How to Enroll Legacy Lenovo Laptops into Microsoft Intune (Without Wiping Devices)
Enrolling Legacy Lenovo Laptops into Intune (Without Wiping Them)
You’ve got a fleet of older Lenovo laptops already joined to Microsoft Entra ID (Azure AD), most users are licensed, but many devices still aren’t enrolled in Intune. You want one simple thing:
Be able to remote wipe or retire those machines when users leave or devices go missing.
Good news: if the laptops are already Entra joined, you don’t need to reimage them. You just need to trigger MDM enrollment for those existing devices and make sure your tenant is configured correctly.
This post walks through:
- The difference between new vs existing devices
- Prerequisites for auto-enrollment
- Options for enrolling existing Entra-joined Lenovo laptops
- A practical workflow to follow
- How to verify you can wipe a device
New vs Existing Devices: Pick the Right Path
The MVP’s answer in the thread is spot on:
- New devices → Use Windows Autopilot (or Autopilot Device Prep) to ship devices ready-to-go, with automatic Intune enrollment during OOBE.
- Existing Entra-joined devices → Use a “catch-up” method (script, provisioning package, or similar) to enroll them into Intune without wiping them.
In your Lenovo scenario, we’re focused on the second group: existing Windows 10/11 laptops already Entra joined.
Step 1 – Check Prerequisites in the Tenant
Before touching the laptops, make sure the basics are in place.
1. Confirm Intune Licensing
Each user who owns a device must have an Intune-eligible license, such as:
- Microsoft 365 Business Premium
- Microsoft 365 E3/E5
- EMS E3/E5, etc.
2. Verify MDM User Scope
In the Intune admin center:
- Go to Tenant administration > Intune enrollment > MDM user scope.
- Scope should include the users of those Lenovo laptops (Some or All).
If MDM user scope wasn’t configured when the devices were first joined, they won’t auto-enroll until you trigger it.
3. Confirm Devices Are Entra Joined
On a sample Lenovo laptop:
- Open Settings > Accounts > Access work or school.
- Click the connected work account > Info.
- At the bottom, you should see Device is joined to Microsoft Entra ID.
If they’re only Entra registered (personal), you’ll need to handle that differently. This post assumes they are Entra joined and corp-owned.
Step 2 – Choose an Enrollment Method for Existing Devices
For existing Entra-joined devices, you have a few realistic options:
Option 1 – PowerShell Script (Good with RMM or Remote Access)
Community guides (like Rudy Ooms’ blog) show how to trigger MDM enrollment on already Entra joined devices by fixing the right registry keys and running the enrollment task in the SYSTEM context.
Typical pattern:
- Ensure Intune MDM URLs and TenantInfo keys are present.
- Trigger the scheduled task that does the MDM join.
This works well when:
- You have RMM tools (Intune Proactive Remediations, Ninja, Datto, etc.)
- Or you can run scripts remotely with PSRemoting / management tools.
Pros
- No user interaction.
- No wipe.
- Good for doing hundreds of devices in waves.
Cons
- Requires remote scripting access.
- You must test carefully on a small pilot group.
Option 2 – Provisioning Package (PPKG) for Walk-Around or USB Method
Microsoft and several community posts describe using a provisioning package created with Windows Configuration Designer to enroll existing devices.
Basic flow:
- Use Windows Configuration Designer to create a package that:
- Sets the MDM URLs and tenant info.
- Triggers MDM enrollment.
- Apply the PPKG on each Lenovo (USB stick, network share, or RMM).
Pros
- Officially supported method.
- Works even when you can’t easily script in SYSTEM context.
Cons
- Still needs someone to touch each device if you don’t have RMM.
- Easy to lose track if you don’t track which laptops are done.
Option 3 – Manual “Enroll Only in Device Management”
As a last resort, you can manually enroll through Settings:
- On the device, open Settings > Accounts > Access work or school.
- Click Connect (or the existing work account).
- Use Enroll only in device management (wording can vary).
This is more suitable for:
- Small environments.
- Ad-hoc devices.
But:
- It can mark devices as personally owned in some flows.
- It depends on users following instructions correctly.
For a Lenovo fleet you want to remote wipe, this is usually the least ideal option, but it’s there if you’re stuck.
Step 3 – Practical Workflow for Legacy Lenovo Laptops
Here’s how I’d structure it for a small/medium environment without wanting to wipe anything.
1. Build a Pilot Group
- Create an Entra security group for 10–20 Lenovo laptops.
- Add devices manually from Entra ID > Devices or Intune > Devices (where they exist).
2. Standardize the Script / PPKG Method
Pick PowerShell or PPKG as your main method:
- If you already have RMM → PowerShell script is usually best.
- If you’re mostly on-prem / hands-on → PPKG via USB can be simpler.
Test on the pilot group:
- Confirm each device shows up in Intune > Devices with:
- Ownership: Corporate
- Join type: Microsoft Entra joined
- MDM: Microsoft Intune
3. Roll Out in Waves
Once the pilot is stable:
- Roll out to one department or site at a time.
- Track devices in a spreadsheet or Power BI report: Serial, User, Model, Enrollment Status.
- Keep an eye on Intune’s Enrollment failures report for issues.
If you hit devices that refuse to enroll:
- Check if they were joined before licenses/MDM scope were configured.
- Check event logs and the DeviceManagement-Enterprise-Diagnostics-Provider log.
- As a last resort, you may need a rejoin or wipe + Autopilot for stubborn cases.
Step 4 – Verify You Can Wipe a Device
On a test Lenovo that is now showing as managed in Intune:
- Go to Intune admin center > Devices > Windows.
- Open the device record.
- Use Remote actions > Wipe or Retire (choose Wipe with test device only).
- Confirm the device resets and reboots as expected.
Once this works end-to-end, you’ve met your main business requirement: you can wipe a lost or decommissioned legacy Lenovo without having to rebuild your whole process.
When to Use Autopilot Instead
For brand new Lenovo laptops, don’t repeat this legacy process:
- Register hardware hashes in Windows Autopilot (or use OEM-direct registration).
- Assign Autopilot profiles and Intune device groups.
- Let devices auto-enroll and configure during first boot.
Think of it this way:
- Legacy fleet → Script / PPKG / one-time catch-up into Intune.
- Future fleet → Autopilot from day one, no manual enrollment needed.
Wrap-Up
For your legacy Lenovo laptops that are already Entra joined, you don’t need to wipe them to get Intune management:
- Make sure licenses and MDM user scope are configured.
- Use a PowerShell script or provisioning package to trigger enrollment on existing devices.
- Pilot first, then roll out in waves.
- Test the wipe action on a lab device to validate the end-to-end flow.
Once done, you’ll have those older machines under the same Intune umbrella as your new Autopilot devices, with the ability to wipe, retire, and secure them when you need to.
