After creating an encrypted PPKG, you can run the package on any Windows 10 device you want to configure. This method installs your configurations and applications on any Windows 10 device, even those already configured.


  • Create an encrypted PPKG in the Workspace ONE UEM console. For more information, see Create a Provisioning Package for Windows 10 Devices.
  • You need a USB drive to transfer the PPKG to the Windows 10 device. The USB drive must be formatted NTFS or FAT32.
  • Your devices must run Windows 10 1709 or later. They must also be unmanaged devices. If the device is already enrolled, the process does not apply any configurations or install any apps.


  1. Navigate to Devices > Lifecycle > Staging > Windows.
  2. Find the encrypted package and select Download Encrypted PPKG.
  3. Save the PPKG to a USB drive.
  4. On the Windows 10 device you want to provision, insert the USB drive, open it, and double-click to run the PPKG.
  5. Enter the password you used to encrypt the PPKG.
  6. Confirm that you trust the source by selecting Yes, Add It.


The Provisioning Tool runs and begins installing the configuration and applications included in the package. If you included configurations in your PPKG, Sysprep runs and automatically reboots the device. After rebooting the device, Windows completes the device setup based on your configuration. After setup, Workspace ONE Intelligent Hub runs and completes device enrollment.