Microsoft Surface Laptop SE Configuration

Step 1: Imaging and Configuration

Remove the Computer from Entra and AD
Boot into UEFI (turn on and hold the F4 button)
Go to Booting Devices and activate the USB option.
Click and slide to the left to boot into the flash drive
Image device with Win11 Basic
Name the device LAB-B102-##
Log in with Administrator (Booting Password)
Add to the domain if necessary
Move to Right OU
Perform Windows Updates. (24H2 is a big download)
GPUpdate /force to get Action1

Step 2: Microsoft Office and Intune:

Log in as IT-Intune2
Once logged in, check for Microsoft 365 License activation
GPUpdate /force to get Action1
DSREGCMD to check for Azure and Intune
Check Entra and Intune to see if they are there properly
Bitlocker the machine
Freeze Machine

Step 3: Decryption

If the computer does not allow you to Bitlocker the machine because it does not have a the right privilege, you may need to log into an administrator and decrypt the machine. In an administrator command prompt, type (manage-bde -off C:).

This decrypts the machine and prepares it for encryption