Fewer models, fewer faults
A short catalogue of standard models for each role means fewer drivers to test, fewer spares to hold and faster swaps. I treat any exception as a request with a business owner.
End user computing
End user computing, from the box to the desk
End user computing is every laptop, desktop, phone and virtual desktop people work on, and everything that keeps them working. This page shows how a device is planned, bought and built with Windows Autopilot instead of an image, then managed with Intune, secured in layers, updated in rings and supported. It also covers the move to Windows 11, Macs and phones, asset records and erasure that can be proved.
Lifecycle
Every device, from order to erasure
EUC (end user computing) covers the laptops, desktops, phones and virtual desktops people work on, and everything that keeps them working. I think of each device as moving round a loop, from the day it is planned to the day its data is erased. Every stage leaves a trace in one asset record, kept in the CMDB (configuration management database).
Swipe sideways to see the whole diagram.
- A device moving through its life
- Updates to its asset record
Each device goes round once, usually in three to five years. I plan the whole loop before the first order, because the cheapest time to decide how a laptop will be wiped is the day it is bought.
What each stage needs
| Stage | What I decide | What the record keeps |
|---|---|---|
| Plan | Standard models for each role, the Windows build, the support model and the refresh cycle | Hardware catalogue and role profiles |
| Buy | Supplier, warranty, and that the supplier registers every device for Autopilot | Order, serial number and hardware hash |
| Enrol | Join type and Autopilot profile, chosen by group tag | Autopilot and Intune device records |
| Configure | Policy, certificates and apps for each role, all from Intune | Assigned policies and app installs |
| Secure | Encryption, endpoint protection and compliance rules | Compliance state and recovery keys |
| Support | Who fixes what, remote help, spares and swaps | Tickets and repairs against the asset |
| Refresh | When to replace, from age, faults and Windows support dates | Age, warranty end and fault history |
| Dispose | Wipe, certified erasure and recycling | Erasure certificate and recycling record |
Zero touch is the goal
A new laptop should go from the supplier to the user without anyone in IT unboxing it. Everything after that, from policy to apps, arrives over the internet.
Plan the end at the start
Refresh and disposal cost less when they are planned. I agree the refresh cycle, the warranty length and the erasure standard when the devices are bought.
Imaging
From gold images to provisioning
For twenty years, a new PC meant wiping it and laying down a company image over the LAN (local area network). Most estates are moving to provisioning instead: keep the Windows build the supplier installed, and add the company layer from the cloud. I know both, so I can tell when each still fits.
Swipe sideways to see the whole diagram.
Gold image. I build one reference PC by hand, capture it and push it to each laptop from a WDS (Windows Deployment Services) server, booting over the network with PXE (Preboot Execution Environment). It is quick on the LAN, but every model needs its own image, and every image is out of date within a month.
Task sequence. Configuration Manager lays down a thin base image, then adds drivers, apps and settings in order, from a distribution point near the device. One sequence serves every model. It still needs the office network or a VPN (virtual private network), and servers to run it.
Autopilot. The laptop keeps the Windows build the supplier installed. At first sign in it joins Entra ID, enrols in Intune and pulls its policy and apps over any internet connection. Nothing is rebuilt, so the device can ship from the supplier straight to the user.
The tools, and where they stand
| Tool | How it works | Where it stands (checked October 2026) |
|---|---|---|
| WDS | Boots a device over the network with PXE and deploys a captured image | Deploying Windows 11 from the boot.wim on installation media is blocked. Microsoft deprecates the WDS role, PXE included, in the Windows Server release after Windows Server 2025. |
| MDT (Microsoft Deployment Toolkit) | Free task sequences, often started from WDS or USB (Universal Serial Bus) media | Deprecation announced in December 2024, then retired in January 2026. No fixes, updates or support. |
| Configuration Manager | OSD (operating system deployment) task sequences from distribution points, with driver packages per model | Supported. Microsoft's route where imaging is still needed, beside Autopilot. |
| Windows Autopilot | Keeps the supplier build and provisions it from Intune | Microsoft's recommended path for new Windows devices. |
| Autopilot device preparation | A newer Autopilot flow that needs no device registration | Entra join only. Needs Windows 11 24H2 or later, or 23H2 and 22H2 with update KB5035942 or later. |
Sources: Microsoft Learn pages on WDS boot.wim support and Autopilot device preparation, and reporting of the MDT retirement. I recheck these before each project.
When I still use a task sequence
Thin links at the build site
Pulling every app over a slow link takes a long time. A local distribution point can be faster, and peer caching on the LAN helps Autopilot too.
Estates still on the domain
Where devices must stay domain joined for now, Configuration Manager task sequences and co management keep working while workloads move to Intune.
A clean start
A wipe and reload is still the cleanest reset after malware or a failed upgrade. With Autopilot, a remote wipe followed by provisioning does the same job without an image.
Autopilot
Windows Autopilot, from box to desk
Windows Autopilot turns a new laptop into a managed one during the Windows welcome screen. The device is registered to the company when it is bought, so the first time it connects it knows who owns it. This is how a laptop can ship from the supplier to someone's home and be ready without anyone in IT touching it.
Swipe sideways to see the whole diagram.
The laptop starts at the Windows welcome screen, the OOBE (out of box experience). Once it has a network, it sends its hardware hash to the Windows Autopilot deployment service. The supplier registered that hash to the company, so the service returns the company's profile and branding.
The user signs in with their work account and MFA (multi factor authentication). The device joins Microsoft Entra ID, Microsoft's cloud directory. There is no local account to create and no domain controller to reach.
Entra ID points the device at Intune, the MDM (mobile device management) service, and it enrols. From now on Intune can send policy, certificates and apps, and read back the state of the device.
The Enrollment Status Page holds the user while device settings arrive: certificates, Wi-Fi and VPN profiles, security policy and the apps every laptop needs. If this takes longer than the timeout, 60 minutes by default, it shows an error.
Next come the things that belong to this user: their apps, settings and OneDrive folders. I keep the list of blocking apps short, so the user reaches a desktop quickly and everything else installs in the background.
The desktop appears. The laptop reports its compliance to Intune, and Intune passes it to Entra ID, so Conditional Access can let it reach email and files. Nobody in IT touched the device.
The modes
| Mode | What happens | Join | Needs |
|---|---|---|---|
| User driven | The user signs in during setup and the device builds itself around them | Entra join or hybrid join | Registration. Hybrid join adds the Intune Connector for Active Directory and line of sight to a domain controller. |
| Pre provisioned | A technician or partner runs the device phase first, then reseals it, so the user only waits for their own apps | Entra join or hybrid join | Registration, and a physical device with TPM (Trusted Platform Module) 2.0 attestation. Virtual machines are not supported. |
| Self deploying | No user at all. The device enrols itself, for kiosks, meeting rooms and shared devices | Entra join only | Registration, TPM 2.0 attestation and a physical device |
| Existing devices | A Configuration Manager task sequence installs Windows with an Autopilot profile, so older devices can join the new process | As the profile sets | Configuration Manager |
| Device preparation, user driven | The newer flow. I pick the apps and scripts for each group, and no hardware hash is needed | Entra join only | Windows 11 24H2 or later, or an updated 23H2 or 22H2. Up to 25 apps and 10 scripts during setup. |
| Device preparation, automatic | Provisions Windows 365 Cloud PCs | Entra join | Windows 365 |
Microsoft recommends Entra join for new devices and does not recommend hybrid join for them, through Autopilot or otherwise. Hybrid join needs a domain controller during setup, which a laptop at someone's home cannot reach without a VPN set up first.
Registering devices
Autopilot only recognises a device whose hardware hash it holds. The best route is the supplier or reseller registering each device when it is sold, through Microsoft Partner Center. For tests, or for devices already in the estate, I collect the hash myself and import a CSV (comma separated values) file into Intune, up to 500 devices per file. A group tag in that file can steer each device to the right profile.
# During setup, press Shift+F10, type powershell, then:
Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo -Online
# Or save the hash to a file for import into Intune:
Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv
# Columns: Device Serial Number, Windows Product ID, Hardware Hash, Group Tag, Assigned UserWhich Autopilot path fits this device?
Answer five questions. The answer changes as you do.
User driven mode, with Entra join. The standard path for a laptop with one user. The supplier registers it, and the user builds it by signing in.
- Needs
- The device registered with Autopilot and assigned a profile, an Intune licence for the user, and internet access during setup.
- Watch
- Keep the blocking apps on the Enrollment Status Page to the few the user needs on day one.
The quick rules
| Situation | The path I choose |
|---|---|
| A laptop for one person, registered by the supplier | User driven, Entra join |
| The same, but the user should wait as little as possible | Pre provisioned, by IT or the supplier |
| A kiosk, meeting room or shared shop floor device | Self deploying, Entra join |
| A device that must stay on the domain for now | User driven with hybrid join, as a step towards Entra join |
| A new Windows 11 device that cannot be registered | Autopilot device preparation |
| A Windows 365 Cloud PC | Device preparation, automatic mode |
Intune
Intune, and co management on the way there
Intune is Microsoft's cloud service for managing devices and apps. Many estates still run Configuration Manager, often called SCCM (System Center Configuration Manager) after its old name. Co management lets both run on the same Windows device and moves control to Intune one workload at a time, so nothing breaks in a single big switch.
Swipe sideways to see the whole diagram.
Day one. With co management switched on, each Windows device runs the Configuration Manager client and is also enrolled in Intune. Every workload still belongs to Configuration Manager, so nothing changes for users yet.
Pilot. Compliance and Windows Update policies move to Intune for a pilot collection only. Compliance goes first because Conditional Access depends on it. I compare the pilot with the rest of the estate before going further.
Move. Each workload moves for everyone once its pilot is clean. Device configuration and Microsoft 365 Apps are in pilot here. Client apps stay with Configuration Manager until every app has an Intune package.
Cloud only. All six workloads belong to Intune. Once nothing depends on it, the Configuration Manager client can be removed and new devices go straight to Autopilot. A seventh workload, resource access, no longer exists: recent releases hand it to Intune.
What Intune is made of
| Building block | What it does | How I use it |
|---|---|---|
| Compliance policies | Rules a device must meet: encryption on, a minimum Windows build, firewall and antivirus running | Feeds Conditional Access, so only healthy devices reach company data |
| Configuration profiles and the settings catalog | Device settings, Wi-Fi, VPN and certificate profiles | Replaces most Group Policy, one profile per purpose |
| Apps | Win32, MSIX, Microsoft 365 Apps and Store apps, required or available | Required apps install during setup. The rest sit in Company Portal. |
| Scripts and remediations | PowerShell that detects drift and fixes it on a schedule | Small fixes the service desk would otherwise do by hand |
| Update rings and Autopatch | Windows quality and feature updates, released in waves | See the updates section below |
| Endpoint security | Antivirus, disk encryption, firewall, attack surface reduction and account protection | Security baselines first, then exceptions with an owner |
| Enrolment restrictions | Which platforms may enrol, and how many devices each user may have | Blocks personal Windows PCs where policy says so |
Three compliance settings I always change or check
- No policy assigned
- Devices with no compliance policy count as compliant by default. I set this to not compliant, so Conditional Access only trusts devices that have been checked.
- Validity period
- 30 days by default, from 1 to 120. A device that stops reporting for longer is marked noncompliant.
- Noncompliance
- Every policy marks a failing device noncompliant. For rules users can fix, I add a grace period and an email, and keep remote lock or retire for devices that stay out of line.
Identity
Identity on the device, and who gets in
A managed laptop is only half the picture. The other half is the identity on it. Microsoft Entra ID is the directory that signs people in and joins devices. Through Conditional Access, it also decides whether a sign in gets a token at all.
Swipe sideways to see the whole diagram.
The user opens Outlook on a work laptop. Outlook asks Microsoft Entra ID for a token to reach Exchange Online. Before Entra ID issues one, Conditional Access checks the request against every policy that applies to this user and this app.
Conditional Access gathers signals: who the user is and their groups, and whether Intune says the device is compliant. It adds where the request comes from, which client app is asking, and the sign in and user risk from Entra ID Protection.
Every policy that matches the user and the app applies, and all of them must be met. A typical set: MFA for everyone, a compliant or hybrid joined device for email and files, and a block on legacy authentication, which cannot do MFA.
This laptop is compliant and the user has passed MFA, so Entra ID issues the token and email opens. The device's PRT (primary refresh token) then gives single sign on to the other apps, with no more prompts.
The same user on a home PC fails the device check, so access is blocked. A softer policy can allow browser access with downloads blocked instead. I start every new policy in report only mode and read the sign in logs before I switch it on.
How a device joins, and how to tell
| Join type | What it means | dsregcmd /status shows | When I use it |
|---|---|---|---|
| Entra joined | The device belongs to Entra ID only, and people sign in with work accounts | AzureAdJoined YES, DomainJoined NO | New and reset devices, by default |
| Entra hybrid joined | Joined to on premises Active Directory and registered in Entra ID | AzureAdJoined YES, DomainJoined YES | Existing domain estates, as a step rather than the goal |
| Domain joined only | Active Directory only, with no cloud identity for the device | AzureAdJoined NO, DomainJoined YES | Legacy, and devices that never reach the cloud |
| Entra registered | A personal device with a work account added | WorkplaceJoined YES, in the user state section | Personal devices with app protection |
Windows Hello for Business
Replaces the password with a PIN or a biometric tied to the device's TPM, so a stolen password is not enough on its own. For hybrid estates, cloud Kerberos trust is the simplest model, because it needs no certificates on each device.
Local administrator passwords
Windows LAPS (Local Administrator Password Solution) is built into Windows since the April 2023 updates. It gives every device its own local administrator password, rotates it, and backs it up to Entra ID or Active Directory, never both.
Emergency access
Two cloud only emergency accounts, excluded from Conditional Access and watched closely, mean a mistake in a policy can never lock every administrator out.
Security
Laptop security in layers
I build laptop security in layers, so one failure does not lose the device or its data. The layers run from UEFI (Unified Extensible Firmware Interface) firmware at the bottom to EDR (endpoint detection and response) at the top. Intune policy sets each one, compliance checks it, and each stops a different kind of attack.
Swipe sideways to see the whole diagram.
Firmware and boot. UEFI Secure Boot only starts a boot loader signed by a trusted key, and the TPM records what started. A bootkit that changes the boot chain is refused, and BitLocker notices the change and asks for its recovery key.
Disk. BitLocker encrypts the whole disk, with its key sealed in the TPM, so a lost laptop is a hardware cost and not a data breach. Intune stores every recovery key in Entra ID, so the service desk can recover a device without anyone writing keys down.
Windows. A security baseline sets hundreds of settings at once. Attack surface reduction rules stop Office apps from starting child processes, which is the usual trick of a malicious macro. The firewall stays on for every network profile.
Identity. Windows Hello for Business replaces the password with a PIN or biometric tied to the TPM, so a phished password does not sign in on its own. Windows LAPS gives every device its own local administrator password and rotates it.
Detect and respond. Some attacks get past every barrier. Defender for Endpoint watches behaviour, such as one process encrypting thousands of files, and can isolate the laptop from the network while it stays connected to the security team.
Cyber Essentials, mapped to device policy
| Cyber Essentials control | What it asks of a device | Where I set it |
|---|---|---|
| Firewalls | A firewall on every device in scope, blocking unauthenticated inbound connections | Intune endpoint security firewall policy |
| Secure configuration | A PIN, password or biometric to get into the device. At least 6 characters where that is all it is used for. No more than 10 guesses in 5 minutes, or lock after 10 failures. Auto run off. | Settings catalog and Windows Hello for Business |
| Security update management | Licensed and supported software only. Critical and high risk updates, or CVSS (Common Vulnerability Scoring System) 7 and above, within 14 days. | Update rings or Autopatch, and app update policy |
| User access control | Unique accounts, separate administrator accounts, and MFA for every cloud service | Entra ID, Conditional Access and Windows LAPS |
| Malware protection | Anti malware software, or application allow listing | Defender Antivirus policy, or App Control for Business |
From the Cyber Essentials Requirements for IT Infrastructure, version 3.3, in force from 27 April 2026. Missing the 14 day update rule or MFA on a cloud service is now an automatic fail.
The NCSC (National Cyber Security Centre) device security guidance goes further, platform by platform, from choosing devices to erasing them. I use it as the checklist for a new build standard.
Updates
Updates in rings, never all at once
Updates are where a laptop estate stays safe or falls behind. Windows releases security updates on the second Tuesday of each month and one feature update a year. I release both in rings, so a bad update reaches a few IT devices first and never the whole company at once.
Swipe sideways to see the whole diagram.
- Deferral: not yet offered
- Deadline: install by then
- Grace period before a forced restart
Example values. If the Test or Ring 1 devices show failed installs, crashes or a spike in calls, I pause the release before it reaches Ring 2. Autopatch keeps the Test and Last rings in every group, and allows up to 15 rings.
The settings behind a ring
| Intune update ring setting | Range | What it does |
|---|---|---|
| Quality update deferral | 0 to 30 days | How long after release the ring is offered the monthly security update |
| Feature update deferral | 0 to 365 days | Holds back the annual Windows version. I prefer a feature update policy that pins the version. |
| Deadline for quality and feature updates | 2 to 30 days | After the deadline the device installs and restarts on its own |
| Grace period | 0 to 7 days | Extra time after a deadline before a forced restart, for devices that were switched off |
Microsoft renamed Windows Update for Business to Windows Update client policies in April 2025. The settings did not change.
How long each Windows 11 version is supported
| Windows 11 version | Released | Enterprise and Education support ends | Home and Pro support ends |
|---|---|---|---|
| 25H2 | 30 September 2025 | 10 October 2028 | 12 October 2027 |
| 24H2 | 1 October 2024 | 12 October 2027 | Ended |
| 23H2 | 31 October 2023 | 10 November 2026 | Ended |
One feature update a year, in the second half of the year. Enterprise and Education editions get 36 months of updates, Home and Pro 24 months. Dates from Microsoft's Windows 11 release information.
23H2 Enterprise devices lose updates on 10 November 2026, so any still on it need a feature update policy now. Cyber Essentials expects critical and high risk fixes within 14 days, which a two week ring plan like the one above meets.
Windows 11
Windows 10 to Windows 11, a hardware project too
Windows 10 reached end of support on 14 October 2025. Devices still on it only get security fixes through the paid ESU (Extended Security Updates) programme. The move to Windows 11 is as much a hardware project as a software one, because older processors cannot run it and many TPMs and Secure Boot settings were never switched on.
Swipe sideways to see the whole diagram.
I start with an inventory from Intune or Configuration Manager: model, processor, TPM, firmware mode, disk layout and owner. Here, 1,000 laptops on Windows 10. Older processors are the usual blocker, because the list of supported processors is fixed.
Each device is checked against the requirements. Most are ready. Some only need a firmware change: the TPM switched on, Secure Boot enabled, or the disk converted from the old MBR (master boot record) layout with Microsoft's MBR2GPT tool. The rest need replacing.
I test the top applications, by number of users and by business impact, on Windows 11, and bring firmware and drivers up to date with the supplier's tools. An app that fails gets a fix, an update or a virtual desktop.
A pilot ring, IT first and then volunteers from each department, upgrades in place through an Intune feature update policy. Apps and data stay where they are. I watch for failed upgrades, rollbacks and calls to the service desk.
The ready devices upgrade in waves by department, then the fixed ones once their firmware changes are in. Each wave goes only when the one before is quiet.
Devices that cannot run Windows 11 are replaced with new ones through Autopilot. The old ones are erased to a recorded standard and recycled. Any that cannot move in time are covered by ESU until they do.
The Windows 11 minimum
| Requirement | Minimum |
|---|---|
| Processor | 1 GHz or faster, two or more cores, on Microsoft's list of supported processors |
| Memory | 4 GB |
| Storage | 64 GB or more |
| Firmware | UEFI, with Secure Boot |
| TPM | Version 2.0 |
| Graphics | DirectX 12 with a WDDM (Windows Display Driver Model) 2.0 driver |
| Display | High definition (720p), larger than 9 inches, 8 bits per colour channel |
ESU for Windows 10, for organisations
| ESU year | Covers until | Price per device |
|---|---|---|
| Year 1 | 13 October 2026 (now ended) | $61 |
| Year 2 | 12 October 2027 | $122 |
| Year 3 | October 2028, the last year | $244 |
Commercial list prices in US dollars, indicative. The years are cumulative, so a device joining late pays for the years it missed. Windows 10 on Azure Virtual Desktop gets ESU at no extra cost.
Three routes
Upgrade in place
An Intune feature update policy moves a Windows 10 device to a chosen Windows 11 version and keeps apps, data and settings. It is the quickest route for ready devices.
Wipe and provision
A reset followed by Autopilot gives a clean Windows 11 build with no old settings carried over. I use it where devices were built by hand or are badly drifted.
Replace
Devices with unsupported processors are replaced. New devices come registered for Autopilot, and the old ones go to certified erasure and recycling.
Mac and mobile
Macs and phones, with the same zero touch start
Few estates are Windows only. Macs, iPhones, iPads and Android phones need the same zero touch start and the same compliance checks. Personal phones under BYOD (bring your own device) need a lighter touch: protect the work data, and leave the rest of the phone alone.
Swipe sideways to see the whole diagram.
Apple. Company Macs, iPhones and iPads are bought through a supplier linked to Apple Business Manager. It assigns each device to Intune, so ADE (Automated Device Enrollment) enrols and supervises it the first time it starts. The Intune token for Apple must be renewed every year, which I put in the operations calendar.
Android. Android Enterprise offers four modes, and Intune has an enrolment profile for each: dedicated for single purpose devices, fully managed for company only phones, and a work profile on a company owned or a personal phone. Approved apps come from managed Google Play.
Personal phones. Where people use their own phones, I often skip enrolment. Intune app protection policies wrap Outlook, Teams and the Office apps: a PIN for work apps, no copy and paste to personal apps, and a selective wipe of work data only. Conditional Access only lets protected apps in.
The options I choose between
| Platform | Company owned | Personal |
|---|---|---|
| iPhone and iPad | ADE through Apple Business Manager, supervised | App protection without enrolment, or account driven user enrolment |
| Android | Fully managed, dedicated, or a work profile on a company owned device | A work profile on a personal device, or app protection without enrolment |
| macOS | ADE through Apple Business Manager, with platform single sign on to Entra ID | Usually browser access only, set by Conditional Access |
| Windows | Autopilot and Entra join | Blocked from enrolling, or browser access only |
Virtual desktops
When the desktop lives in the data centre
Sometimes the right device is not a device at all. A virtual desktop runs in a data centre or in Azure, and the user reaches it from any laptop, thin client or browser. I use virtual desktops where data must not leave a controlled place, for contractors and offshore teams, and for heavy apps on light laptops.
| Service | What it is | Strengths | Where I would use it |
|---|---|---|---|
| Azure Virtual Desktop | Microsoft's desktop service on Azure. Several users can share one session host. | Pay for the Azure capacity used, and scale host pools on a schedule | Large pooled estates, with Azure skills in house |
| Windows 365 | A Cloud PC for each user, at a fixed monthly price, managed in Intune like a laptop | Simple and predictable. Nothing to size beyond the Cloud PC plan. | Contractors, and teams who want a laptop experience in the cloud |
| Citrix | Desktops and apps delivered through Citrix's own stack, on premises or in the cloud | Fine control of policy and the display protocol | Estates with Citrix skills and demanding apps |
| Omnissa Horizon | Formerly VMware Horizon. KKR bought VMware's end user computing business, which became Omnissa in July 2024. | Runs on vSphere on premises, or in public cloud | Estates built on vSphere |
Profiles follow the user
In pooled desktops, FSLogix profile containers keep each user's profile on a file share, so it loads on whichever session host they land on. Storage speed for those shares decides how fast people sign in.
Distance matters more than bandwidth
A virtual desktop feels slow long before the link is full, because every key press makes a round trip. I test from where users really work before choosing the region.
The endpoint still counts
A thin client or an old laptop used to reach a virtual desktop still needs updates, a supported operating system and protection. It is still a device on the network.
The servers and storage underneath are on the servers and virtualisation and private cloud pages.
Assets
Knowing what you own, and proving where it went
ITAM (IT asset management) is knowing what you own, where it is, who has it and what it costs. It sounds like admin, but licence audits, refresh budgets, security incidents and disposal all depend on it. ISO/IEC 19770-1 sets out what a good ITAM process looks like.
Swipe sideways to see the whole diagram.
- Facts flowing in
- Decisions flowing out
No single source is complete. Purchase orders miss gifts and transfers, Intune misses devices that never enrolled, and a discovery scan misses laptops that stay at home. Joining them on serial number is what makes the register trustworthy.
What one asset record holds
| Part of the record | What it holds | Where it comes from |
|---|---|---|
| Identity | Asset tag, serial number, model and purchase date | Purchase order and supplier |
| Ownership | User, cost centre and location | HR (human resources) data and the service desk |
| State | On order, in stock, deployed, in repair, retired or disposed | Service desk, kept current by every move |
| Security | Encryption, compliance and last check in | Intune |
| Money | Price, warranty end and depreciation | Finance |
| Software | Installed apps and the licences they use | Intune and discovery, for SAM (software asset management) |
| The end | Erasure method, certificate and recycler | The disposal partner |
What a laptop really costs each year
An indicative model with example prices in pounds. Real numbers come from finance, the supplier and the service desk.
- Replaced each year
- 250 laptops
- Hardware each year
- £233,750
- Support each year
- £200,000
- Per laptop, per year
- £434
- Over one full cycle
- £1,735,000
A four year cycle is a common middle ground: most faults come late, and the warranty can be bought to match. Hardware is 54% of the yearly cost here, so support deserves as much attention as the purchase price.
Disposal that can be proved
| Method | What it means | Typical use |
|---|---|---|
| Clear | Logical overwrite of every place a user can write, against simple recovery | A device reused inside the organisation |
| Purge | Cryptographic or block erase, so even laboratory recovery is not feasible | A device leaving the organisation, for resale or recycling |
| Destroy | Shred or disintegrate, so the media cannot store data again | Failed drives, or the most sensitive data |
Categories from the US National Institute of Standards and Technology (NIST): Guidelines for Media Sanitization, NIST SP 800-88 Revision 2, published in September 2025. It points to IEEE 2883 for the technique for each kind of media, and asks for each erasure to be verified and the result recorded.
In the UK I use disposal partners certified to the ADISA (Asset Disposal and Information Security Alliance) ICT Asset Recovery standard, a scheme the ICO (Information Commissioner's Office) approved in July 2021. Recycling must meet the WEEE (Waste Electrical and Electronic Equipment) Regulations 2013. Every device gets its own erasure certificate, matched to its serial number in the register.
IT asset management and the CMDB as practices of ITIL (originally the IT Infrastructure Library) are on my ITIL 4 page.
Troubleshooting
Finding an enrolment fault stage by stage
A laptop that will not build usually stops at one clear stage. It cannot get online, Autopilot does not know it, the join fails, enrolment is refused, an app holds up the status page, or the device never becomes compliant. Choose a symptom to see where it stops, what I see and where I look.
Swipe sideways to see the whole diagram.
Stuck on the network screen. The device cannot reach Microsoft's services: a proxy that wants a user to sign in, TLS (Transport Layer Security) inspection breaking the connection, or an 802.1X port that will not admit an unknown device. I allow the published Autopilot and Intune endpoints, exempt them from inspection, and give new devices a provisioning network.
No company sign in page. The device shows the normal Windows setup, so Autopilot does not know it. Its hash was never uploaded, or it has no profile (event 815). I check the device in Intune, assign a profile through its group tag, and wait for the profile status to show as assigned before trying again.
Pre provisioning fails at the TPM. TPM attestation failed: old TPM firmware, a virtual machine, which is not supported, or blocked access to the TPM maker's attestation site. I update the firmware, use a physical device, and allow the attestation URLs.
Registered, not joined. Stale objects from an earlier build confuse the join. I delete the device from Intune, Entra ID and Autopilot, register it again, and rebuild it.
Hybrid join stops. The Intune Connector for Active Directory is installed in a different domain from the one the profile targets, or it cannot create the computer object. I install the connector in the right domain and check its rights on the target organisational unit. For new devices, Entra join avoids the problem.
Error 0x80180014 on a rebuild. A device that was self deployed or pre provisioned before has a blocked record, or Windows enrolment is blocked by a restriction. I unblock the device in Intune, or allow Windows MDM enrolment, and start again.
The status page times out. A required app fails or waits: a Win32 app with a wrong detection rule, two installers running at once, or too many blocking apps. I read the app's result in the Intune Management Extension logs, fix the detection rule, and trim the blocking list.
Signed in, but email is blocked. Conditional Access wants a compliant device, but a rule fails: BitLocker still encrypting, a Windows build below the minimum, or the first compliance check not yet done. I read compliance setting by setting, give fixable rules a short grace period, and have the user sync from Company Portal.
The tools I reach for
| Question | Command or place | What it tells me |
|---|---|---|
| How is it joined, and does the user have a token? | dsregcmd /status | AzureAdJoined, DomainJoined and AzureAdPrt |
| What happened during setup? | mdmdiagnosticstool.exe -area Autopilot -cab C:\temp\ap.cab | One CAB (cabinet) file with the logs, registry keys and event logs |
| What does that file say? | Get-AutopilotDiagnostics -CABFile C:\temp\ap.cab | The profile, the status page progress and each app install, in plain text |
| What is happening right now? | Ctrl+Shift+D during setup on Windows 11 | The Autopilot diagnostics page |
| Did the profile arrive? | Event Viewer, ModernDeployment-Diagnostics-Provider, then Autopilot | Profile download and errors such as 807, 815 or 171 |
| Why did an app fail? | C:\ProgramData\Microsoft\IntuneManagementExtension\Logs | Win32 app and script results, with exit codes |
| Can I see it without the device? | Intune remote action: Collect diagnostics | The same logs, from a laptop in someone's home |
I always test with the same build on a spare device before touching the user's. Most enrolment faults are about network access, a missing registration, or one app the status page is waiting for. My general method is on the troubleshooting page, and support by tier is on the 1st, 2nd and 3rd line support page.
Engagement
How I approach an end user computing programme, from first survey to steady state
An end user computing programme usually starts with a deadline: Windows 10 support ending, a merger, or a move away from imaging. I follow the same path as any infrastructure change. I agree what people must be able to do, measure the estate as it is, design one build standard, prove it with real users, and then keep it current.
Swipe sideways to see the whole diagram.
I start with the people, not the devices: who works where, on what, and what they must be able to do on day one. I group them into personas, such as office, field, shop floor and developer, and record who decides in a RACI (responsible, accountable, consulted, informed) chart.
Each persona gets functional requirements, the apps and access it needs, and non functional ones with numbers: time from box to desk, patch compliance, encryption coverage and support response. Security sets the baseline, mapped to Cyber Essentials, and procurement sets the catalogue and the warranty terms.
Before designing anything I measure: devices by model, age, processor, TPM and owner, every application and who really uses it, the Group Policy still applied, and tickets by model. The findings usually shrink the application list and grow the hardware budget.
The high level design sets the join type, the Autopilot modes, the update rings, the security layers and the support model. The low level design turns them into Intune policies, app packages and Conditional Access rules, each with a name, an owner and a test agreed before the build.
I build in test groups first, then pilot with real users from each persona and measure time to desk, failed installs and calls. Waves follow through change control, each with a way back, and the service desk gets its runbooks before the first wave, not after it.
Before handover, compliance, update and app install reports sit in dashboards with thresholds. The service desk has remote help, runbooks and the known errors from the pilot. Hypercare, the period of extra support after go live, ends only when the agreed criteria hold for a set time.
The estate never stands still. Each month I review the update rings and app versions. Each year a new Windows version and a refresh wave need planning. Apple tokens, certificates and connectors must be renewed on time, so they sit in an operations calendar with named owners.
Functional requirements
What it must do.
- Ship new laptops from the supplier to the user with no IT handling, ready at first sign in.
- Give each persona its apps, printers, Wi-Fi and VPN on day one, without a call to the service desk.
- Encrypt every device, store its recovery key, and report compliance to Conditional Access.
- Release Windows and app updates in rings, with a pause when the early rings show problems.
- Let the service desk see, help and wipe any device remotely, with every action logged.
- Keep one asset record per device, from order to erasure certificate.
Non functional requirements
How well it must do it, with a number wherever one can be agreed.
- Time to desk
- Under an hour from first sign in for a standard persona, on a typical home connection (typical).
- Patch compliance
- 95% of devices on the latest monthly update within 14 days (typical).
- Encryption
- Every laptop encrypted, with its recovery key stored, before it reaches company data.
- Build success
- 98% of devices finish setup first time, and every failure is traced to a cause (typical).
- Remote support
- Remote help available for every managed device, with sessions logged.
- Asset accuracy
- The register agrees with a discovery scan for 98% of devices (typical).
- Refresh
- A planned cycle, often four years for laptops, with warranty to match (typical).
These numbers are typical starting points, not standards. Each organisation agrees its own. The 14 day window for critical updates comes from Cyber Essentials.
Who I talk to
- Persona owners in each business unit, who know how people really work
- Application owners, for licences, versions and compatibility
- The service desk, who know which models and apps cause calls
- Security, for the baseline and the exceptions it will accept
- Finance and procurement, for budgets, leases and warranty terms
How I find out
- Hardware inventory checked against the Windows 11 requirements
- Application use by person and device, not just what is installed
- A Group Policy and image audit, to see what configures devices today
- Ticket analysis by model, age and category
- Site visits and conversations with users from each persona
Discovery tools
| Tool or source | What it tells me |
|---|---|
| Intune and Configuration Manager hardware inventory | Model, processor, TPM, firmware and disk for every device |
| Endpoint analytics in Intune | Start up times and app reliability by model |
| Group Policy analytics in Intune | Which Group Policy settings have an Intune equivalent |
| Lansweeper or a similar discovery tool | Devices that never enrolled anywhere |
| ServiceNow or the service desk tool | Tickets by model, app and category |
| Entra ID sign in logs | Which apps and clients people really use |
Most enrolment and access faults stop at one stage, so I find that stage first, then read the logs for it.
My approach
- Scope. One device or many, one model or every model, new builds or existing ones, and since when? What changed: a policy, an app, a network rule or a Windows release?
- Stage. Which stage does it stop at: network, profile, join, enrolment, status page or compliance? The fault finder above shows each.
- Logs. Collect the diagnostics file and read the events and app logs for that stage, on the device or remotely.
- Compare. Build a spare device of the same model on the same network. If it works, the difference is the device or the user, not the service.
- Fix and prove. Change one thing through change control, rebuild a test device, and record the cause as a known error for the service desk.
The faults that come up most
- TLS inspection or a proxy blocking setup
- Devices the supplier never registered
- One required app holding up the status page
- Stale device records after a rebuild
- Compliance failing on BitLocker or the Windows build
- Hybrid join waiting for a domain controller
Layer by layer
| Layer | What I check |
|---|---|
| 1 · Physical | USB network adapters and docks without drivers during setup, and Wi-Fi that needs a sign in page. |
| 2 · Data link | 802.1X ports that will not admit a device before it has a certificate, so new builds need a provisioning VLAN (virtual LAN). |
| 3 · Network | DNS (Domain Name System), proxy and firewall rules for the Microsoft endpoints, and VPN reach to a domain controller for hybrid join. |
| 4 · Transport | TLS inspection breaking connections to Entra ID and Intune. |
| 5 to 7 · Application | Profiles, compliance rules, Conditional Access and app detection rules, read in the diagnostics and the sign in logs. |
My general method, with worked faults, is on the troubleshooting page.
A laptop estate only stays healthy if someone watches it every day. I agree who does, and what they do when the numbers drift.
Service model
Who owns each part: the service desk, desktop support, endpoint engineering and suppliers, with escalation times in the contracts. The tiers are on the support page.
Monitoring
Compliance, update status, app install failures and encryption coverage in dashboards, with thresholds tuned during hypercare.
Remote help
Intune Remote Help or a similar tool, with role based access, elevation for approved staff only, and every session logged.
Runbooks
Step by step guides for failed builds, blocked sign ins, BitLocker recovery and lost devices, each starting with the check to run.
Swaps
Spare devices of each standard model, registered and ready, so a broken laptop is a swap and not a repair queue.
Reviews
A monthly look at compliance, failed installs and tickets by model, and a quarterly supplier review that includes failure rates.
An end user estate ages on several clocks at once. I plan its upkeep from the start.
- Windows. One feature update a year, supported for 36 months on Enterprise. Each version gets a ring plan well before the one before it runs out.
- Monthly updates. Security updates on the second Tuesday, released through the rings, with the 14 day Cyber Essentials window tracked.
- Apps. App versions, packages and detection rules updated as vendors release, and retired apps removed rather than left behind.
- Hardware. A refresh cycle, often four years for laptops, planned by model and warranty end, with disposal booked in the same plan.
- Tokens and connectors. The Apple token every year, certificate connectors and the Intune Connector for Active Directory, each renewed by a named owner before it expires.
- Standards. Changes such as the MDT retirement, the WDS deprecation and new Autopilot features, adopted on purpose rather than by surprise.
Projects
Related work behind this page
These are the projects closest to this topic. My work has centred on the networks, servers and identity services that every managed device depends on, rather than on running an Intune or Autopilot rollout myself. The skills that carry over are directory and identity design, remote delivery across many sites, and support models that cut cost.
The directory every device leans on Related
Windows Server 2012 R2 runs Active Directory, DNS (Domain Name System), DHCP (Dynamic Host Configuration Protocol) and TACACS (Terminal Access Controller Access Control System) for device logins, with Cisco ISE (Identity Services Engine) for network access control. See the lab.
Systems across a whole group Related
LAN, WAN (wide area network), VoIP (voice over IP), virtualisation and security across the group, including warehouse, cold chain and temperature monitoring systems at the food depots, linked to the group ERP (enterprise resource planning) system. Over £250k a year saved, with first year payback.
Joining two estates after a merger Related
Post merger infrastructure integration across a multi site estate, including distribution centres, with warehouse automation segmented from corporate IT. £700k a month saved across support and operations.
Every site upgraded remotely Related
Modernised every AVEVA site worldwide remotely during the COVID lockdowns, on schedule, through local enablement, leading 7 engineers and architects and coordinating 5 vendors. Remote delivery at that scale needs the same planning as zero touch provisioning.
From discovery to handover Related
Lead architect on network, cloud and data centre modernisation programmes, from discovery to operational handover, across several client environments. The handover into support is the same whether the change is a network or a laptop estate.
Rooms are end user devices too Related
I have trained as a Kramer Certified Expert, with Kramer Academy courses including AV over IP Installer and Education Spaces and Solutions Designer, and with Crestron. Meeting room systems need the same enrolment, updates and support as laptops.
Backed by MCITP (Microsoft Certified IT Professional) and MCSE (Microsoft Certified Systems Engineer), legacy Microsoft server certifications, and ITIL (Information Technology Infrastructure Library) v3 and v4 for service management. See all credentials
Explore
More areas I design and deliver
Every page follows the same idea: how it works, the choices that matter, and where I have used it. The foundations pages explain the basics the others build on.