Intune Fresh Start vs. Wipe: The Best Choice for Device Management

Managing devices within an organization is a crucial task, and Microsoft Intune plays an important role in this process. Two options that often cause confusion are “Intune Fresh Start” and “Intune Wipe.” In this blog post, I’ll explain the difference between these two features so you can better determine which option best suits your needs.

1. Intune Fresh Start: A Clean Slate While Preserving User Data

Purpose: Fresh Start is designed to restore a device to a clean state, installing the latest version of Windows.

What happens: When you run Fresh Start, all apps installed by the user are removed. What makes this unique, however, is that user data is preserved. Windows is then reinstalled.

Use case: This option is ideal if you want to rid a device of unwanted software while ensuring it has the latest Windows version without losing the user’s personal data.

❌ 2. Intune Wipe: A Full Reset

Purpose: Wipe is used to delete all data on a device and restore it to factory settings.

What happens: A wipe completely removes all user data, apps, settings, and even the operating system. The device is restored to the state it was in when it first came out of the box.

Use Case: This option is useful if you want to completely wipe a device, for example, before it is phased out or transferred to a new user. This ensures that no data from the previous user remains on the device.

Two Forms of Intune Wipe

Standard Wipe
The standard Wipe option in Intune deletes all user data, apps, and settings, and restores the device to its factory settings. This is ideal when a device is transferred to a new user or removed from the organization.

Wipe with “Continue Wipe even if Device Loses Power”
This advanced option is designed for scenarios where a device may have been stolen. When this option is enabled, the wipe continues even if the device loses power. This is a crucial security feature, as stolen devices are often quickly turned off by thieves.

3. Autopilot Reset

Autopilot Reset is a feature within Microsoft’s Windows Autopilot that allows a device to be restored to a clean state while remaining under the organization’s management. This feature is ideal for scenarios where a device needs to be reconfigured for a new user or when issues need to be resolved that cannot be fixed through standard troubleshooting. The reset process ensures that all personal files, apps, and settings are removed, while the device remains connected to the organization for easy reconfiguration.

Why LTE/5G Laptops Are a Smart Choice

Tip: Consider laptops with LTE/5G connectivity for your organization. Why? LTE/5G connections increase the likelihood that a wipe will be successfully performed on a stolen device.

Why is this important?

A thief is unlikely to try to connect to Wi-Fi on a stolen device to avoid detection. However, LTE/5G-connected devices always have some form of connectivity, even when they’re not connected to Wi-Fi. This means that as long as the device is turned on, it can receive signals via LTE/5G, allowing security measures such as a remote wipe to be effectively carried out. As a result, your data remains protected, even in the event of theft. LTE/5G laptops therefore not only offer the flexibility of being connected anywhere, but also enhance the security of your devices and sensitive data.

Management via the Intune console

Both actions—Fresh Start and Wipe—can be easily initiated from the Microsoft Intune management console. Simply select the device and choose the desired action. This makes device management efficient and user-friendly.

Recommendation: Replace the SSD/HDD When a Device Is Decommissioned

Although a standard wipe deletes the data, we recommend replacing the SSD/HDD when a device is taken out of service to ensure maximum security.

BitLocker Policy in Intune

Another interesting feature in Intune is the ability to set a policy that activates BitLocker after a certain number of failed login attempts. This requires the user to enter a recovery key to regain access. Although this isn’t exactly the same as a full wipe, it provides strong protection against unauthorized access.

Conclusion

In summary, Windows Autopilot offers three powerful options for managing devices within an organization: “Fresh Start,” “Wipe,” and “Autopilot Reset.” Each of these options serves a specific purpose, ranging from preserving personal data during a light refresh to performing a full reset for a clean start, and maintaining management control during a reset. By using these options strategically, organizations can optimize and secure their device management, contributing to a more efficient and secure IT environment.

Would you like to learn more or need help implementing and managing Intune in your organization? Please contact ALTA-ICT. Our team of experts is ready to support you with customized solutions tailored to your specific needs. Visit our website or contact us directly for personalized advice. Together, we’ll ensure your organization gets the most out of Microsoft Intune and is ready for the technological challenges of today and tomorrow.

Are you unsure which reset is right for your devices, or do you want to set up Intune without any surprises? Read about how ALTA-ICT handles this when managing your workstations.