Migrating a sprawling legacy Windows fleet to cloud-native management in Microsoft Intune is one of the most critical transformations modern enterprise IT teams face. While procurement workflows typically register brand-new hardware through OEM and CSP channels, existing active workstations—whether Hybrid Azure AD joined, SCCM co-managed, or manually enrolled—require a strategic conversion methodology.
Without an intentional hardware hash harvesting and registration pipeline, administrators often face deployment bottlenecks, duplicate device object conflicts, and broken Out-of-Box Experience (OOBE) provisioning when machines are wiped or refreshed. This deep dive details the architectural blueprints, automation scripts, and governance strategies required to convert existing active devices to Windows Autopilot at scale.
The 3 Enterprise Conversion Approaches
Depending on your current management topology, network segmentation, and device state, three primary methods exist for converting existing devices into Windows Autopilot:
GroupTag.
Method 1: The Native Intune Autopilot Conversion Policy
If your fleet is already enrolled in Intune (via GPO, SCCM co-management, or user enrollment), Microsoft provides a native background conversion switch.
To enable this in the Microsoft Intune Admin Center:
- Navigate to Devices > Windows > Windows enrollment > Deployment Profiles.
- Create or edit an existing User-Driven Azure AD Joined Autopilot profile.
- Under Out-of-box experience (OOBE) settings, toggle "Convert all targeted devices to Autopilot" to Yes.
- Assign the profile to an Entra ID Dynamic Security Group containing your existing Windows fleet (e.g.
All Windows 11 Endpoints).
Method 2: Direct Automation with PowerShell 7 & Microsoft Graph
For machines requiring immediate registration, or endpoints being staged in IT imaging depots, running a scripted registration pipeline via Microsoft Graph is the fastest and most deterministic path.
The following production-ready PowerShell script extracts the complete hardware hash, handles proxy authentication, and registers the device with a customized GroupTag:
# ==============================================================================
# Enterprise Autopilot Registration & Hardware Hash Ingestion Script
# Author: MSEndpoint Modern Workplace Engineering
# ==============================================================================
[CmdletBinding()]
param(
[Parameter(Mandatory = $false)]
[string]$GroupTag = "Corp-Standard-Laptop",
[Parameter(Mandatory = $false)]
[string]$AssignedUser = ""
)
Write-Host ">>> [1/4] Checking Execution Environment & Prerequisite Modules..." -ForegroundColor Cyan
# Ensure TLS 1.2 / 1.3
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls13
# Install / Import Get-WindowsAutoPilotInfo if missing
if (-not (Get-Module -ListAvailable -Name "Get-WindowsAutoPilotInfo")) {
Write-Host "Installing Get-WindowsAutoPilotInfo from PSGallery..." -ForegroundColor Yellow
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force -Scope CurrentUser | Out-Null
Install-Script -Name Get-WindowsAutoPilotInfo -Force -Scope CurrentUser | Out-Null
}
$tempPath = "$env:SystemRoot\Temp\AutopilotRegistration"
if (-not (Test-Path $tempPath)) { New-Item -Path $tempPath -ItemType Directory -Force | Out-Null }
$csvPath = "$tempPath\HWID_$($env:COMPUTERNAME).csv"
Write-Host ">>> [2/4] Harvesting 4K Hardware Hash from WMI..." -ForegroundColor Cyan
& Get-WindowsAutoPilotInfo.ps1 -OutputFile $csvPath
if (-not (Test-Path $csvPath)) {
throw "Failed to extract hardware hash to $csvPath"
}
$hwidData = Import-Csv -Path $csvPath
Write-Host "Device Serial Number: $($hwidData.'Device Serial Number')" -ForegroundColor Green
Write-Host "Windows Product ID : $($hwidData.'Windows Product ID')" -ForegroundColor Green
Write-Host ">>> [3/4] Ingesting to Microsoft Intune Autopilot Service..." -ForegroundColor Cyan
# Direct Graph Authentication and Ingestion
& Get-WindowsAutoPilotInfo.ps1 -Online -GroupTag $GroupTag -AssignedUser $AssignedUser -Assign
Write-Host ">>> [4/4] Hardware Hash successfully uploaded to tenant with GroupTag: $GroupTag" -ForegroundColor Green
Remove-Item -Path $tempPath -Recurse -Force
Enterprise GroupTag Architecture & Dynamic Entra ID Assignment
Uploading hardware hashes is only half the battle. To ensure the correct Enrollment Status Page (ESP) and configuration baselines apply immediately upon reset, you must establish an intentional GroupTag taxonomy.
| GroupTag Value | Target Persona / Hardware | Autopilot Join Type | Dynamic Entra ID Query Filter |
|---|---|---|---|
Corp-Dev |
Engineering & DevOps Workstations | Entra ID Joined (User-Driven) | (device.devicePhysicalIds -any _ -eq "[OrderID]:Corp-Dev") |
Corp-VIP |
Executives & C-Level Laptops | Entra ID Joined (White-Glove / Pre-Prov) | (device.devicePhysicalIds -any _ -eq "[OrderID]:Corp-VIP") |
Kiosk-Shared |
Frontline & Shared Warehouse PCs | Self-Deploying Mode | (device.devicePhysicalIds -any _ -eq "[OrderID]:Kiosk-Shared") |
GCCH-Gov |
Sovereign Cloud & High Compliance | Entra ID Joined (DoD/FedRAMP) | (device.devicePhysicalIds -any _ -eq "[OrderID]:GCCH-Gov") |
Common Troubleshooting & Production Gotchas
sysprep /generalize /oobe before extraction. Cloning a running VM produces identical motherboard UUIDs, causing Autopilot registration collisions and error 80070032.
Summary & Implementation Checklist for Engineers
- Audit Existing Fleet: Inventory all active endpoints across SCCM, Intune, and Active Directory.
- Standardize GroupTags: Establish your corporate naming convention (e.g.
[OrderID]:Corp-Laptop) for dynamic profile mapping. - Enable Background Conversion: Activate "Convert all targeted devices" on your primary Windows 11 Autopilot deployment profile.
- Deploy Remediation Scripts: For hybrid/workgroup devices, execute the Graph API harvesting script via Intune Proactive Remediations.
- Validate Profile Assignment: Ensure the Autopilot Profile Status reads
Assignedbefore scheduling user device refreshes.
