Endpoint Services, MECM, Managing Windows 11


This article covers the available MECM features for evaluating Windows 11 compatibility, as well as deploying Windows 11 to new and existing devices.


Microsoft Endpoint Configuration Manager (MECM)

Intended Audience

University of Illinois IT Pros leveraging MECM, hosted by Technology Services' Endpoint Services team

Evaluating Windows 11 compatibility for an existing device

  • Deploy one of the 'Audit Windows 11 Readiness' configuration baselines to the respective collection - located at \Assets and Compliance\Overview\Compliance Settings\Configuration Baselines in the console

    • The configuration baselines leverage Microsoft's Windows 11 Hardware Readiness script. Non-compliant devices will fail one or more of the following requirements: Memory, Processor, SecureBoot, Storage, TPM
      • Refer to the 'Understanding the Hardware Readiness script output' section at the link above to evaluate the output of the baseline
      • This will check that an endpoint meets the Windows 11 minimum system requirements and mark any endpoints that don't meet them as non-compliant

    • The 'Audit Windows 11 Readiness - Granular' baseline checks all of the requirements: Memory, Processor, TPM, SecureBoot, Storage

    • If you would like to create a non-compliant collection for a specific requirement, deploy the respective 'Audit Windows 11 Readiness - x' baseline.
      • For example, if you want a collection of devices that do not meet TPM requirements so you can query models and potentially deploy newer TPM firmware, deploy the 'Audit Windows 11 Readiness - TPM' baseline

    • Collections based on compliance can be created by right-clicking the deployment of the configuration baseline, selecting ‘Create New Collection’, then selecting the desired compliance status

    • View the details of the baseline results at \Monitoring\Overview\Deployments in the console
      • Search for the baseline name and double-click to view the status
      • For details of non-compliance, select the Non-Compliant tab, expand the columns, then view the assets under each CI name.

    • Please note that additional compatibility considerations for internal and external peripherals may be required

  • For devices that do not meet TPM requirements, determine if the device can be upgraded from TPM 1.2 to TPM 2.0

Deploy and manage Windows 11

  • For new Windows 11 installations:

    • Copy an existing OS deployment task sequence to use for Windows 11 deployments

    • Update the 'Apply Operating System Image' step to use the latest Windows 11 operating system upgrade package

    • Update the 'Apply Driver Package' steps to use the latest Windows 11 drivers for each model

    • If there is a 'Pre-provision BitLocker' step, disable that step and implement one of the following options:
      • Replace the step with a new ‘Run Task Sequence’ step that runs the ‘DEMO DAYS-Pre-Provision Bitlocker Workaround’ task sequence, located at '\Software Library\Overview\Operating Systems\Task Sequences\.DEMO DAYS' in the console
      • Or, you can create the following four Run Command Line steps in your task sequence using the commands below:
        1. reg.exe add HKLM\SOFTWARE\Policies\Microsoft\TPM /v OSManagedAuthLevel /t REG_DWORD /d 2 /f
        2. reg.exe delete HKLM\SYSTEM\CurrentControlSet\Control\MiniNT /f
        3. manage-bde.exe -on C: -em xts_aes128
        4. reg.exe add HKLM\SYSTEM\CurrentControlSet\Control\MiniNT /f

    • Ensure your unit's boot image is updated to the latest version (OS Version 10.0.25398.531 or greater): Update boot image

    • Deploy the task sequence to the respective OSD collection

  • Upgrade devices with an existing Windows 10 installation:

  • Track your environment's overall count of Windows 11 devices

  • In order to manage Windows 11 updates with MECM, visit https://go.illinois.edu/epshelp, select the 'MECM' service, select 'Microsoft/Office/Windows Updates' under 'Request Type', then fill out the rest of the form

Contact the EPS team

KeywordsEPS MECM SCCM "windows 11" readiness TechS-EPS-SCCM   Doc ID131339
OwnerEPS Distribution ListGroupUniversity of Illinois Technology Services
Created2023-09-10 19:56:54Updated2023-12-19 16:24:55
SitesUniversity of Illinois Technology Services
Feedback  0   0