One USB stick. Wipe to domain-joined, no keystrokes.

Reimaging a Windows machine properly is a day of reading before it is ten minutes of work. You need to know which OSDCloud cmdlet, what an unattend file is, that the specialize pass exists, where an enrollment hook goes, and why the thing you did on the last box did not take on this one.

RFF collapses that into a form. You get a boot stick. You boot the machine. You walk away. It comes back named, enrolled in your console, and domain-joined.

Start free → · No credit card · Free for 100 endpoints

What actually happens

1. Build the media in the console. Pick a name pattern, a domain to join, and an imaging token. RFF produces WinPE boot media.
2. Boot the machine off it. No keystrokes after the boot menu.
3. Windows gets applied. OSDCloud pulls the ESD from Microsoft directly, at deploy time.
4. First boot enrolls it. The machine appears in your device list already named, already enrolled, pending your approval.
5. It joins the domain and updates itself to the current agent on its next poll.

Here is a real run from our lab, not a projection:

We never host or ship Windows media

This is worth saying plainly because it is unusual, and because it is the reason this stays free at your scale.

Our boot artifact is a few hundred megabytes of WinPE and scripts. The Windows image itself comes straight from Microsoft at deploy time. We do not keep an image library, you do not maintain one, there is no OS licensing exposure sitting on somebody’s file server, and there is no multi-gigabyte download coming out of our infrastructure and onto your bill.

The practical version: there is no golden image to rebuild every time a cumulative update ships. There is nothing to go stale.

The part that is easy to fake and hard to do

Plenty of tooling will tell you a machine is domain-joined. A registry entry can make a box look joined.

RFF verifies it on the machine after reboot:

Hostname     : CLIENT67
PartOfDomain : True
Domain       : corp.contoso.com
DomainRole   : 1                       (member workstation)
Test-ComputerSecureChannel : True

Test-ComputerSecureChannel is the assertion that matters. It proves the computer account password actually authenticates against the domain controller. Anything less is a claim, not a join.

Enrollment is token-gated, and the tokens are bounded

A boot stick that enrolls machines into your tenant is a credential. It is treated like one.

Imaging tokens are bounded by machine count and by expiry, so a stick left in a drawer stops working on its own. Every machine that enrolls records which token it came in on, so you can answer “where did this device come from” months later. New machines land pending approval rather than appearing in your fleet unannounced.

Where this fits

Imaging is one action in the same console that patches, deploys, and reports on the machine afterwards. That matters more than it sounds: the answer to “this laptop is dying, and its replacement needs to look identical” is one workflow rather than three tools.

If you are replacing hardware because it cannot run Windows 11, that is the same loop - find the machines that need replacing, then bring their replacements up the same way.

Honest limits

• Windows only, and the imaging path targets Windows 10 and 11 client editions.
• You need a working network in WinPE. Machines that need a vendor NIC driver in PE need that driver added to the media.
• We are a small vendor. The runbook above is what we have proven in our own lab, end to end, and we would rather show you that than a feature matrix.

Start free → · Free for 100 endpoints, every feature included. See pricing.