mirror of
https://github.com/fleetdm/fleet
synced 2026-05-24 09:28:54 +00:00
f2f1f66d11
Closes #38916 Related: #34993, #33985, fleetdm/confidential#13228 ## Changes **Article update** (`articles/windows-mdm-setup.md`) - Adds "Migrating from another MDM solution" subsection under **Manual enrollment** with overview of common migration issues and links to remediation scripts **New scripts** (`docs/solutions/windows/scripts/`) - `reset-mdm-enrollment-flag.ps1` — Resets MmpcEnrollmentFlag blocking MDM status after migration - `remove-stale-mdm-enrollment-records.ps1` — Clears orphaned enrollment GUIDs, AAD discovery cache, and MS DM Server cache - `fix-workplace-join-configuration.ps1` — Re-enables Automatic-Device-Join task and configures Workplace Join policies - `remove-unreachable-wsus-configuration.ps1` — Removes unreachable WSUS server config that breaks Windows Update ## Context Customers migrating Windows hosts from Intune to Fleet have been hitting recurring enrollment issues, MDM status stuck on "Off," enrollment errors (`0x80190190`, `0x8018000a`), and Windows Update breakage from leftover RMM agents. These scripts consolidate the workarounds from multiple customer engagements into self-serve remediation that can be deployed via **Controls > Scripts**. --------- Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
22 lines
1.1 KiB
PowerShell
22 lines
1.1 KiB
PowerShell
# Please don't delete. This script is referenced in the guide here: https://fleetdm.com/guides/windows-mdm-setup#migrating-from-another-mdm-solution
|
|
# Re-enables the Automatic-Device-Join scheduled task and configures Workplace Join policies
|
|
# that may be misconfigured after migrating from another MDM solution.
|
|
# Reboot the device after running this script.
|
|
|
|
# 1. Re-enable Automatic-Device-Join scheduled task
|
|
$TaskPath = "\Microsoft\Windows\Workplace Join\"
|
|
$TaskName = "Automatic-Device-Join"
|
|
try {
|
|
$task = Get-ScheduledTask -TaskName $TaskName -TaskPath $TaskPath -ErrorAction Stop
|
|
Enable-ScheduledTask -InputObject $task
|
|
Write-Host "Re-enabled Automatic-Device-Join task"
|
|
} catch {
|
|
Write-Host "Automatic-Device-Join task not found - skipping"
|
|
}
|
|
|
|
# 2. Configure Workplace Join policy
|
|
$WJPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WorkplaceJoin"
|
|
if (-not (Test-Path $WJPath)) { New-Item -Path $WJPath -Force | Out-Null }
|
|
Set-ItemProperty -Path $WJPath -Name "autoWorkplaceJoin" -Value 1 -Type DWord
|
|
Set-ItemProperty -Path $WJPath -Name "BlockAADWorkplaceJoin" -Value 0 -Type DWord
|
|
Write-Host "Configured Workplace Join policy"
|