Home/Questions/Backup and recovery/Bulk workstation reimaging
Backup and recovery

Can workstations be reimaged in bulk from a controlled operating system image?

Servers get the attention in recovery planning. The thing that keeps people from working for another week is usually the laptops.

Partly verifiable from your tenant

What the carrier is actually asking

The carrier is asking whether you can rebuild many endpoints quickly, from a known-good image, without touching each one by hand. It is a question about tooling and about readiness: whether the image exists, is current, and can be delivered at scale to devices that may not be on a corporate network.

Why it is underwritten

In a widespread ransomware event, servers are restored by a small team and endpoints have to be rebuilt across the whole workforce. Organisations without bulk reimaging spend the long tail of the outage rebuilding devices one at a time, and that tail is business interruption the carrier pays for.

Where the answer lives in Microsoft 365, Entra ID, and Azure

Modern endpoint provisioning is measurable in the tenant, which makes this one of the more verifiable backup-block questions.

PlatformWhere the setting livesWhat has to be true
Microsoft 365Intune enrolment coverage and Windows Autopilot device registrationDevices registered for automated provisioning, so a wiped device rebuilds itself from the cloud
Microsoft 365Autopilot profiles and enrolment status page configurationProfiles that produce a working device, tested rather than assumed
Microsoft 365Application deployment through IntuneThe applications people need are deployed by policy, since a reimaged device without applications is not a recovered device
Entra IDDevice join state across the fleetCloud-joined or hybrid-joined devices, since a workgroup device cannot be rebuilt centrally
On-premises toolingDeployment services or configuration manager task sequences, where usedCurrent images and tested sequences. Attested where the tooling is on-premises
Rebuilding is not restoring

A reimaged device is clean and empty. If user data lived only on that device, bulk reimaging costs you the data. This answer is strongest when paired with a design where user data lives in a synchronised or centralised location, which is exactly what another question in this block asks about.

What a defensible yes requires

  • A current, controlled image or a cloud provisioning profile exists and produces a working device.
  • Devices are enrolled such that a wipe-and-rebuild can be initiated centrally, including for remote workers.
  • Applications and configuration deploy automatically after rebuild.
  • User data is centralised or synchronised, so rebuilding does not destroy it.
  • The process has been exercised recently on a real device rather than assumed from documentation.

How this answer goes wrong

The image drifts. It was built two years ago, three of the applications in it are end-of-life, and the first rebuild attempt during an incident reveals it does not join the domain any more. The other failure is remote reach: bulk reimaging that assumes devices are on the corporate network, at a moment when the corporate network is exactly what is unavailable.

Frequently asked

Does cloud provisioning count?

It is the strongest version of a yes, because it works over the internet without corporate infrastructure, which is the condition you will actually be in.

What about macOS and mobile devices?

The same principle and different tooling. Include them in the answer, since a fleet that is half unmanaged is half rebuildable.

How current does the image need to be?

Current enough that a rebuilt device is usable without manual work. Testing it quarterly catches drift before an incident does.

Does this interact with the local data question?

Closely. Bulk reimaging is safe when user data lives centrally and destructive when it does not, so the two answers should be consistent.

Related questions

Stop answering this from memory

Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.

Assess your posture