Turn on Windows management
One page for the MDM switch, the password every PC shares, the helper, and waking a PC. A PC can enroll only when the corner label is Ready to enroll.
Settings → Windows → Service settings. The button Enroll device → Windows PC opens this page too.
Turn it on and get the password
Turn on the Windows MDM switch. The label becomes Ready to enroll when the organization accepts new enrollments.
Check-in interval is how many minutes the PC asks for work on its own when there is no WNS wake-up. Change the number and click Save. An enrolled PC receives the new number at the next check-in.
Under Enrollment password, click Generate if it says Not generated. This password is shared by every PC in the organization. Give it to the person enrolling the PC, together with the MDM server value.
Which address to paste on the PC
| Field | Where it is used |
|---|---|
| MDM server | The server box when you add a work or school account. Windows adds the discovery path itself. This demo shows https://spike-mdm.click — your organization will show your server. |
| Discovery URL | For checking. Do not paste this whole URL into the server box on the PC. |
| Management URL | The address the PC talks to after it is enrolled. It is not the box the user types at enrollment. |
| Enrollment CA | Only when the server requires a client certificate. Download PEM appears once one exists. This demo is Not generated. |
The username on the PC should be the person’s email, so the PC is tied to that person. The steps at the PC: Enroll a PC.
Helper and WNS
Copy the helper folder to the PC and run install.cmd.
Enter the MDM server, the organization’s short name, and the enrollment password, then Enroll helper. The device id in the helper must match the hardware tab of that device in VN-MDM.
To get a location: turn on Location and Wi-Fi in Windows, and click Test location in the helper before you send the command here.
WNS push wakes the PC immediately. Without it, the PC fetches commands on the Check-in interval. Fill in Package family name and Package SID from Partner Center → Product identity. Client secret is the secret value shown once, not the Secret ID. Click Save. Once it is saved, Test connection tries the push path. Remove credentials clears the WNS configuration, and the PC returns to the check-in schedule.
Common questions
- Test connection says there is no push channel yet?
- The path to the push service can still be fine. The PC registers a channel at a later sync. Commands still arrive on the Check-in interval.
- Lock is missing from the command box?
- The helper is not enrolled on that PC. Restart and Defender do not need the helper. See Commands.