Endpoint Management & Imaging

The day the image stopped mattering

For most of my career, the most prized artifact in any IT shop was the image. A senior administrator would spend days building one perfect machine - the right OS build, the right apps, the right defaults, every annoyance pre-disabled - and then capture it into a single .wim file. That file was the crown jewels. Deploy it, and a fresh laptop became a corporate laptop in twenty minutes. We guarded those images, versioned them, argued about what belonged in them.

Then, gradually, the image stopped mattering. Not because imaging was wrong, but because the problem it solved - turning identical hardware into identical, ready machines on a fast local network - stopped being the problem most of us had. The fleet went remote. Devices shipped from a vendor straight to someone’s kitchen table. There was no technician, no PXE boot, no LAN. The crown jewels were useless if you couldn’t get the machine in front of them.

Two philosophies, one goal

What replaced the image was not a better image but a different idea. Traditional imaging says: build the end state, then copy it. Modern provisioning says: ship a generic device, then assemble the end state live, from the cloud, on first boot. Windows Autopilot is the canonical example. You never build a custom image at all. You register a device’s hardware identity ahead of time, and when the user opens the box, connects to Wi-Fi, and signs in, the device recognizes itself, joins the directory, enrolls into management, and pulls down policy and apps until it is business-ready.

Both philosophies aim at the same target, and this is the thing newcomers miss: the goal was never “deploy an image.” The goal was always to get every device into a known-good state and keep it there. Imaging was one way to reach the first half of that sentence. It was never very good at the second half.

The second half is the whole job

Here is what the image never did: it never kept anything. The moment you deployed it, the machine began to drift. Users installed things. Settings changed. Patches lagged. The beautiful image was a photograph of a state the machine left behind on day two. Everything that actually keeps a fleet trustworthy - configuration enforcement, baselines, patch rings, encryption, compliance reporting - happens after provisioning, continuously, forever.

This is why the center of gravity shifted from imaging tools to management platforms. Group Policy did this for the on-premises world: bundle settings, attach them to a slice of the directory, refresh them every ninety minutes. But Group Policy assumed the LAN. When the LAN evaporated, mobile device management took over - cloud-native, internet-first, and crucially, self-reporting. The old tools applied settings and shrugged. The new ones apply settings and tell you, per device, per setting, who complied and who did not. That reporting is not a nicety. It is the difference between believing your fleet is encrypted and knowing it.

Membership, not machines

The deepest change is conceptual. In the imaging era you thought about machines: this laptop has this software, that one needs a rebuild. In the management era you think about membership: this device is in the Finance group, so it gets the Finance apps, the Finance baseline, the Finance update ring. You stop touching machines and start curating groups. A new hire’s laptop configures itself not because someone prepared that machine but because it landed in the right groups and the groups carry the policy.

This is enormously powerful and slightly unnerving. Powerful, because changing a standard for five thousand devices becomes a single edit. Unnerving, because a single bad edit reaches five thousand devices just as fast. That is precisely why the mature parts of endpoint management - update rings, pilot waves, the discipline of never advancing a ring until the last one is clean - are really about staging blast radius. Automation without staging is just a faster way to break everything at once.

Why the old skills still matter

It would be easy to read all this as “imaging is dead, learn the cloud.” That is wrong, and it is the mistake I see most. The fixed kiosk in the warehouse, the offline lab, the air-gapped site, the bench rebuild - these still want a golden image, a task sequence, a Sysprep before capture. More importantly, the thinking behind imaging transfers directly: what belongs in the stable core versus what should be delivered dynamically, how to handle drivers, how to keep a known-good baseline current. The administrator who understands why you generalize an image before capture also understands why a compliance policy reports false positives when a detection rule is wrong. It is the same instinct for state, identity, and proof.

The quiet throughline

Strip away the tooling and endpoint management has not changed at all in twenty years. It is still one sentence: get every device into a known-good state, and keep it there, automatically. Imaging answered the first clause. Configuration, patching, and security answer the second. The cloud changed the how - from copying disks on a LAN to orchestrating fleets over the internet - but the what is exactly what it always was. Learn the sentence, and every tool, old or new, falls into place as just another way to keep its promise.