Convert from Azure AD registered to Azure AD Joined without local admin rights

Question

question

DanielMonks-0112 asked Mar 8, '22 LuDaiMSFT-0289 commented Mar 10, '22

Convert from Azure AD registered to Azure AD Joined without local admin rights

Hello,

We have an issue with a large number of machines our client has inherited. Our client has absorbed a couple of companies and the machines that were associated with those users.

The issue is we can't get Intune to deploy to these machines since the users are signed into local account that do NOT have local admin rights to the machine. These machines are Azure AD Registered, but we need to get them to a Azure AD Joined or Hybrid state. We do not have the passwords for the local users that do have local admin rights on the machines, so we can't get any new software installed or provision our RMM tools.

Is there any way to get the devices moved to Azure AD Joined or grant local admin rights without resetting the device to factory and running through AutoPilot?

mem-intune-general mem-intune-enrollment

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2022-03-09T20:46:21.103Z

Jason-MSFT answered Mar 9, '22 DanielMonks-0112 commented Mar 9, '22

Is there any way to get the devices moved to Azure AD Joined or grant local admin rights without resetting the device to factory and running through AutoPilot?

No. Local admin permissions are required to join a device to a domain (AD or AAD doesn't matter) or enroll it into MDM. If this were not required, any bad actor, even unintelligent ones, would already have taken over all of your user's systems.

AAD Registration is just that, a simple registration of a device by the user, it doesn't endow or grant any sort of control over that device in any way.

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DanielMonks-0112 · Mar 09 at 08:57 PM

Yeah understood, I was just hoping to avoid resetting 300 devices.

0 ·

Answer 2 · 2022-03-08T23:19:10.817Z

RahulJindal-2267 answered Mar 8, '22 DanielMonks-0112 commented Mar 9, '22

Have you considered using provisioning package for joining into AAD and auto-enrollment?

· 1

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DanielMonks-0112 · Mar 09 at 05:39 PM

@RahulJindal-2267

I have not. This is the first time I am coming across Provisioning Package. I will look into and see if that can help resolve the issue.

0 ·

Answer 3 · 2022-03-09T04:52:23.46Z

LuDaiMSFT-0289 answered Mar 9, '22 LuDaiMSFT-0289 commented Mar 10, '22

@DanielMonks-0112 Thanks for posting in our Q&A.

To clarify this issue, could you please tell us if the devices are already manged by intune? If yes, we can try to write a Powershell script to create a local admin user and deploy this script via intune.

I have done the test in my lab. I will share you some screen shots:
Script:

Settings of script policy in intune portal:
https://docs.microsoft.com/en-us/mem/intune/apps/intune-management-extension#create-a-script-policy-and-assign-it

Results:
I can see the new admin user in the Administrator group.

Now we can disconnect the account in Settings > Accounts > Access work or school. Then we can follow the steps under "To join an already configured Windows 10 device" in the following link to make the device Azure AD joined.
https://support.microsoft.com/en-us/account-billing/join-your-work-device-to-your-work-or-school-network-ef4d6adb-5095-4e51-829e-5457430f3973

Hope it will help.

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

image.png (50.8 KiB)

image.png (79.6 KiB)

image.png (23.3 KiB)

· 2

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

DanielMonks-0112 · Mar 09 at 04:35 PM

@LuDaiMSFT-0289

No, the devices are not managed by Intune. I have a test machine spun up that has the same settings as the acquired companies' machines.

In my test setup, I can check Azure and see my test user, checked the devices and my test device is showing as "Azure AD Registered" but the MDM column shows as "None".

I should note that Intune works perfectly if setting up a device "as new". The issue is primarily with machines that are setup with local users that don't have local admin rights.

0 ·

image.png (20.4 KiB)

LuDaiMSFT-0289 DanielMonks-0112 · Mar 10 at 02:50 AM

@DanielMonks-0112 Thanks for your update. The above method is not available for this situation that the device is not enrolled to intune.

And thanks Jason for clearing some information about AAD Registration.

0 ·

question