Intune Autopilot v2 – Part 3: Configuration, Branding & User Experience
Liladhar Sapkota•February 28, 2026
1
Company Branding for Windows Login
Configure company branding that appears during Windows login and throughout the OS.
Create Branding Profile
- Navigate to Intune → Devices → Configuration profiles → Create profile
- Platform: Windows 10 and later
- Profile type: Templates → Administrative Templates
Configure These Settings:
| Setting | Path | Value |
|---|---|---|
| Company Name | Windows Components/File Explorer | Your Company Name |
| Lock Screen Image | Windows Components/Windows Logon | Path to company image |
| Desktop Wallpaper | Desktop | Path to company wallpaper |
Production Tip: Use device context for branding profiles so they apply before any user signs in.
2
Taskbar and Start Layout Configuration
Standardize the user experience by configuring taskbar and Start menu layouts.
Export Reference Device Layout
# On a reference device, configure the taskbar and Start menu # Export the layout using PowerShell Export-StartLayout -Path "C:\Layout.xml" Export-StartLayout -UseDesktopApplicationID -Path "C:\Layout.json"
Deploy via Intune
- Go to Intune → Devices → Configuration profiles → Create profile
- Platform: Windows 10 and later
- Profile type: Settings catalog
- Search for "Start" and configure:
- Start Layout - Upload your XML/JSON file
- Pin apps to taskbar - List of app IDs to pin
- Remove taskbar icons - Hide unnecessary icons
Important: Test on a small group first. Some users may be confused if Start layout changes dramatically.
3
OneDrive Known Folder Move (KFM)
Automatically redirect Desktop, Documents, and Pictures folders to OneDrive for backup and sync.
Configure KFM Policy
- Go to Intune → Devices → Configuration profiles → Create profile
- Platform: Windows 10 and later
- Profile type: Administrative Templates
- Search for "OneDrive"
Key Settings:
| Setting | Value | Notes |
|---|---|---|
| Silently move Windows known folders to OneDrive | Enabled | No user prompts |
| Prompt users to move Windows known folders to OneDrive | Disabled | Use silent mode |
| Prevent users from redirecting their Windows known folders to their PC | Enabled | Prevents moving back |
4
USB Device Restrictions
Control USB device usage to prevent data theft and malware introduction.
Option 1: Block All USB (Strict)
- Go to Intune → Devices → Configuration profiles → Create profile
- Platform: Windows 10 and later
- Profile type: Settings catalog
- Search for "USB" and configure:
Administrative Templates/System/Removable Storage Access: - All Removable Storage classes: Deny all access → Enabled - Removable Disks: Deny write access → Enabled - CD and DVD: Deny read access → Optional - WPD Devices: Deny read/write → Enabled
Note: Test USB restrictions thoroughly. Don't block necessary devices like keyboards or mice.
5
NTLMv2 and Security Hardening
Strengthen authentication security by disabling older, less secure protocols.
NTLM Settings
- Go to Intune → Endpoint security → Attack surface reduction
- Create policy for Account protection
| Setting | Recommended Value |
|---|---|
| Network security: Restrict NTLM: Incoming NTLM traffic | Deny all domain accounts |
| Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers | Audit all |
| Network security: LAN Manager authentication level | Send NTLMv2 responses only. Refuse LM & NTLM |
Critical: Test NTLM restrictions in audit mode first. Some legacy apps may break.
6
Microsoft Defender for Endpoint (EDR) Configuration
Enable advanced threat protection and endpoint detection.
Onboard Devices to Microsoft Defender for Endpoint
- Go to Microsoft 365 Defender → Settings → Endpoints → Onboarding
- Download onboarding package
- In Intune, create configuration profile:
Profile type: Endpoint protection Settings: - Microsoft Defender for Endpoint: - Enable Microsoft Defender for Endpoint: Yes - Share endpoint alerts with Microsoft Defender for Endpoint: Yes - Enable endpoint data collection: Yes
7
Timezone and Regional Settings
Standardize timezone and regional settings across your organization.
Set Timezone Automatically
- Create configuration profile
- Profile type: Settings catalog
- Search for "time"
Settings: - Time Language Settings/Time Language Settings: - Configure time zone: Enabled - Time zone to apply: AUS Eastern Standard Time (or your timezone) - Set time zone automatically: Enabled - Set daylight saving time automatically: Enabled
Production Best Practices
- Phased rollout: Deploy to test group → IT department → Pilot users → All users
- Monitor reporting: Check Intune reporting daily during rollout
- Document exceptions: Keep list of devices/users requiring special policies
- Version control: Name policies with dates (e.g., "Branding - Feb 2026")
You've completed the Intune Autopilot v2 series! Your devices should now be:
- ✅ Enrolled via Autopilot (Part 1)
- ✅ Hardened with security policies (Part 2)
- ✅ Configured with branding and user experience (Part 3)