The job
Edit workstations need a consistent setup, but they aren’t office PCs. Several “All Devices” policies that are right for a laptop are wrong for an edit bay.
What I did
- Moved the edit PCs into Intune with their own device group and filters, so they’re excluded from the All Devices policies that don’t fit.
- Built a baseline to the edit bays’ actual requirements.
- Deployed Intune to the news workstations during the news move and trained staff one on one.
The edit baseline
- Storage and sync settings chosen for editing, not for laptops
- NVIDIA Studio drivers
- Remote support tooling
- Nexio mount and ICM client
- A dedicated power profile
- VLC
- Windows bloat removed
What I left alone on purpose
- Craft edit PCs stay in a separate group with their own rules.
- Production and control room PCs stay out of Intune entirely. A policy push should never be able to reboot something that’s on air.
What I learned
- “All Devices” is a trap for specialized machines. Policies built for laptops do real damage on an edit bay. Separate groups and filters fixed most of it.
- Build the baseline from the workload. I started from what the editors actually needed and worked backward, instead of starting from a security template and carving out exceptions.
- Training matters as much as policy. Going desk to desk during the news move caught problems no policy report would have shown.
- Deciding what not to manage is a design decision. Keeping on-air machines out of Intune entirely was the most important call in this project.