up by a member of the organization and configured for that person<td>[Windows Autopilot user-driven mode](user-driven.md)
|
||||
<tr><td>Deploy devices that will be automatically configured for shared use, as a kiosk, or as a digital signage device.<td>[Windows Autopilot self-deploying mode](self-deploying.md)
|
||||
<tr><td>Re-deploy a device in a business-ready state.<td>[Windows Autopilot Reset](windows-autopilot-reset.md)
|
||||
<tr><td>Pre-provision a device with up-to-date applications, policies and settings.<td>[White glove](white-glove.md)
|
||||
<tr><td>Deploy Windows 10 on an existing Windows 7 or 8.1 device<td>[Windows Autopilot for existing devices](existing-devices.md)
|
||||
</table>
|
||||
|
||||
## Windows Autopilot capabilities
|
||||
|
||||
### Windows Autopilot is self-updating during OOBE
|
||||
|
||||
Starting with the Windows 10, version 1903, Autopilot functional and critical updates will begin downloading automatically during OOBE after a device gets connected to a network and the [critical driver and Windows zero-day patch (ZDP) updates](https://docs.microsoft.com/windows-hardware/customize/desktop/windows-updates-during-oobe) have completed. The user or IT admin cannot opt-out of these Autopilot updates; they are required for Windows Autopilot deployment to operate properly. Windows will alert the user that the device is checking for, downloading and installing the updates.
|
||||
|
||||
### Cortana voiceover and speech recognition during OOBE
|
||||
|
||||
In Windows 10, version 1903 and later Cortana voiceover and speech recognition during OOBE is DISABLED by default for all Windows 10 Pro, Education and Enterprise SKUs.
|
||||
|
||||
If desired, you can enable Cortana voiceover and speech recognition during OOBE by creating the following registry key. This key does not exist by default.
|
||||
|
||||
HKLM\Software\Microsoft\Windows\CurrentVersion\OOBE\EnableVoiceForAllEditions
|
||||
|
||||
The key value is a DWORD with **0** = disabled and **1** = enabled.
|
||||
|
||||
| Value | Description |
|
||||
| --- | --- |
|
||||
| 0 | Cortana voiceover is disabled |
|
||||
| 1 | Cortana voiceover is enabled |
|
||||
| No value | Device will fall back to default behavior of the edition |
|
||||
|
||||
To change this key value, use WCD tool to create as PPKG as documented [here](https://docs.microsoft.com/windows/configuration/wcd/wcd-oobe#nforce).
|
||||
|
||||
### Bitlocker encryption
|
||||
|
||||
With Windows Autopilot, you can configure the BitLocker encryption settings to be applied before automatic encryption is started. For more information, see [Setting the BitLocker encryption algorithm for Autopilot devices](bitlocker.md)
|
||||
|
||||
## Related topics
|
||||
|
||||
[Windows Autopilot: What's new](windows-autopilot-whats-new.md)
|
||||
|
||||
@ -61,5 +61,5 @@ Windows 10 version 1703 or higher is required to use Windows Autopilot. See [Win
|
||||
|
||||
## Related topics
|
||||
|
||||
[Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/en-us/intune/enrollment-autopilot)<br>
|
||||
[Enroll Windows devices in Intune by using Windows Autopilot](https://docs.microsoft.com/intune/enrollment-autopilot)<br>
|
||||
[Windows Autopilot scenarios and capabilities](windows-autopilot-scenarios.md)
|
||||
Reference in New Issue
Block a user