Category filter

How to enroll Windows PCs & Tablets?

Device management is integral in restricting, managing, and securing your Windows devices. Hexnode supports the management of PCs and tablets running Windows 10 or later. To manage a device using Hexnode, it must be enrolled in the UEM portal. Enrollment establishes a connection between the UEM and the device through which they communicate with each other.

On enrolling a Windows device, the Hexnode UEM app will get automatically installed on the device. The broadcast messages sent by the admin from the Hexnode portal are received through this app.

Note:


Log in to your Windows 10/11 device as an admin user to enroll the device in Hexnode UEM.


Windows PCs and tablets can be enrolled via different methods:
  1. Open Enrollment
  2. Authenticated Enrollment
  3. PPKG enrollment
  4. Google Workspace Enrollment for Windows.
  5. Windows Virtual Machine Enrollment
  6. Co-Management
  7. Windows Autopilot
Pre-requisites

  • Enrollment via Hexnode Installer app is supported on:
    • Windows 10 v1803 and later.
    • Windows 10 v1703 to 1709, if Visual C++ Redistributable and .NET framework version 4.7.1+ are installed on the devices.
    • Windows 11
  • To ensure that the device runs .NET framework 4.7.1+, you may execute the following command from the PowerShell console:

    Get-ItemProperty –Path “HKLM:SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full” | Format-List
    ensure that the device runs a supported version of .NET framework
    Identify the Version of the .NET framework installed on the device from the displayed details.

    If the device runs an unsupported version, you should download the updated version of .NET framework. Once downloaded, you can install it by opening the .EXE file from the Downloads folder.

  • If the VC redistributable or .NET framework dependencies are not installed on the devices, an error message asking you to install the missing dependencies will be shown during enrollment.
    missing dependencies interrupts enrollment
  • Click OK. It redirects you to a page to download the latest Visual C++ Redistributable .EXE file.
    download the latest supported version of visual c++ redistributable
    1. Choose a package that matches the system architecture and edition of your OS for perfect compatibility. (Any attempt to install a 64-bit dependency package on a 32-bit machine always fails.)
    2. Download the .exe file.
    3. Open the file from the Downloads folder.
    4. Agree to the terms and conditions.
    5. Click on Install.
      Install the .exe file and agree to the license terms & conditions to download visual studio


Tips:

  • If you are using Windows 10 v1803 or later device, it is recommended to enroll the device via the Hexnode Installer app.
  • Use the native device enrollment method, if you cannot install the dependency packages on your device running Windows 10 v1703 till 1709.

Open Enrollment

Configure Open Enrollment on the Hexnode portal
  1. Go to Enroll → Platform-Specific → Windows → Windows PCs & Tablets.
  2. Click on Switch to Open Enrollment.
  3. Choose the user Domain. Only the user belonging to this domain can be chosen as the default user.
  4. Switch to Open Enrollment.
  5. Select a Default User and enter a Default password.
  6. Change the Ownership based on the device to either Personal or Corporate.
  7. Click Next.


Note:


If you want to enable users to enroll the devices on their own, it is best to send them enrollment requests via Email or SMS. This enrollment request will contain the enrollment URL and instructions for enrolling devices in Hexnode. To send such a request to the user, go to Enroll > Settings > Request Modes and select Email or Text/SMS. Then, go to Manage > Users > select the users, click on Actions > New Enrollment.



Enroll the device via Open Enrollment

To enroll a Windows device in Hexnode via open enrollment, you can use either of the following enrollment methods:

Method 1: Using Hexnode Installer app

  1. Enter the Enrollment URL in a web browser. It should be in the format: https://portalname.hexnodemdm.com/enroll/
  2. Download the Hexnode Installer Setup by clicking on Download.
  3. Run the setup and install the Hexnode Installer.
  4. Hexnode Installer will prompt you to install any required dependency packages if they are missing on your device. Follow the on-screen instructions and complete the dependency installations.
  5. After successful installation of the required dependency packages, Hexnode EULA will be displayed. Read the EULA and click on Agree and Enroll.
  6. If the enrollment request was successfully processed, go to step 8.
  7. In case the process fails, to continue the enrollment:
    • Click on Enroll. This will redirect you to Settings > Accounts > Access work or School > Enroll only in device management on your device.
    • On the ‘Set up a work or school account’ pane, the admin’s username and enrollment server address will be auto-filled. Click on Next.
    • After reading the instructions regarding device set up, click Got it. Hexnode will now connect to the workplace or school. It may take a few minutes to set up the connection. All the configurations and apps set up for the user will now be pushed to the device.
  8. Click on Next, then Got It. Wait for a few minutes for Hexnode to connect to the school or workplace.
  9. The Hexnode UEM app will now be installed, and all the configurations will be applied to the device. Click Done and exit the Hexnode Installer.
  10. Click Finish to exit the Setup.
  11. Note:

    If the configured settings and apps are not reflected on the device after waiting for a few minutes, go to Settings > Accounts > Access work or school > Info and tap Sync.

Method 2: Native Enrollment

  1. Go to Settings → Accounts → Access work or school.
  2. Select Enroll only in device management.
  3. Enter your work mail ID and click Next.
  4. Now, you will be asked to enter your Microsoft password, simply neglect this by closing the tab.
  5. Enter the server URL. It will be in the format: https://<yourportal>.hexnodemdm.com and click Next.
  6. Read the instructions regarding the device set up and click Got it. You have now successfully enrolled your laptop.

Hexnode will now connect to the Workplace or School. It may take a few minutes to set up the connection, all the configurations and apps that your organization has set up for the user will soon be pushed to the device. If the user doesn’t have access to these after waiting for a few minutes, go to Settings > Accounts > Access Work or school > Info and click on Sync.


Authenticated Enrollment

Configure Authenticated Enrollment on the Hexnode portal

You can configure authenticated enrollment on the Hexnode UEM portal via Email/SMS enrollment or Self-Enrollment.

Method 1: Email or SMS Enrollment

Use email/SMS enrollment to send enrollment requests to users. The request includes the enrollment instructions, and the server URL for enrolling the devices.

  1. Go to Enroll → Platform-Specific → Windows → Windows PCs & Tablets.
  2. Click on Switch to Authenticated Enrollment → Authenticated Enrollment.
  3. Select the types of users (AD/ Microsoft Entra ID/ Local/ Google/ Okta) to be enrolled via Enrollment Request.
  4. Change the Ownership to Personal, Corporate, or Let the user choose.
  5. Click Next.
  6. A message “Enrollment settings successfully updated” will be displayed on the portal.
  7. Check the box corresponding to Email or SMS based on how you want to send the enrollment request.
  8. Change the Domain and select the User.
  9. Click on Send.

Method 2: Self-Enrollment

  1. Go to Enroll → Platform-Specific → Windows → Windows PCs & Tablets.
  2. Click on Switch to Authenticated Enrollment → Authenticated Enrollment.
  3. Select the types of users (AD/ Microsoft Entra ID/ Local/ Google/ Okta) to be enrolled via Self Enrollment.
  4. Change the Ownership to Personal, Corporate, or Let the user choose.
  5. Click Next.

Note:


Configure AD, Microsoft Entra ID, Google, or Okta directory in the Hexnode portal to enroll the device via directory authentication.



Enroll the device via Authenticated Enrollment

To enroll a Windows device in Hexnode via authenticated enrollment, you can use either of the following enrollment methods:

Method 1: Using Hexnode Installer app

To enroll a device using the Hexnode Installer app, follow the procedure:

  1. Enter the enrollment URL in a web browser. It should be in the format: https://portalname.hexnodemdm.com/enroll/
  2. Download the Hexnode Installer Setup by clicking on Download.
  3. Run the setup and install the Hexnode Installer.
  4. Hexnode Installer will prompt you to install any required dependency packages if they are missing on your device. Follow the on-screen instructions and complete the dependency installations.
  5. After successful installation of the required dependency packages, Hexnode EULA will be displayed. Read the EULA and click on Agree and Enroll.
  6. The Hexnode Installer then checks with the portal for the enrollment authentication settings.
  7. If you are a local or AD user, enter your email ID/sAMAccount Name and click on Authenticate. If you are a Microsoft/Googe/Okta user, you can authenticate by signing in with the corresponding directory credentials.
  8. If the authentication fails, an error message “Authentication failed! Try Again!” will be displayed. Click on Enroll to re-authenticate.
  9. Now the device will process the enrollment request. If the process succeeds, go to step 11.
  10. In case the process fails, to continue the enrollment:
    • Click on Enroll. This will redirect you to Settings > Accounts > Access work or School > Enroll only in device management on your device.
    • On the ‘Set up a work or school account’ pane, the admin’s username and the enrollment server address will be auto-filled. Click on Next.
    • Read the instructions regarding the device set up and click Got it. Hexnode will now connect to the Workplace or School. It may take a few minutes to set up the connection. All the configurations and apps that your organization has set up for the user will soon be pushed to the device.
  11. The Hexnode UEM app will now be installed, and all the configurations will be applied to the device. Click Done to exit the Hexnode Installer.
  12. Click Finish to exit the Setup.
  13. Note:

    If the configured settings and apps are not reflected on the device after waiting for a few minutes, go to Settings > Accounts > Access work or school > Info and tap Sync.

Method 2: Native Enrollment

  1. Go to Settings → Accounts →Access work or school.
  2. Select Enroll only in device management.
  3. Enter your work email and click Next.
  4. Now you will be asked to enter your Microsoft password, simply neglect this by closing the tab.
  5. Enter the server URL. It will be in the format: https://<yourportal>.hexnodemdm.com and click Next.
  6. If you are enrolling the device via AD or local authentication, select the domain from the dropdown, enter the Email/SAM Account Name and password and click Authenticate.

    Or, click on Sign in with Microsoft/Google/Okta to authenticate with the directory credentials.

  7. Read the instructions regarding the device set up and click Got it. You have now successfully enrolled your PC in the Hexnode portal.

Hexnode will now connect to the Workplace or School. It may take a few minutes to set up the connection, all the configurations and apps that your organization has set up for the user will soon be pushed to the device. If the user doesn’t have access to these after waiting for a few minutes, go to Settings > Accounts > Access Work or school > Info and click on Sync.




Notes:

  • To automatically install the Hexnode agent app on devices enrolled through Native enrollment, make sure to enable the “Install Hexnode Service App Silently on Windows Devices” option in the Hexnode App Updates section under Admin > General Settings before enrollment. The installation process will begin automatically after 5 minutes.

    Enable the 'Install Hexnode Service App Silently on Windows devices' option to automatically install the Hexnode agent on devices enrolled in Hexnode without the Hexnode agent app

  • If you haven’t enabled the “Install Hexnode Service App Silently on Windows Devices” option during enrollment, you can still manually trigger the installation of the Hexnode agent app by clicking the refresh button next to the Hexnode Service (Agent) App status in the Enrollment Details section of the Device Summary for that Windows device from the Hexnode UEM console.

    Refresh button on the Device Summary page to initiate the installation of the Hexnode agent app

  • If you have set a password for the local user in the portal and have sent enrollment request to the same user, use the credentials in the enrollment request to authenticate.
  • If Hexnode UEM is already installed on the device, the app would be cleared during the enrollment. Before clearing the app, its data and logs will be backed up and stored as zip files on your Windows machine’s primary partition.
  • Custom Script, Remote view and MSI app installation are supported only on devices enrolled via the Hexnode Installer as they require the latest versions of the Hexnode UEM app to be installed on the device.

What happens when the MDM profile/Agent app is removed?

A Windows device is marked as Enrolled in the device summary page of the UEM portal once it gets enrolled in Hexnode UEM. Enrollment proceeds with MDM profile installation and/or agent app installation, which, when complete, result in the device being managed by Hexnode. But removing the MDM profile or agent app from the device results in Hexnode UEM having limited control over the device. In that case, most policies associated, and actions executed on the device will not take effect.

Removing the MDM profile doesn’t affect the admin’s ability to execute most remote actions, except for the ones executed via CSPs like Scan Device and Scan Device Location. But the policies that can be applied get limited to the following Restrictions:

  1. Camera
  2. Cortana voice assistant
  3. Use Cortana if device is locked
  4. Location services
  5. Change language
  6. Sync Settings
  7. Cellular data roaming
  8. Show toast notification on lock screen

And certain Advanced Restrictions, like:

  1. USB connection
  2. Allow Region
  3. Search can use user location
  4. Internet Sharing

If the agent app is removed, remote actions like Execute Custom Script, Join AD Domain, Power off Device, etc., that require an agent app can no longer be executed. However, policies, including all the restrictions, can be successfully deployed.

Troubleshooting Tips

  • Enrolling Devices
  • Managing Windows Devices