Windows Autopilot

Export all your hardware hashes from ConfigMgr

Quite some time ago, ConfigMgr added an inventory class that gathers the hardware hashes needed to register devices with Windows Autopilot from every Windows 10 device that it is managing.  Those are stored as part of the standard ConfigMgr inventory, in the SMS_G_System_MDM_DEVDETAIL_EXT01 WMI class.  Combine that with the serial number from SMS_G_SYSTEM_PC_BIOS and you have all the information that you need to add those devices to Windows Autopilot.

To help with that process, I uploaded a new sample script to the PowerShell Gallery.  It’s not a particularly sophisticated script, but it gets the job done:  It grabs a list of all the hashes from WMI, a list of all the serial numbers from WMI, merges them together, and creates a CSV file with the result.  You can find that script at https://www.powershellgallery.com/packages/Get-CMAutopilotHashes.

To use that script, it’s easiest to log onto your ConfigMgr server (although you can run it remotely by adding a computer name parameter and credentials if you want to).  From there, you can install the script (using “Install-Script Get-CMAutopilotHashes”) or download it manually, and run it like so:

image

Notice the warnings?  Those are from hashes that are present in ConfigMgr without corresponding serial numbers – don’t ask me why that is happening, seems like my site server has a little garbage floating around in it.  But for the one active Windows 10 device that I do have, the hash was written to the specified CSV file, which you can then upload to Intune, either manually or using the WindowsAutopilotIntune module’s Import-AutopilotCSV file.  (Note that Intune has maximum row counts when uploading, so if you have lots of devices you might need to break the CSV file into pieces and upload them separately.  If you use Import-AutopilotCSV, it might let you do larger batches, but it will eventually generate a Graph throttling error, so it would be best to break it up for that too if you have thousands of devices.)

If you want to add a group tag, you can specify that at the command line too by adding a “-GroupTag Blah” parameter.

Of course your other (easier, automatic) alternative to doing all of this is to get the devices Hybrid Azure AD Joined (registered in Azure AD) and co-managed.  If you do that, you can take advantage of the Intune “Convert all targeted devices to Autopilot” setting:

image

As long as the co-managed devices are in a group that is targeted by an Autopilot profile that has the “Convert all targeted devices to Autopilot” setting enabled, Intune will automatically reach out to each device, grab the hardware hash via MDM, and then register the device via Autopilot and assign the profile to it.

Categories: Windows Autopilot

8 replies »

  1. Is this any different to the Autopilot hardware report you can run to generate a csv file for all devices?
    Or can you use this script to target a collection of devices?

    Like

  2. It would be cool if we could filter by collections. We run a confederated SCCM/MEM environment with a heavy reliance on RBAC. Using RLS on PowerBI would be a good way for me to filter this data, which is what I have been looking into.

    Like

    • You can configure Intune to automatically upload the hash with the “Convert devices to Autopilot” option in the Autopilot profile. You just need to make sure your devices (the ones that went through the JSON-based process) end up in an AAD group tied to that Autopilot profile.

      Like

Leave a Reply to Richard Fairchild Cancel reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s