Silent enrollment of remote Windows laptops with Hexnode MSI installerSolved

Hi @gareyy ,

For first-time enrollment of Windows devices, use the Windows migration package from the Hexnode portal.

Go to Enroll > Windows > Migrate, add the required configuration file, and download the MSI package. The MSI can then be deployed silently using standard MSI silent installation switches, provided it is executed with administrative or system privileges.

Hexnode cannot execute scripts on devices that are not already enrolled. So, if the device does not yet have the Hexnode agent installed, Hexnode policies, custom scripts, or self-service elevation cannot be used to start the enrollment.

In short:

• For unenrolled Windows devices, deploy the generated MSI package.
• The MSI must be run with admin/system privileges.
• Hexnode does not provide a separate script that embeds or supplies the local admin password for first-time enrollment.
• Self-service elevation applies only after the Hexnode agent is already installed and managing the device.

Regarding the MSI size, the installer package size cannot be reduced from the Hexnode side. Since it is delivered as an MSI package, it should be deployed as generated from the portal and installed silently using standard MSI behavior under administrative or system context.

Best Regards,
Isabel Lora
Hexnode UEM

That makes sense. I was hoping the self-service option could let the user elevate temporarily and install it, but I guess that won’t work because the agent is not installed yet.

Correct. Self-service elevation is managed through the Hexnode agent, so it cannot be used as a bootstrap method for fresh Windows enrollment.

For remote users, the practical approach is to distribute the downloaded migration MSI through a method that can already run installers with admin rights, such as an existing endpoint management tool, remote management tool, or another deployment mechanism available in your environment. Once the MSI completes successfully, the device enrolls into Hexnode silently based on the migration package configuration.

Best Regards,
Isabel Lora
Hexnode UEM

Is email the only option for Windows enrollment authentication? Can enrollment invites be sent another way, like SMS?

Windows enrollment options include sending the enrollment invite by SMS where supported from the enrollment settings. However, Hexnode does not support configuring a custom SMS gateway for sending those enrollment messages.

Best Regards,
Isabel Lora
Hexnode UEM