Since its debut in 1985, Windows PCs and laptops have become a dominating presence in both business and personal computing spaces. When we have a look at the global market share, Windows operating system dominates it with a whopping lead of around 77 percent, with macOS trailing behind as a distant second. Hence, it comes as no surprise that managing the corporate Windows machines is indispensable for an IT admin. This blog aims to provide a basic guide to Windows device management to get you started.
Mobile Device Management solutions have always been the optimal option to manage enterprise mobile devices, but it used to fall short for traditional desktop and PCs. Legacy Windows devices did not have MDM features built into them, making them highly difficult to manage in a simple and efficient manner. Traditionally, Windows devices were managed using agent-based client management tools. The introduction of Windows 8.1 showed some development with some MDM concepts. The progress was complete in 2015 as all the modern MDM concepts were realized with the latest Windows 10 OS. Now, with a complete UEM solution like Hexnode, Windows 10 devices can be managed remotely from a single Web Console along with the Android, iOS and macOS corporate devices.
What is Windows device management?
Windows device management is the process of monitoring, auditing, securing and managing the Windows laptops and phones in an enterprise or educational environment, usually done in a centralized manner.
Why MDM for Windows?
For managing Windows devices, group policies have long been the go to method. Group Policy is a feature of Microsoft Windows Active Directory that provides centralized management and controls the connected user and computer accounts. Group policies are a trusted staple for the Domain admin. However, managing and keeping track of a fleet of devices with varying sets of group policies can be difficult for even veteran admins. For common enterprise requirements, MDM would prove to be an easier and less time-consuming option. In case of more specialised and extensive feature requirements, dependencies on the group policy management cannot be eliminated entirely. For example, deploying apps and configuring network settings like Wi-Fi can easily be done using an MDM solution. However, specialized tasks such as preventing access to specific control panel applets can only be achieved by using a Group Policy.
How can you manage your Windows 10 devices using Hexnode MDM?
From initial deployment to the end-user involvement, it is important to support, manage and monitor the devices throughout their lifecyle. For managing Windows 10 devices with Hexnode, there are four critical elements:
- Enrollment and setup
- Configuring policies and settings
- Securing against unauthorized access and attacks
- Asset Management
1. Enrollment and Setup
Enrolling a device with Hexnode establishes a connection between the MDM and and the device through which they communicate with each other. Windows PCs and tablets can be enrolled in different methods using either Open or Authenticated enrollment. The devices can be enrolled using either Hexnode Installer App or the Native enrollment method. For bulk enrollment of devices, provisioning package (.ppkg) file can be used for a one-time setup so that the user can enroll the devices the first time they are turned on by installing the ppkg file. On enrolling a Windows device, the Hexnode Notifications App gets automatically installed on the device. The admin can send broadcast messages to the users that are received and displayed on the installed app.
2. Configuring Policies and Settings
After enrolling the devices, the devices have to be configured properly with the required configurations and settings. These settings can be configured in a policy. The policy can be assigned to individual devices or groups of devices based on the requirements. You can create either static or dynamic groups for applying the policies. We have discussed a brief overview of the settings you can configure using an MDM.
Managing the apps installed in the corporate devices is an essential feature for any admin. The business devices often need to have some apps installed in them. Getting each user to install the apps would be a hassle. Hexnode simplifies this task by enforcing the app installation of the apps configured as mandatory apps in the MDM policy. The mandatory apps are silently installed on the devices. Both store apps and enterprise (MSI) apps can be deployed using the Mandatory Apps feature.
To prevent the users from installing unnecessary or malicious applications, the admin can either blacklist or whitelist the applications. If a blacklisted application is installed on the device, the device is marked as non-compliant. On whitelisting the apps, all the apps other than the ones whitelisted are considered blacklisted.
For accessing company resources such as enterprise Wi-Fi on BYOD devices, the user need not know about the complex settings or the credentials. With Hexnode, the admin can directly push the Wi-Fi configuration settings to the enrolled Windows devices. The settings can be configured remotely and then deployed to the devices automatically without the user having to worry about connecting to the Wi-Fi manually.
Hexnode allows you to configure email and Exchange ActiveSync accounts remotely and push it to the enrolled Windows devices over-the-air. Exchange ActiveSync syncs emails, attachments, calendar, contacts, and tasks between the device and your email account server.
In the enterprise IT world, device and data security is one of the most important elements in the device lifecycle. Preventing the compromise of device security is infinitely easier with an MDM. Strong password policies, Bitlocker encryption, threat management, and configuring settings restrictions are some ways to secure the systems
Enforce strong passcode policies to secure the corporate data in the Windows devices. The passcode can be made mandatory and you can set a passcode age so that the passcode is changed frequently
BitLocker is Microsoft’s full-disk encryption tool for Windows PCs. It enforces encryption on system drives, fixed data drives, and removable drives for data protection. It actively prevents unauthorized users from accessing device data even if the device is stolen or lost. Hexnode MDM allows you to setup BitLocker and configure the encryption settings for the operating system, fixed data drives, and removable drives remotely in a single policy.
Windows Defender is an anti-malware tool for threat management in Windows devices. Microsoft Defender offers real-time protection against viruses, spyware, malware or any other software threats. The admin can configure various Windows Defender settings in a policy from the HexnodeWeb Console. These settings are controlled in Windows Defender Security Centre (WDSC), a built-in Universal Windows Platform (UWP) app that offers the continuous real-time protection for Windows devices.
Additionally, you can also configure Windows Defender Application Guard settings with Hexnode. Windows Defender Application Guard is a security tool designed to protect devices from security attacks originating from untrustworthy websites by enforcing browser isolation. If the user tries to access a website that is not trusted by the organization, an isolated anonymous browsing session is opened so that the enterprise data is not accessible to any potential attackers
Depending on the business use-case, the IT admins can configure various restrictions for device settings in a policy. For instance, the users can be restricted from deleting the workplace account from device settings so that the device cannot be disenrolled from the MDM by the user. The device security can be further ensured by mandating signed certificate for installing provisioning package files and restricting automatic pairing with other devices.
4. Asset Management
The IT admin has to continually track and monitor the enrolled devices and users even after the initial setup to ensure proper functioning in a seamless manner. The dashboard in the Hexnode Web Console gives a general overview of the asset status in a single glance. The quick actions allow the admin to execute instant device scans, send a broadcast message, install an application or even wipe/disenroll the device.
Reports and analysis
Analyzing and monitoring corporate asset information is always easier with solid reports. Hexnodeallows you to generate complete device reports and granular reports based on specific actions at any time manually or at a scheduled time. The reports can be easily exported as either PDF or CSV files.
Handling lost devices
The corporate devices may get stolen or misplaced even with utmost care. In such an even, the sensitive data can be protected by performing a remote wipe with Hexnode Remote Actions on the lost device.