Internal

• Login to the device using a local admin account
• Open Settings
• Select Accounts
• Select Access work or school
• Select Connect
• Select Join this device to Microsoft Entra ID
• Enter a user id to join the device. The users email account should work for this, otherwise a tenant admin account can be used
• Select Join on the pop up window after confirming the organisation was correct
• Once successful you will see a You're all set! window.

Select Done

• Open settings on the device you are using
• Select Accounts
• Select Access work or schools
• You should see the domain in there which the machine is joined to, select that domain so you see a drop down menu
• Under the domain name, select Disconnect
• Agree to leave the domain
• You maybe asked to enter an account to confirm removal, you can use a local admin account

• Open task manager and select Run
• Open MSCONFIG
• Select the Boot tab
• Untick Safe boot
• Click OK and restart the device

• Open windows explorer.
• Open C:\Windows
• Find the CSC folder and right click, select Properties
• Select the Security tab
• Select Advanced at the bottom of the tab
• Under Owner select Change
• In the search box, enter Administrators
• Click OK
• Select Replace Owner on sub containers and objects
• Click OK
• Windows will now go through changing the permissions. You may see some errors appear, click Continue/Skip or Ignore to continue changing the rest of the permissions
• Once completed, right click the CSC folder and rename it to _OldCSC

• Open Windows Explorer
• Navigate to C:\Users
• Create a new folder, _OldProfiles
• You will see many profile folders in C:\Users folder
• We recommend leaving any Admin/Administrator accounts in place, but move any named accounts or generic accounts to _OldProfiles.
• Where possible rename the user profile of the user who has this assigned laptop with an _ in front of the profile name. This just makes it easier for you to identify later.

• Open MSConfig on the laptop you are working on
• Select the Boot tab from the window that pops up
• Under Boot Options, select Safe Boot
• Click OK
• Now restart the laptop

• Click the start menu and search for Bitlocker. If you dont see Bitlocker, you may have to login in as a local administrator to find this setting.
• Open Bitlocker
• If Bitlocker is enabled you should see an option to Suspend bitlocker. Choose to suspend Bitlocker. DO NOT DISABLE BITLOCKER as this will slow you down waiting for the laptop to decrypt.

• Within Windows open "Computer Management" MMC
• Select "Local Users and Groups"
• Select "Users"
• Look for any user accounts that could be local admin accounts. Double click them and check they are members of the administrators group and they are enabled.
• If there is no account, we recommend creating a standard EICT account with the password quest. Don't forget to add the new account to the local administrators group.

We are now ready to move onto the next module.