Windows 11 Migration in a Hospital System
My part in a 1,000-endpoint Windows 11 migration program across nine NYU Langone Health sites, racing Windows 10 end of support without taking clinicians offline.
Program scale
These figures describe the program, not my personal output. Program completion is not claimed: my contract ended August 29, 2025, and I cannot speak to the program's final status.
- Program scope 1,000 endpoints in program scope (not a personal total)
- Program scope 9 sites in Manhattan and Brooklyn
Personal throughput
My own working rates. They are rates, not totals. I did not keep a lifetime device count, so I do not compute one from the daily rates.
- Personal, daily 30+ devices I staged a day in the staging room
- Personal, daily 10 to 15 on-site swaps a day on clinical units (typical)
- Personal, weekly ~65 approximately 65 ServiceNow cases a week (deployment, support and follow-up; not all incidents)
A fixed deadline, in buildings that never close
Microsoft ended support for Windows 10 on October 14, 2025. Any Windows 10 machine still in service after that date would collect known, unpatched vulnerabilities while sitting next to patient data.
Windows 10 endpoints across hospital, outpatient and specialty sites had to move to Windows 11. These devices run nursing stations, clinics and specialty practices around the clock, so there were two ways to fail: miss the date and leave unpatched endpoints in clinical spaces, or rush the swaps and take a working station, printer or department application away during patient care.
Nine sites, two boroughs, one Microsoft-managed endpoint environment
NYU Langone Health, an academic health system with hospital, outpatient and specialty sites. The work happened in two places: the basement staging room, where devices were provisioned in batches and volume mattered, and clinical units, where devices were swapped at the user's station and disruption mattered.
Sites (nine in total; seven named here)
- Tisch Hospital and Kimmel PavilionManhattan, main campus
- Outpatient clinicManhattan, near the main campus, toward the FDR
- NYU Langone Orthopedic HospitalManhattan, East 17th Street
- Ambulatory Care CenterManhattan, East 38th Street
- One Park AvenueManhattan, outpatient practices
- Oncology practiceManhattan, East 51st Street
- NYU Langone Hospital, BrooklynBrooklyn, part of my work from July 2025
Platforms and tools
| Platform | How I worked with it |
|---|---|
| Windows 11 | Target operating system |
| Windows Autopilot | Provisioned devices with Windows Autopilot in the staging room |
| Intune-managed environment | Worked within an Intune- and Entra ID-managed endpoint environment |
| Entra ID-connected environment | Used Intune and Entra ID as part of the Windows 11 deployment workflow |
| BitLocker-enabled endpoints | Worked with BitLocker-enabled endpoints |
| Active Directory | Handled Active Directory account unlocks, password resets and group membership changes |
| ServiceNow | Handled approximately 65 ServiceNow cases a week |
| Wyse thin clients | Shared clinical stations; confirmed they still connected after each swap |
Platform context reflects tools encountered or used during deployment. Administration/configuration claims are limited to actions personally performed.
From the basement staging room to the nursing station
I worked at the device and user level. I provisioned devices with Windows Autopilot and operated inside a Microsoft-managed endpoint environment. Alongside on-site swaps, I coordinated Windows 11 migrations that could be completed remotely. A device counted as done only when it was on a supported build, the right person could work on it, and the clinical station was still whole.
Prep
Matched each device to its user and room on the deployment schedule and confirmed its Autopilot registration.
Stage
Provisioned devices with Windows Autopilot in batches in the basement staging room: out-of-box experience, Autopilot profile, then the Enrollment Status Page holding setup while required apps and policies installed.
Validate
Checked user sign-in, mapped drives, printers and required departmental applications before handoff.
Deploy on site
Swapped devices on clinical units at times that avoided patient care, and confirmed the Wyse thin clients at the same station still connected.
User readiness
Handed off only when the user confirmed they could do their normal work.
Post-deployment support
Handled approximately 65 ServiceNow cases a week, handled Active Directory account unlocks, password resets and group membership changes, and closed cases with clear notes and no patient data.
Not claimed: design or configuration of Autopilot profiles, Intune policies, app assignments, Entra ID or BitLocker settings; Active Directory work beyond account-level changes; building the deployment schedule; escalation work beyond the service desk; a lifetime device count; program completion; anything about old devices after the swap.
Per-device checklist (excerpt)
The validation categories and flow come from my work. Individual checks such as the peripherals list and naming convention are reconstructed, and the device name, user, unit and wording are fictional, with no hostnames, users or internal systems from the real environment.
Before the visit
- Device, user and room match the schedule (example: WS-CLIN-0142, J. Rivera, 4 West)
- Swap time confirmed outside patient care
- Attached peripherals noted: printers, label printers, scanners, badge readers
Autopilot provisioning
- Device registered in Autopilot with the correct profile
- Out-of-box experience and Enrollment Status Page finish without errors
- Device name follows the naming convention
- Required department applications installed
Validation before handoff
- User signs in with their own account
- Mapped drives, default and department printers work
- Department applications launch and reach their servers
- Wyse thin clients at the station still connect
Handoff and close
- User confirms they can do their normal work
- ServiceNow case closed with steps taken, no patient data in notes
What shaped the work, and how it ended
Constraints
- A fixed external deadline: October 14, 2025
- No lost workstations mid-shift; swaps fit around patient care
- No patient data in notes; nothing left a device or appeared in case notes
- Shared Wyse stations and department printers and applications had to work before handoff
- A site added mid-assignment: NYU Langone Hospital, Brooklyn, from July 2025
- Contractor scope: I worked inside a deployment workflow the program provided
Outcome
Completed my assignment through its scheduled end. Before it ended, a manager on another NYU Langone team asked me to join his team on a new contract.
Employment verification and the email asking me to join the other team are on file and available to hiring teams on request. No third-party statement exists yet for this engagement.
What I learned
- Validation before handoff is cheaper than a case after it
- In a hospital, the schedule belongs to patient care
- Identity runs through every step: a device is done only when the right person can sign in with the right access
- What I would do differently: keep my own daily log of devices staged, devices deployed and issues caught at validation, so I could show totals as well as rates
An IT project with a security reason behind it
| Element | In this program |
|---|---|
| Asset | Windows endpoints in hospital, outpatient and specialty spaces |
| Threat | Known Windows 10 vulnerabilities that would stop receiving fixes after October 14, 2025 |
| Exposure | Patient data viewed and entered on those endpoints |
| Control | Move endpoints to Windows 11, provisioned with Windows Autopilot into an Intune- and Entra ID-managed environment with BitLocker-enabled endpoints |
| Supporting controls | Validation before handoff; no patient data in case notes |
| Residual risk | Devices not moved by the deadline. Program-level status is outside what I can confirm |
The same risk is developed further in a simulated risk assessment set at Riverside Health, a fictional hospital. Those are simulated work samples, not claims about NYU Langone. See the simulated projects.
Now in the WGU M.S. in Cybersecurity and Information Assurance. This project is where I learned that endpoint work is security work: patching, identity, encryption and data handling all meet at the device.