This setup is set for a Laptop which has not been imaged or sysprepped. I use it on W10/11 Pro editions of the OS.
Prepping the Machine
Plug the laptop in to the mains and plug an ethernet cable in that has internet access.
USB Drive
On a USB Drive Create a folder in the Root called Software.
In that Folder have the contents of an “ODT Installation” and also Install_Intune_Files.ps1, install_office.bat, restart.bat and Configuration.xml
Install_Intune_Files.ps1
Edit #1 There was an error in the code on section 4 which has been fixed by u/AnIdeal1st, thanks for your help there. I have also added a replacement for section 4, if you want the script to join azure without you authenticating. I have added what API settings need to be added for that in the script but hashed out. This was recommended by u/BackSapperr and can be seen in his reply here. You can see this under the first block of code as an alternative.
So it is now a team effort and thanks for all the suggestions.
function Show-Menu {
Clear-Host
Write-Host "=== Intune Integration Tool ==="
Write-Host "1. Section 1 - Install NuGet"
Write-Host "2. Section 2 - Windows Update"
Write-Host "3. Section 3 - Install Office"
Write-Host "4. Section 4 - Get Windows AutoPilot Info"
Write-Host "5. Section 5 - Run all"
Write-Host "6. Restart Machine"
}
function Execute-Section1 {
# Section 1 - Install NuGet
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Confirm:$false
}
function Execute-Section2 {
# Section 2 - Windows Update
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser -Force
Write-Host "Installing PSWindowsUpdate module..."
if (-not (Get-Module -Name PSWindowsUpdate -ErrorAction SilentlyContinue)) {
Install-Module PSWindowsUpdate -Force -Confirm:$false
}
Write-Host "Getting available Windows updates..."
Get-WindowsUpdate -Verbose -acceptall
Write-Host "Installing Windows updates..."
Install-WindowsUpdate -Verbose -acceptall
}
function Execute-Section3 {
# Section 3 - Install Office and Add to AutoPilot
Invoke-Expression -Command ".\install_office.bat"
}
function Execute-Section4 {
Write-Host "Setting New Enviromental path..."
$newPath = "C:\Program Files\WindowsPowerShell\Scripts"
$newPathWithExisting = "$newPath;$existingPath"
[Environment]::SetEnvironmentVariable("PATH", $newPathWithExisting, "Machine")
$env:PATH = $newPathWithExisting
# Set PSGallery as trusted...
Write-Host "Set PSGallery as trusted..."
Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
# Section 4 - Get Windows AutoPilot Info
Write-Host "Installing Get-WindowsAutoPilotInfo script..."
install-script get-windowsautopilotinfo
Write-Host "Running Get-WindowsAutoPilotInfo script online..."
Get-WindowsAutoPilotInfo.ps1 -Online
}
function Execute-Section5 {
Execute-Section1
Execute-Section2
Execute-Section3
Execute-Section4
Execute-Section6
}
function Execute-Section6 {
# Section 6 - Restart Machine
Restart-Computer
}
while ($true) {
Show-Menu
$choice = Read-Host "Enter your choice (1-6)"
switch ($choice) {
"1" {
Execute-Section1
}
"2" {
Execute-Section2
}
"3" {
Execute-Section3
}
"4" {
Execute-Section4
}
"5" {
Execute-Section5
}
"6" {
Write-Host "Exiting..."
break
}
default {
Write-Host "Invalid choice. Please enter a valid option (1-6)."
Read-Host -Prompt "Press Enter to continue..."
}
}
}
Alternative section 4 which auto enrolls in Intune
Execute-Section4 {
Write-Host "Setting New Enviromental path..."
$newPath = "C:\Program Files\WindowsPowerShell\Scripts"
$existingPath = (Get-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" ).GetValue('Path', '', 'DoNotExpandEnvironmentNames')
$newPathWithExisting = "$newPath;$existingPath"
[Environment]::SetEnvironmentVariable("PATH", $newPathWithExisting, "Machine")
# Set PSGallery as trusted...
Write-Host "Set PSGallery as trusted..."
Set-PSRepository -Name PSGallery -InstallationPolicy Trusted
# Section 4 - Get Windows AutoPilot Info
#Write-Host "Installing Get-WindowsAutoPilotInfo script..."
#install-script get-windowsautopilotinfo
#Write-Host "Running Get-WindowsAutoPilotInfo script online..."
#Get-WindowsAutoPilotInfo.ps1 -Online
#Variables
$TenantID = "xxxxxxxxxxxxxxxxxxxx"
$AppID = "xxxxxxxxxxxxxxxxxxxxxxx"
$AppSecret = "xxxxxxxxxxxxxxxxxxxxxxxxxx"
#API Permissions
#All Microsoft Graph
#Application
#DeviceManagementManagedDevices.ReadWrite.All
#DeviceManagementServiceConfig.ReadWrite.All
#Delegated
#User.Read
#RegisterDevice
Set-ExecutionPolicy Unrestricted -Force
Install-PackageProvider NuGet -Force -ErrorAction SilentlyContinue
Install-Script Get-WindowsAutoPilotInfo -Force
Get-WindowsAutoPilotInfo -Online -TenantId $TenantID -AppID $AppID -AppSecret $AppSecret
Install_Office.bat
setup.exe /configure Configuration.xml
Configuration.xml (this is configured to our setup, you will need to set whats best for you)
<Configuration ID="3506e8f3-ba41-4764-a767-79fe90edf9fc">
<Add OfficeClientEdition="64" Channel="Current">
<Product ID="O365BusinessRetail">
<Language ID="en-gb" />
<ExcludeApp ID="Groove" />
<ExcludeApp ID="Lync" />
</Product>
</Add>
<Updates Enabled="TRUE" />
<RemoveMSI />
<AppSettings>
<User Key="software\microsoft\office\16.0\excel\options" Name="defaultformat" Value="51" Type="REG_DWORD" App="excel16" Id="L_SaveExcelfilesas" />
<User Key="software\microsoft\office\16.0\powerpoint\options" Name="defaultformat" Value="27" Type="REG_DWORD" App="ppt16" Id="L_SavePowerPointfilesas" />
<User Key="software\microsoft\office\16.0\word\options" Name="defaultformat" Value="" Type="REG_SZ" App="word16" Id="L_SaveWordfilesas" />
</AppSettings>
</Configuration>
Insert the USB Drive in to the laptop.
PowerShell
Boot up the laptop to the first OOBE menu.
Open a CMD window by pressing Shift + F10. Depending on the machine you may have to press the Fn button too.
With the CMD window now open type in the word “PowerShell” and press enter.
In the PowerShell window navigate to the USB drive and then to the Software folder.
run the PowerShell script Install_Intune_Files.ps1
You will now see a menu with different options.
Section 1 NuGet is needed to run the Windows Updates
Section 2 Performs a windows update of the PC.
Section 3 Installs the Microsoft Office Suite
Section 4 Adds the files required to join the PC to Azure AD
Section 5 runs all of the above.
Section 6 doesn’t actually work!
Starting the Process
Press option 5 to start running all of the updates and installations. You will be prompted after the windows update has finished to restart the PC. Press N for no for the next part of the script to run.
Office will install and will then confirm with you that it has gone through successfully.
Finally after the Office suite is installed it will start the process of running Autopilot files and to join the device to AAD. You will be prompted to insert your o365 credentials, do this and allow it to complete. This adds the machine as a device in Microsoft Endpoint Manager.
Once the script comes to an end press “Control + C” to exit the menu, Type “Exit” to close PowerShell and to return to the CMD Line.
When at the command line type “Shutdown -R -T 0” to immediately restart the machine.
Restarting and Post Restart
After a restart the device usually goes through am automatic bios update (if there was one available for that device) and then boots to the login window with the branded logo’s. You need to wait 5-10 minutes for the machine to successfully add itself in to AAD before logging in.
Starting Autopilot
When at the login windows press the windows key on the keyboard 5 times. If this errors then you must wait longer for the machine to add itself to AAD or manually run the install of Autopilot again.
The window will change and you will be shown 3 options. Select “Windows Autopilot provisioning”. This will start Autopilot and will download settings, policies and some apps to the machine.
When finished you will be shown a green window and have the option to “Reseal” the OS. Reseal it and the device is now ready for the user.
Thats how I setup my intune devices. Obviously this is after intune and MEM has already been setup in the background. Hopefully this might make the setup slightly easier for someone else but also for someone to give me some tips.
The script still needs some work, currently I have to say No to a restart after OS updates and also click close on the o365 installation. I’ll tackle those as and when I get time!
