Microsoft Intune manages everything from iOS, Android, and Windows phone devices to Windows RT, Windows PCs, and even Mac OS X, but I’m going to kick off this blog series to talk specifically about managing Windows 10 PCs. This might seem like a straightforward subject to be spending so much of my time blogging about, but bear with me; there are plenty of interesting twists and turns you should be aware of before deciding how you will manage Windows 10 with Intune. Knowing these ins and outs will enable you to take full advantage of the management capabilities that Intune—and Windows 10 itself—provides to make your life as an IT admin easier.
Trust me, if you want to know how to properly manage not only Windows 10 PCs, but also the apps and files used on them, with Intune then you’ll want to keep reading this series. In this particular post I’ll get you started with deciding how to enroll PCs into Intune and then get deeper into the actual management of these devices, and the apps/settings in use on them, in subsequent posts.
Getting Win10 PCs under management
Before you can manage Windows 10 PCs with Intune, you first must enroll them into management by the service. Seems obvious right? What is not so obvious is just how you get them snug as a bug in the Intune rug. The first question you will need to answer is: do I install the Intune computer client to manage Windows 10 PCs as computers or should I enroll these PCs into management as mobile devices? A simple question with an answer of immense consequences. Choose wisely.
Note: To avoid the tl;dr phenomenon on this post I’ll get you started with the scoop on managing Windows 10 PCs as computers and then get to the good stuff (managing them as mobile devices) in the next.
Manage Windows 10 PCs as computers (please only if you really, really have to)
The only way you can manage Windows 7 or Windows 8 computers with Intune is to use the Intune computer client so it’s kind of a no-brainer for those PCs to follow a more traditional management strategy. With the newer operating systems like Windows 8.1 and Windows 10 (where we can leverage OMA-DM), you have a choice to enroll as a PC or mobile device and leverage more modern management practices. So, one way to think about the computer client is that it is the old school way of managing Windows PCs. As an old school SMS admin in a previous life, the simplicity, and basic feature set the computer client enables can be appealing. That said, you’re really better off managing the more modern (Win8.1 and Win10) PCs as mobile devices, but I said I wouldn’t say anything about that until we get this computer client stuff out of the way.
It’s easy to get the computer client installed. First, you’ll need to go grab the bits to deploy. You can get a link to the files from within the Intune admin console (ADMIN\Client Software Download). Then, with your trusty Microsoft_Intune_Setup.zip file in hand, either manually sneakernet the installation files around to each PC you want to manage as a computer or use Group Policy to install the client. You could also try telling your users to open the Company Portal website from their PC and install the client themselves. Good luck with that, but if you’re interested in establishing the affiliation between a user and their managed PC, that’s the way to do it. User device affinity will not be set when you, as an admin, push the client bits to PCs.
With the computer client successfully installed, you can review software and hardware inventory reports, remotely run malware scans, install desktop apps (.exe and .msi), perform a selective wipe (not full wipe) of company data from the PC, remotely restart the computer, and manage Windows Update and firewall settings. Your users can use the Microsoft Intune Center to do some handy things like open the Company Portal website to see what apps are available for them to install, check for updates (don’t you use WSUS by now?), start Windows Defender to scan for malware (you know Windows 10 comes with Defender built-in right?), or…well, that’s it really.
Don’t believe me? See for yourself:
OK, to be fair, in theory you can also enable the TeamViewer Connector and use TeamViewer software to request remote assistance, but that’s not “right out of the box”.
Tip: When you enable the TeamView connector in the Intune admin console, the Remote Assistance text at the bottom of the Intune Center for managed Windows 10 PCs automatically changes from “Remote assistance is not supported on this version of Windows” to “Request remote assistance“.
Do you really want to do this?
So, now you know how to use the Intune computer client to manage Windows 10 PCs as computers and what capabilities you get using that method. The more interesting part to me though is what you don’t get. Namely the ability to leverage most of the mobile device management capabilities Intune provides. And these are handy things like conditional access to company data, resource access profiles (VPN, Wi-Fi, email, etc.), and Windows Information Protection (WIP) and OMA-URI settings management.
I could go on and on about why it’s a better idea to manage Windows 10 PCs as devices, and I will, but that’s another blog post (that you won’t want to miss).
You’ve seen my blog; want to follow me on Twitter too? @JeffGilb.
