VM Prep

Runbook — Windows Autopilot VM Enrollment via
PIM (TeamA Test)
Goal: register a coworker's VMware Windows 11 VMs into Windows Autopilot and assign a
deployment profile, when the coworker's scoped role lacks Enrollment rights. You activate the
needed role via PIM and perform the registration; the VMs land in TeamA scope.
Terminology fix
For Windows, the zero-touch program is Windows Autopilot, not ADE. ADE is Apple-only.
Correct "ADE" to "Autopilot" anywhere it appears in Windows process docs.
PIM reality
PIM activates a role with its permissions for a time window. It does not transfer ownership of the
coworker's devices. You activate a role that carries the Enrollment programs permission (the
scoped Helpdesk-derived role lacks it), then register on his behalf. Deactivate when done.
What you need from the coworker

1. The Autopilot hardware hash CSV from each VM (from
   Get-WindowsAutopilotInfo), columns: Device Serial Number, Windows Product ID,
   Hardware Hash.
2. Confirmation that each VM's BIOS UUID and serial number are unique and
   non-blank.
   The BIOS UUID list he already sent (e.g., IntuneTest = 564d8b5a-
   ...) is a useful uniqueness
   check but is NOT the import file. The four UUIDs seen were unique (good). Still need the actual
   hash CSV and a serial check.
   Coworker's steps — prepare unique VMs (VMware)
3. Build one golden Win11 VM.
4. Generalize: C:\Windows\System32\Sysprep\sysprep.exe /generalize
   /oobe /shutdown
5. Full Clone x N (not linked clones).
6. Per clone, edit .vmx:
   -
   SMBIOS.reflectHost =
   "FALSE"
   -
   serialNumber.reflectHost =
   "FALSE"
   -
   serialNumber =
   "TEAMA-VM01-0001" (unique per clone)5. Boot each clone; choose "I Copied It" (regenerates uuid.bios + MAC).
7. Gate — verify uniqueness before collecting hashes:
   -
   UUID: confirm distinct per VM (already confirmed unique).
   -
   Serial: Get-CimInstance Win32_BIOS | Select-Object
   SerialNumber — must be unique and non-blank. If blank/identical, go back to
   step 4 and set unique serialNumber.
   Coworker's steps — collect
8. On each VM (elevated):
   Set-ExecutionPolicy -Scope Process RemoteSigned
   Install-Script Get-WindowsAutopilotInfo -Force
   Get-WindowsAutopilotInfo -OutputFile C:\autopilot-hash.csv
   (Use -Append to combine multiple VMs into one CSV.)
9. Send the CSV(s) to you.
   Your steps — PIM + Autopilot (Intune)
10. Activate PIM: My roles > Intune Administrator > Activate (justification + ticket; MFA).
    Wait for active. Prefer a narrower custom role with Enrollment programs rights if one
    exists.
11. Import: Devices > Windows > Windows enrollment > Devices (Windows Autopilot
    Devices) > Import > upload CSV.
12. Sync and wait for devices to appear.
13. Gate — import clean? If hashes collide or fail (often blank/duplicate VM serials), go
    back to step 6/7 and recollect after fixing serials.
14. Add the imported devices to SG-TeamA-Devices (static group; needs group Owner).
    This also puts them in the coworker's scope.
15. Deployment Profile: Devices > Windows > Windows enrollment > Deployment Profiles
    > create/select > assign to a group containing these devices (e.g.,
    SG-TeamA-Devices).
16. Confirm each device shows Profile status: Assigned.
17. Deactivate PIM (or let it expire). Do not leave Intune Administrator active past the task.
    Verify
    -
    -
    Devices appear as Autopilot devices, Profile status = Assigned.
    Devices are members of SG-TeamA-Devices.-
    Coworker (scoped role, no PIM) can see and manage them within TeamA.
    Notes / gotchas
    -
    -
    -
    VM serials are the usual failure point — unique BIOS UUID is necessary but Autopilot
    also keys on serial. Verify both.
    Static group = manual add per device, by the group Owner. Re-imaged/non-persistent
    VMs produce new objects and need re-adding.
    Clean up stale Entra device objects from torn-down VMs so they don't clutter the group
    or hit join limits.
    Companion diagram: Autopilot_VM_Enrollment_viaPIM.vsdx (vertical swimlanes, NASA
    style).