Category Filter

How to enroll Windows 10 devices using provisioning package files

What is Windows provisioning package (ppkg)?

To configure end-user’s devices without imaging, Windows provisioning is the best way to go. Using Windows provisioning, administrators can quickly and seamlessly set up the configurations and settings for the enrollment process and deploy the configurations to bulk devices.

A provisioning package file (.ppkg) is a container for a collection of configuration settings. It can be created using a Windows 10 device, which can later be used for the bulk enrollment of Windows devices without any user intervention.

Benefits of enrolling devices using provisioning package

  • One-time setup – It is a one-time setup where the end users need to just power on the device, get connected to the network and install the ppkg file to get enrolled with Hexnode MDM.
  • Bulk Enrollment of devices – It allows large scale roll-out of corporate-owned devices.

To create ppkg file using Windows Configuration Designer

Create a Project

  1. Download and Install Windows Configuration Designer on a Windows 10 device.
  2. Open Windows Configuration Designer.
  3. Click on File and choose New project.
  4. Provide the project details.
    • Name: Provide a suitable name to identify the project.
    • Project folder: Choose the destination path for the file to be saved.
    • Description: Provide a suitable description regarding the package.
  5. Select project workflow as Provisioning package and click on Next.
  6. Choose the type of Windows edition and click on Next.
  7. If you want, you can import an existing provisional package to your project or click on Finish to create your project.

Customize the provisioning package

Once the project is created, you can select the desired customizations from the Available customizations.

  1. Expand Runtime settings and choose Workplace.
  2. Click on Enrollments.
  3. Provide your User Principal Name (UPN) and click on Add.
  4. On the left navigation page, click on the UPN and provide the following details for the enrollment process.
    • AuthPolicy: Select On-Premise.
    • DiscoveryServiceFullUrl: Provide the complete URL for the discovery service.(
    • EnrollmentServiceFullUrl: Provide the complete URL here.(
    • PolicyServiceFullUrl: Provide the complete URL here.(
    • Secret: Provide the secret key for the Windows enrollment here.
      You can get the secret key from your Hexnode MDM console.(Enroll > Settings > Authentication Modes > No Authentication mode > Default Password.)
  5. Save the project once you are done with adding all the settings. (File > Save)

Build the provisioning package

Once you have customized the provisioning package,

  1. Click on Export and select Provisioning package.
  2. Provide the following details and click on Next.
    • Name: This field will be pre-filled with the Project Name. However, you can change this name to a required one.
    • Version (in Major.Minor format): This field represents the default package version. You can change the current version by specifying a new value. (Optional)
    • Owner: Choose the package owner type here.
    • Rank (between 0-99): Choose a package rank between 0-99. Default rank is 0.
  3. If the package contains sensitive data that cannot be compromised, you can select the required security type.
    • Encrypt package: Select the option to encrypt the package. An encryption password will have to be provided.
    • Sign package: If you are signing the package, you need to provide a valid certificate.
  4. Provide the destination path to save the package and click on Next.
  5. Click on Build to build the package.
  6. If your build is successful, the package name along with the project and output locations will be displayed.
  7. Click on Finish.

Apply the provisioning package to the devices

Once the ppkg file is created, you can use this file to enroll Windows devices without any user intervention.

  1. On a Windows PC/Tablet, navigate to Settings > Accounts > Access work or school > Add or remove a provisioning package and click on Add a package.
  2. From the removable media that contains the ppkg file, select the package to install.
  3. The device gets enrolled with Hexnode MDM.

  • ppkg file can be shared by any means and you need to click on the file to install and the device gets enrolled with Hexnode MDM.


  • You can verify the enrollment process, by navigating to Settings > Accounts > Access work or school > Add or remove a provisioning package. The provisional package will be listed here.