A. Install Windows 11 Pro

Here are some points to note when installing:

1. Network Connection during installation

   • For wireless connection, please refer to On-Campus WI-FI connection for campus community
   • For wired connection, in office area, plug-in network cable. ITSC will provide limited network access that allows Windows 11 installation to complete. Upon successful Intune onboarding, the device's network connection will automatically be registered and gain full access to all sites and services. No manual node registration is needed.
      

2. Device Naming

   During installation, you'll be given an option to name your device.

   Here, ITSC imposes no restriction on computer name for new Windows 10/11 devices enrolling to Intune. However, we strongly recommend changing your device name at this stage. By changing device name now will give you ease to manage devices. Also, it'll help to locate the device should there be security alerts raised in future. ITSC would like to suggest using the following naming convention:

   • [dept]-[Abbreviation or Team or Owner]-[sequence]
     e.g., ITSC-DIR-001, ITSC-PROJ-001 or ITSC-CCTEST-001

B. Enroll the device using ITSC account of the device user

Upon renaming device and device restart

1. At the "How would you like to set up this device?" page, select "Set up for work or school", and click "Next".
   
2. At the prompt "Let's set things up for your work or school", enter your ITSC credentials (i.e., johnchan@ust.hk) and complete the MFA challenge using DUO mobile (or other registered authentication methods). Note that the account you provided here will be the owner and administrator of the device. The new Bitlocker key will be stored under this account's devices.
   

3. Wait until the installation completed and follow the set-up instructions
   

C. Enable Windows Hello PIN Login

Upon installation completion and machine boot up, you're required to configure Windows Hello. Windows Hello is a new way of signing into your device using PIN or Biometric. You need not type complex password to login. Please refer to our Passwordless page for benefits of setting up Windows Hello.

Now, just follow the on-screen instruction to sign on your ITSC network account again. If you have not yet set up the Azure MFA, you'll be asked to setup at this step before the Windows Hello PIN. This is required as it is used to reset the Windows Hello PIN or biometric if needed. We recommend to setup Microsoft Authenticator App as your preferred Azure MFA method and you can enable Passwordless authentication for browser-based applications later.

Follow the steps and you'll finally reach "All Set".

Now, your new desktop device installation has completed. You may login your ITSC account on this device using PIN in future.

D. Verify Intune EnrolLment

1. Verify Intune Enrolment
   You can verify your device enrolment status by checking the presence of "Managed by HKUST - Info" under "Settings", "Accounts", "Access work or school", "Connected to HKUST's Azure AD".
   
    
2. Verify Microsoft Defender for Endpoint protection.
   Your device should also be protected by the Microsoft Defender for Endpoint. This could be verified by checking the presence of "ITSC Support" under the "Windows Security" application page.