ConfigMgr · Intune · MDT · Windows
SCCM, MDT, Windows, Troubleshoot — anything I would like to write
A working notebook on System Center Configuration Manager, Microsoft Intune, operating system deployment and PowerShell automation, written from the field by Zeng Yinghua (Sandy).
Learn more
Zeng Yinghua (Sandy)
IT infrastructure engineer writing about the tools that run enterprise Windows estates.
The SCCM is a personal technical blog covering System Center Configuration Manager and ConfigMgr administration, Microsoft Intune, MDT, Windows deployment, and day-to-day IT troubleshooting.
Posts are practical rather than theoretical: rebuilding a ConfigMgr test lab after a fatal MSI error, exposing the administration service over the internet, connecting Microsoft Graph to Intune Autopilot, and monitoring WSUS pool status with PowerShell. Categories on the blog include AD, Application, AutoPilot, Azure, Bitlocker, ConfigMgr, GPO, Hyper-V, IIS, Microsoft Graph, OSD, Planner, Powershell, PXE, SQL, Task Sequence, Troubleshooting, Windows Server 2016, Windows Store App, Windows10 and WSUS.
Recent posts
Latest entries from the archive, newest first.
-
ConfigMgr: Fatal MSI Error – mp.msi could not be installed
A management point installation failed while rebuilding a ConfigMgr test lab, and the same mistake was made before — so it was written down this time.
-
Use ConfigMgr administration service (AdminService) over internet
Notes on putting the administration service to work across the internet.
-
Microsoft Graph Intune Autopilot connectors
Connecting Microsoft Graph so Autopilot work can be driven from script.
-
PowerShell modules for Microsoft Planner
Using Planner modules from PowerShell as part of an operational toolkit.
-
Windows 10 Upgrade won't continue after reboot
Troubleshooting an upgrade that stalls and refuses to progress after a restart.
Operating system deployment
iPXE UEFI boot without a WDS server
Booting UEFI clients straight from iPXE, without deploying or maintaining a Windows Deployment Services server.
Other OSD notes cover task sequence error handling, the process exit code that appears when every machine running the same task sequence reports the same unknown error, and multi-language Windows 10 deployment strategies written up in July 2018.
For the wider picture, the OSD section collects task sequence, imaging and deployment articles; the Windows 10 guides cover upgrade loops and installing Windows Store apps on Windows Server 2016.
Configuration Manager remains the backbone of many enterprise Windows estates, and understanding its console, site hierarchy, and client behaviour is the foundation for everything else. Administrators who take time to learn how collections, deployments, and boundaries interact find that troubleshooting becomes far less mysterious. The blog treats ConfigMgr as a craft rather than a checklist, documenting the small observations that only surface after real deployments. Whether you are new to the console or have managed sites for years, there is always another corner of the product worth exploring, and writing those findings down is how knowledge compounds over time.
Operating system deployment is where theory meets hardware, and the task sequence is the instrument through which that meeting happens. A deployment sequence is rarely just a linear script; it is a series of decisions about drivers, applications, and conditions that must hold true on every machine. When something fails midway, the logs tell a story that rewards patience and careful reading. The habit of building a lab, breaking it deliberately, and rebuilding it is the most reliable way to learn. Each mistake in a deployment sequence becomes a lesson that makes the next rollout calmer and more predictable.
Microsoft Intune has shifted the centre of gravity for many organisations, moving device management toward cloud-native policy and away from on-premises infrastructure. Co-management lets both worlds coexist, so endpoints can benefit from modern management while still relying on Configuration Manager for the workloads that remain on-premises. The transition is rarely a single switch; it is a gradual rebalancing of which tool owns which responsibility. Documenting that journey, including the awkward middle stages, helps others plan their own path with fewer surprises and a clearer sense of what to expect along the way.
PowerShell is the connective tissue of modern Windows administration, and automation is where its value really shows. A well-written module can replace hours of repetitive clicking, turning routine tasks into repeatable and auditable operations. The trick is to start small, wrap the things you do often, and let the tooling grow as your confidence does. Error handling, logging, and readable output matter as much as the logic itself, because automation that nobody can troubleshoot is automation that nobody trusts. Writing about these scripts, and the mistakes inside them, keeps the learning honest.
Troubleshooting is the part of the job that rarely appears in planning documents but consumes much of the working day. A failed installation, a client that will not register, or a content distribution that stalls all demand a methodical approach rather than guesswork. Reading logs closely, isolating variables, and reproducing the issue in a controlled lab environment turn a frustrating problem into a solvable one. The most useful posts are often the ones that walk through a dead end before reaching the answer, because that is how real diagnosis actually feels from the inside.
Windows Server and Windows client administration form the platform beneath everything else in the enterprise. Patch management through WSUS, service health, and the steady rhythm of monthly updates keep estates secure and predictable. Understanding how updates flow from the source to the endpoint, and where that flow can break, is essential for anyone responsible for keeping systems current. The blog treats patching as an operational discipline rather than an afterthought, exploring how to schedule, monitor, and recover when a deployment does not go as planned, and how to keep users informed without causing unnecessary alarm.
The Microsoft Graph and its associated interfaces have opened new ways to query and automate the management of devices and users. Rather than replacing existing tools, these interfaces extend them, allowing scripts to reach data that was previously scattered or difficult to collect. Learning to work with them is an investment that pays off in reporting, compliance checks, and bulk operations that would otherwise be tedious. The emphasis here is on practical, incremental use: small scripts that solve real problems first, with more ambitious automation following once the fundamentals feel comfortable.
Community and continuous learning sit at the heart of this notebook. Conferences, user groups, and conversations with other administrators regularly surface ideas that never appear in official documentation, and those exchanges are worth capturing while they are fresh. Writing publicly about what works, and what does not, creates a record that others can build on and a discipline that sharpens the author as much as the reader. The tone throughout is that of a working engineer sharing field notes rather than a formal manual, because the most useful technical writing tends to come from someone still doing the work.
Archive by category
The blog is organised by the product area each post belongs to.
| Section | What it covers |
|---|---|
| ConfigMgr | Task sequences, client deployment, server setup and site administration |
| OSD | iPXE UEFI boot, imaging and task sequence error handling |
| Intune | Autopilot automation, Policy CSP settings and Win32 application deployment |
| Windows 10 | Upgrade restart loops, Windows Store apps on Server 2016, multi-language deployment |
| PowerShell | Lenovo dock detection, WSUS pool monitoring, Microsoft Planner connectors |
| SSPR | Cloud self-service password reset setup for Windows 10 Insider previews |
| Events | User group speaking records and sessions |
Cloud SSPR requires Azure AD Premium, and it exists so end users can reset their own passwords — taking work away from the helpdesk.