Skip to content
Home » Articles » Deploying Windows 11 Images via Intune

Deploying Windows 11 Images via Intune

By Grant Sullivan (Lead Writer) | Senior Systems Engineer: Duncan Stewart | Service Desk Director: Caleb Patterson

SYSADMIN RUNBOOK & TECHNICAL SPECS
– Technical Objective: Step-by-step engineering deployment or troubleshooting fix
– Estimated Execution Time: 20 to 45 minutes
– Prerequisites & Minimum Licensing: PowerShell 7.x, Microsoft.Graph SDK, Entra ID P1 / Business Premium
– Testing Protocol: Sandbox tenant validation before production deployment
– Rollback Safety: Explicit rollback commands provided in Section 5

The Challenge of Manual Windows 11 Deployment

For many Canadian businesses, deploying new Windows 11 endpoints remains a surprisingly manual and time-consuming process. IT teams often resort to USB-based imaging, custom scripts, or even direct user configuration, leading to inconsistent security baselines, application drift, and a high volume of Tier-1 support tickets. Each new device represents a potential security gap and a drain on IT resources, directly impacting Mean Time to Resolve (MTTR) for new hardware requests. This operational friction is particularly acute in hybrid work environments where devices are rarely in a central office for physical imaging.

Microsoft Intune, when properly configured, transforms this chaotic process into a streamlined, zero-touch deployment. By leveraging Windows Autopilot and Win32 application packaging, organizations can deliver fully configured, compliant Windows 11 Enterprise devices directly to end-users with minimal IT intervention.

Prerequisites & Environment Checklist

Before proceeding, ensure your environment meets the following requirements:

  • Microsoft 365 Licensing:
    • Minimum: Microsoft 365 Business Premium
    • Recommended: Microsoft 365 E3 or E5 (for advanced security and compliance features)
    • Requirement: Entra ID P1 (included in Business Premium, E3, E5) for Autopilot and advanced device management.
  • Administrative Roles:
    • Intune Administrator
    • Entra ID Device Administrator
  • Tools & Modules:
    • PowerShell 7.x (or later)
    • Microsoft Graph PowerShell SDK (Install-Module Microsoft.Graph -Scope CurrentUser)
    • Win32 Content Prep Tool (download from Microsoft GitHub)
  • Network Connectivity: Devices must have internet access during Autopilot enrollment.

Step-by-Step Implementation: Zero-Touch Windows 11 Deployment

This guide focuses on preparing your Intune environment for a robust Windows 11 Enterprise deployment using Autopilot and custom Win32 app packaging.

1. Configure Windows Autopilot Deployment Profile

Autopilot profiles define the out-of-box experience (OOBE) for new devices.

  1. Navigate to Intune: Go to Microsoft Intune admin center.
  2. Enrollment Devices: Select Devices > Windows > Windows enrollment.
  3. Deployment Profiles: Under Windows Autopilot Deployment Program, select Deployment profiles > Create profile > Windows PC.
  4. Basics:
    • Name: Windows 11 Enterprise Standard Profile
    • Description: Standard Autopilot profile for Windows 11 Enterprise devices, user-driven, Entra ID joined.
  5. Out-of-box experience (OOBE) settings:
    • Deployment mode: User-Driven
    • Join to Entra ID as: Entra ID joined
    • Skip Entra ID setup: Hide (to ensure users sign in)
    • User account type: Standard (for least privilege)
    • Allow user to create local account: No
    • Pre-provision devices: Yes (for white glove pre-provisioning if desired)
    • Assignment: Assign to a dynamic device group (e.g., (device.devicePhysicalIDs -any _ -contains "[ZTDID]")).

2. Prepare and Upload Win32 Applications

For applications not available in the Microsoft Store, package them as Win32 apps. This example uses a custom PowerShell script as a placeholder for a Win32 app.

Step A: Create Your Application Content

For testing, create a simple PowerShell installation script Install-App.ps1:

# Install-App.ps1
Write-Host "Starting custom application installation..."
# Simulate installation of a critical LOB app
New-Item -Path "C:\Program Files\CustomApp" -ItemType Directory -Force
Set-Content -Path "C:\Program Files\CustomApp\app.log" -Value "Custom application installed successfully at $(Get-Date)"
Write-Host "Custom application installation complete."
Exit 0

Next, create an uninstallation script Uninstall-App.ps1:

# Uninstall-App.ps1
Write-Host "Starting custom application uninstallation..."
Remove-Item -Path "C:\Program Files\CustomApp" -Recurse -Force
Write-Host "Custom application uninstallation complete."
Exit 0

Step B: Package with Win32 Content Prep Tool

  1. Download IntuneWinAppUtil.exe from GitHub.
  2. Run IntuneWinAppUtil.exe specifying the source folder, setup script, and target output folder:
IntuneWinAppUtil.exe -c "C:\Source\CustomApp" -s Install-App.ps1 -o "C:\Output"

Step C: Upload and Deploy in Intune

  1. In Intune, navigate to Apps > Windows > Add.
  2. Select Windows app (Win32).
  3. Upload your .intunewin package file and configure app metadata (Name, Description, Publisher).
  4. Configure the Program execution parameters:
  5. Install command: powershell.exe -ExecutionPolicy Bypass -File Install-App.ps1
  6. Uninstall command: powershell.exe -ExecutionPolicy Bypass -File Uninstall-App.ps1
  7. Install behavior: System
  8. Device restart behavior: No specific action
  9. Configure OS architecture (x64) and minimum build requirement (Windows 10 2004 or later).
  10. Set detection rule to Manually configure detection rules using a File rule:
  11. Path: C:\Program Files\CustomApp
  12. File or folder: app.log
  13. Detection method: File or folder exists
  14. Assign the package to your target device group (e.g. All Autopilot Devices) as Required.

3. Create a Device Configuration Profile for Security Baselines

Ensure all deployed devices adhere to your organization’s security standards.

  1. Navigate to Intune: Go to Microsoft Intune admin center.
  2. Configuration Profiles: Select Devices > Windows > Configuration profiles > Create profile.
  3. Profile Type: Select Templates and then Security baseline.
  4. Baseline Selection: Choose Windows 10 and later - Security Baseline.
  5. Configuration Settings: Review and customize settings like BitLocker encryption, Defender antivirus, firewall rules, and password policies.
  6. Assignments: Assign to your target device group (e.g., All Autopilot Devices).

Verification & Functional Testing

To confirm successful deployment, provision a test device and monitor its enrollment.

  1. Enroll a Test Device:
    • Ensure a test device’s hardware hash is uploaded to Intune (Devices > Windows > Windows enrollment > Devices).
    • Perform an Autopilot enrollment on the test device.
  2. Monitor Deployment Status:
    • In Intune, go to Devices > Windows > Windows enrollment > Autopilot devices. Check the status of your test device.
    • Under Devices > Windows > All devices, click on your test device. Review Device configuration and App installation status to ensure all profiles and applications were applied successfully.
  3. On the Device:
    • Verify the custom application installation by checking for C:\Program Files\CustomApp\app.log.
    • Confirm security policies by checking Settings > Accounts > Access work or school > Info > Sync and reviewing applied policies.
    • Check Windows Security > Device performance & health for Defender status.

Common Troubleshooting Pitfalls & Rollback

Even with careful planning, issues can arise.

  • Autopilot Device Not Found: Ensure the hardware hash is correctly uploaded and associated with an Autopilot profile. Verify the device is not already Entra ID joined.
  • Application Installation Failures: Check the IntuneManagementExtension.log on the client device (C:\ProgramData\Microsoft\IntuneManagementExtension\Logs). This log provides detailed insights into Win32 app installation issues.
  • Profile Conflicts: If multiple configuration profiles target the same setting, conflicts can occur. Use the Device configuration > Per-setting status blade in Intune to identify and resolve conflicts.
  • Network Connectivity Issues: Autopilot requires consistent internet access. Proxy servers or restrictive firewalls can block enrollment.
  • User Account Type: If users are created as local administrators instead of standard users, review your Autopilot profile settings.

Rollback Safety

For Autopilot deployments, a direct “rollback” is less about command execution and more about re-evaluation and re-provisioning.

  1. Remove Device from Autopilot: In Intune, navigate to Devices > Windows > Windows enrollment > Devices. Select the problematic device and click Delete. This unregisters it from Autopilot.
  2. Remove Entra ID Record: In Entra ID admin center, go to Devices > All devices. Select the device and delete it.
  3. Local Wipe: If the device is accessible, perform a factory reset or reimage it locally.
  4. Re-upload Hash (if needed): Correct any configuration issues, then re-upload the device hash and re-assign the corrected Autopilot profile.

For Win32 applications, use the uninstall command defined in the application’s Intune configuration. This can be triggered by changing the assignment from Required to Uninstall for a specific group, or by removing the device from the assigned group.

# Example: Uninstall a Win32 app via Intune (conceptual, managed by Intune agent)
# This is NOT a direct PowerShell command for rollback, but how Intune handles uninstallation.
# To trigger uninstall, change the Intune assignment type for the application.

Sources & References

  • Microsoft Learn: What is Windows Autopilot?
  • Microsoft Learn: Win32 app management in Microsoft Intune
  • PowerShell Gallery: Microsoft.Graph module
  • GitHub: Microsoft Win32 Content Prep Tool
Tags:
Helpdesk.ca Assistant

Please enter your details to start chatting.

Hello! How can I help you today?