Windows commands
A command goes to an Enrolled PC. The PC receives it when it is woken, or when the check-in is due. Locking the screen on Windows 10 and 11 is not built into the operating system — it needs the helper.
When to use thisThe PC is managed and Windows MDM is on.
Open the device and click Send command. The group is Windows (OMA-DM). A command that does not qualify is hidden.
Commands in the dialog
| Command | What the PC does | Needs the helper? |
|---|---|---|
| Lock Device | Locks the screen. | Yes. Without the helper the command is hidden. |
| Device Location | Gets the location. On the PC, Location must be on and Test location must have been run in the helper. | Yes. |
| Reboot Device | Restarts. | No. |
| Defender Quick Scan | A quick scan. | No. Acknowledged means Windows accepted it. The scan may not be finished. |
| Defender Full Scan | A full scan. It can take a long time. | No. Read the status the same way as a quick scan. |
| Defender Update Signatures | Updates Defender signatures. | No. |
| Install Configuration Profile | Sends one profile to this PC. | No. Assigning a whole group is done on Profiles. |
| Delete Configuration Profile | Removes one profile from this PC. | No. A profile assigned by group is removed by unassigning it on the profiles page. |
| Unenroll | The PC leaves management. | No. |
| Wipe Device | Resets the PC to setup. | No. |
| Protected Wipe | Removes the management part but keeps user accounts and data. | No. It is still a wipe. Read it carefully before you send it. |
Wipe Device and Protected Wipe both erase something on the PC. Unenroll only removes management. Delete from MDM on the device page removes the list row. It does not replace those two wipe commands.
Defender, BitLocker, and TPM results on the inventory tab update the next time the PC reports, not the moment the command is accepted.
Common questions
- The scan is Acknowledged, but the inventory tab has not changed?
- Windows accepted the command to start the scan or update signatures. Health numbers are read on a later session.
- Without WNS, does the command still arrive?
- Yes, when the Check-in interval is due. WNS only makes the PC ask sooner. See Turn on the service.