Keeley Companies

Autopilot – New Machines

*New laptops are typically purchased in bulk and automatically added into the Autopilot Device section*

 

Go to Intune

• Open Admin Center: https://admin.microsoft.com/#/homepage
• Click Show all in the left column
• Click Endpoint Manager
  •  
• Alternatively, you can go directly by going to: https://intune.microsoft.com/?ref=AdminCenter#home

 

Assign user to laptop

1. Locate Serial Number on bottom of laptop or on the box the laptop came in
2. Within Intune
   1. Click on Devices in the left column
   2. Click on Windows in the secondary column 

Click on Devices under Windows Autopilot.

Search for the serial number of the new machine

If device isn't found go to this KB for importing the laptop's HASH:

1. Manually Collecting Hash | Knowledge Base | Keeley Companies
2. Return here when finished.
3. Select machine and choose Assign user.

Search for new user, select the user,  and choose Select button.

 

 

In the Device Name field, type in the Serial number. Group tag will always be KO-ITCE. Click Save to finish assign user to laptop.

 

 

• In Entra ID, make sure the user is also in the Allowed Users Group to Azure Join group before kicking off TAPs or Autopilot.

TAPs

• In Azure, go to Microsoft Entra and search for the user under Users. Click their name to access the user's account.

• On the left side, choose Authentication Methods.

• Choose "Add Authentication Method", choose Temporary Access Pass, and then the length of time. Cyber does not recommend going over 4 hours.

• Power on the laptop.

Autopilot

• Connect laptop to power and a working network cable/connection
• Power on laptop
• Autopilot will start automatically if it has a good connection to the internet
  • Wifi connections will also work, if you connect to a Keeley Wifi connection
  • KeeleyCompanies: password:  K331eyC0mp@nies
• Autopilot will require you to enter the TAPs for the user you assigned to the laptop.
• Autopilot will now start for the user – you can expand whatever step it is on to see details.
• If Phase 3 (Account Setup) errors, click Continue Anyway button.  This will take you into the final steps of setting up the computer.

• After the Device Setup is completed, it will again require you to enter the user's TAPs. After doing so, Click Skip for Now on the fingerprint option.
• Enter a 6-digit PIN you will remember. Click OK.

Windows Desktop Environment

• First, use the attached document named Laptop Set Up Checklist to double check and track the computer building process.

• Go to edit power plan using the search bar and change everything to never to prevent it from timing out during company portal SYNC. Click Save Changes.

• In the next window, click "Choose what closing the lid does". 

• Set it to match the below:

• Go to Microsoft Entra ID
• Go to Groups

• Search for New Windows Laptops - Click to open

• Click on members

• Click Add members

• Search for serial number of laptop - Select box - click Select button at bottom

• Force user to login with password
  • Signout of desktop
  • Click the screen anywhere (or click space bar)
  • Click the Sign-in Options
  • Choose the key icon
  • Enter password
    • Note - these steps might have to be done after the first couple reboots to get it to stay with password as the default setting
• To force software sync on laptop to finish up adding all software: 
  • Start Menu
  • Search for Company Portal
  • Go to Settings
  • Click Sync button

• Verify Microsoft Office, TeamViewer, Google Earth Pro, Google Chrome, Sentinel Agent, Zscaler, and Rapid7 Agent have installed
• Login to Outlook, Teams, and OneDrive.
• Pin Outlook, Teams, and Chrome to the user's taskbar.
• Login to Zscaler
• Verify Bitlocker is on
  • Click Start Menu
  • Search for Bitlocker
  • Open Manage Bitlocker
• Remove device from New Windows Laptops Group and the user from the Allowed Users Group to Azure Join Group.

• Run Lenovo Commercial Vantage (if not installed, it can be found in the Microsoft Store). Click Check for Updates.

• Click Install now after selecting all the updates below.

• Once completed, click the Search bar on the taskbar and search for Updates. Choose Check for Updates. Install any updates if they are available.

• Install any nVidia Drivers (if applicable) the device may require, especially if built with a dedicated video card. Go to https://www.nvidia.com/en-us/drivers/
  
  
• Map printer drivers by going to File Explorer (Windows key + e) onlyif the user is based out of the Ewing Office.
  • \\az-print01 in the address bar - hit enter
  • Right click and choose connect on the Ewing printers that should be on all laptops
    • LKC - Left New
    • LKC - Right New
    • LKC - Executive
    • LKC - Expansion