After creating an encrypted PPKG, you can add the package to devices using the Windows 10 Out of Box Experience (OOBE). This method installs your configurations and applications during the initial device setup.



  1. Navigate to Devices > Lifecycle > Staging > Windows.
  2. Find the encrypted package and select Download Encrypted PPKG.
  3. Save the PPKG to the root of a USB drive.
    If you save the PPKG to a subfolder, OOBE cannot detect the file.
  4. On the Windows 10 device you want to provision, insert the USB drive at the Select your Region screen of the Out of Box Experience.
    If you save multiple PPKGs on the USB device, Windows prompts you to select the PPKG you want to apply. After selecting the PPKG, Windows automatically detects and begins processing the PPKG.
  5. When prompted, enter the password used to encrypt the PPKG.
  6. If you want to see the progress of the app installation, press Shift + F10 to run a cmd window, press Alt + Tab and select the Provisioning Tool.


The OOBE process runs the PPKG and installs the configuration and applications included in the package. The workflow changes based on the content of your PPKG:
  • If you do not include configurations in your PPKG, the process completes and returns you to the Select your Region to complete the OOBE process.
  • If you include configurations in your PPKG, Windows automatically runs Sysprep and reboots the device. After rebooting the device, Windows completes the device setup based on your configuration. After setup completes, Workspace ONE Intelligent Hub runs and completes device enrollment.