# Enroll Windows Server via Windows PowerShell Deployment Overview ------------------- While graphical setup wizards are suitable for standalone servers, modern enterprise infrastructure often relies on headless architectures and automated deployment pipelines. Enrolling Windows Server via PowerShell is a highly efficient, command-line-driven method that completely eliminates the need for visual interaction. Instead of downloading an installer and clicking through a GUI, System Administrators execute a pre-compiled PowerShell script provided by the Hexnode console. This script handles the entire lifecycle automatically: it temporarily bypasses local execution policies, securely fetches the generic Hexnode agent from the cloud, verifies its digital signature, silently installs the application using a Base64-encoded Enrollment Token, and cleans up the temporary files—all within seconds. This method is the required standard for provisioning GUI-less environments (like Windows Server Core) and integrating UEM enrollment into larger DevOps automation workflows. Supported Platforms & Prerequisites --------------------------------------- Before executing the deployment script, ensure the target Windows Server meets the necessary baseline requirements. **Supported Operating Systems:** - Windows Server 2019 - Windows Server 2022 - Windows Server 2025 **Deployment Prerequisites:** - **Elevated Privileges:** The script must be executed within an elevated PowerShell session (Run as Administrator). - **Active Internet Connectivity:** The Windows Server requires an active outbound connection (Port 443/HTTPS) to download the .msi package in real-time and authenticate the enrollment token against your Hexnode UEM portal. - **PowerShell Environment:** Windows PowerShell 5.1 or later (standard on supported Server OS versions). Enterprise Use Cases -------------------- System Administrators and DevOps engineers should choose the PowerShell enrollment method in the following scenarios: - **Windows Server Core Provisioning:** Because Server Core completely lacks a graphical desktop (meaning standard .msi wizards cannot be displayed), this command-line method is the only way to natively enroll these lightweight, headless servers. - **DevOps & Automated Bootstrapping:** The script can be seamlessly injected into post-deployment automation tools (like Terraform, Ansible, AWS UserData, or VMware customization specifications) to ensure Windows Servers are enrolled into Hexnode the moment they are provisioned. - **Bulk Silent Deployments:** Infrastructure teams can push this script via existing legacy management tools (like an RMM or Group Policy) to silently enroll hundreds of existing Windows Servers in the background without interrupting active user sessions. Enrollment Workflow ------------------- ### Step 1: Portal Configuration (Hexnode Admin Console) To begin, you must act from your Hexnode UEM console to retrieve the specialized enrollment script. 1. Log in to the Hexnode UEM console. 2. Navigate exactly to: **Enroll > Platform-Specific > Windows Server > Windows Server Enrollment > Information**. 3. Select your desired Enrollment Profile from the dropdown menu. **Understanding the Profile:** In Hexnode UEM, an enrollment profile dictates the initial onboarding experience by defining general settings (like device ownership and group assignment), device configurations, and user authentication methods. Learn more about configuring [Windows Enrollment Profiles](https://www.hexnode.com/mobile-device-management/help/windows-enrollment-profiles/). 4. Click the **View** option located beside the chosen profile. This allows you to quickly double-check the profile’s assignment rules before you deploy. 5. Scroll down to the Enrollment Instructions section and locate the **Enroll using Windows PowerShell** section. 6. Here, you will find the **Installer download URL**, the **Enrollment Token**, and a fully generated PowerShell script block. The Hexnode portal automatically embeds the universal download URL and your specific Enrollment Token directly inside this script for seamless execution. [![Screenshot of the Hexnode UEM console showing the Information sub-tab under Windows Server Enrollment, accessed from the Platform-Specific section of the Enroll tab. The interface highlights the Enroll using Windows PowerShell section after an Enrollment Profile has been selected. It displays the Installer download URL, the Enrollment Token, and a fully generated PowerShell script block where the portal automatically embeds the download link and unique token for seamless execution on the target Windows Server.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/08/Enrolling-a-Windows-Server-via-Windows-PowerShell-in-Hexnode-UEM.png "Enrolling a Windows Server via Windows PowerShell in Hexnode UEM")](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/08/Enrolling-a-Windows-Server-via-Windows-PowerShell-in-Hexnode-UEM.png) 7. Copy the entire script block to a secure clipboard. **Reference PowerShell Script:** Note that when copied from your portal, the and placeholders will be automatically populated with your actual portal data. **Store current execution policy to safely restore it post-installation** $oldPolicy = Get-ExecutionPolicy -Scope Process # Temporarily bypass execution policy for this specific session only Set-ExecutionPolicy Bypass -Scope Process -Force try { # Define the temporary path for the downloaded installer $tempMsi = "$env:TEMP\\hexnode\_agent.msi" Write-Host "Downloading Hexnode Agent..." -ForegroundColor Cyan # Securely fetch the installer payload from the Hexnode UEM portal Invoke-WebRequest -Uri "" -OutFile $tempMsi Write-Host "Verifying signature..." -ForegroundColor Cyan # Verify the digital signature to ensure payload integrity if ((Get-AuthenticodeSignature $tempMsi).Status -ne 'Valid') { throw "Security Alert: Invalid digital signature!" } Write-Host "Installing and enrolling server..." -ForegroundColor Cyan # Silently execute the MSI passing the unique enrollment token $process = Start-Process "msiexec.exe" -ArgumentList "/i `"$tempMsi`" /qn ENROLLMENTTOKEN=" -Wait -NoNewWindow -PassThru if ($process.ExitCode -eq 0) { Write-Host "Success! Server enrolled." -ForegroundColor Green } else { throw "Install failed with code: $($process.ExitCode)" } # Clean up the downloaded installer from local storage Remove-Item $tempMsi -Force } catch { Write-Host "Enrollment Failed: $\_" -ForegroundColor Red } finally { # Safely revert the execution policy back to its original state Set-ExecutionPolicy $oldPolicy -Scope Process -Force } 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 $oldPolicy = Get-ExecutionPolicy -Scope Process \# Temporarily bypass execution policy for this specific session only Set-ExecutionPolicy Bypass -Scope Process -Force try { \# Define the temporary path for the downloaded installer $tempMsi = "$env:TEMP\\hexnode\_agent.msi" Write-Host "Downloading Hexnode Agent..." -ForegroundColor Cyan \# Securely fetch the installer payload from the Hexnode UEM portal Invoke-WebRequest -Uri "" -OutFile $tempMsi Write-Host "Verifying signature..." -ForegroundColor Cyan \# Verify the digital signature to ensure payload integrity if ((Get-AuthenticodeSignature $tempMsi).Status -ne 'Valid') { throw "Security Alert: Invalid digital signature!" } Write-Host "Installing and enrolling server..." -ForegroundColor Cyan \# Silently execute the MSI passing the unique enrollment token $process = Start-Process "msiexec.exe" -ArgumentList "/i `"$tempMsi`" /qn ENROLLMENTTOKEN=" -Wait -NoNewWindow -PassThru if ($process.ExitCode -eq 0) { Write-Host "Success! Server enrolled." -ForegroundColor Green } else { throw "Install failed with code: $($process.ExitCode)" } \# Clean up the downloaded installer from local storage Remove-Item $tempMsi -Force } catch { Write-Host "Enrollment Failed: $\_" -ForegroundColor Red } finally { \# Safely revert the execution policy back to its original state Set-ExecutionPolicy $oldPolicy -Scope Process -Force } ### Step 2: Device-Side Execution (On the target Windows Server) Now, transition to the command-line interface of the target Windows Server. 1. Open an elevated PowerShell session. (On a GUI-enabled Windows Server, right-click the Start button and select Windows PowerShell (Admin). On Server Core, the default command prompt can be transitioned by typing `powershell`). 2. Paste the copied script block directly into the PowerShell window and press **Enter**. [![Screenshot of an elevated PowerShell session running on a Windows Server. The console window displays the execution of the Hexnode enrollment script, showing colored output detailing the autonomous progress, including downloading the agent, verifying the signature, installing the agent, and concluding with a green success message confirming the server has been enrolled.](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/08/Executing-the-Hexnode-PowerShell-Script-to-Enroll-a-Windows-Server.png "Executing the Hexnode PowerShell Script to Enroll a Windows Server")](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2026/08/Executing-the-Hexnode-PowerShell-Script-to-Enroll-a-Windows-Server.png) 3. The script will execute autonomously. You will see colored output detailing its progress: 1. Downloading Hexnode Agent… 2. Verifying signature… 3. Installing and enrolling server… 4. Wait for the process to finish. The agent will silently validate the token and authenticate the Windows Server. 5. Once complete, the console will output a green “**Success! Server enrolled.**” message. Advanced: Bulk Silent Deployment -------------------------------- If you are managing a large fleet of Windows Servers, you do not need to log into each one manually. You can execute the Hexnode deployment script across hundreds of servers simultaneously by wrapping it in a remote execution loop (such as Invoke-Command), deploying it as a Group Policy Startup Script, or passing it as a payload through an existing RMM tool. Here is a simplified example of passing the script to multiple servers remotely using native PowerShell remoting: \# Define the array of target servers on your domain $servers = @("Server01", "Server02", "ServerCore01") # Execute the enrollment script block remotely across all targets Invoke-Command -ComputerName $servers -ScriptBlock { # \[Paste the copied Hexnode script block here\] } 1 2 3 4 5 6 7 \# Define the array of target servers on your domain $servers = @("Server01", "Server02", "ServerCore01") \# Execute the enrollment script block remotely across all targets Invoke-Command -ComputerName $servers -ScriptBlock { \# \[Paste the copied Hexnode script block here\] } Post-Enrollment Validation -------------------------- To confirm that the Windows Server is successfully communicating with your management portal, return to your Hexnode UEM console. Navigate to the **Manage > Devices** tab. The newly enrolled Windows Server should now appear in your device list. By clicking on the Windows server’s name, you can view its comprehensive Device Summary, verifying its OS version, network status, and real-time health telemetry. What This Method Does Not Do ---------------------------- To set clear expectations before running the script, review these common misconceptions: AssumptionRealityRecommended ActionRequires a graphical interfaceOperates entirely via command line with no visual wizard.Use this as the primary method for Server Core environments.Re-enrolls a previously enrolled serverDoes not automatically uninstall existing Hexnode agents.Ensure the server is fully disenrolled and the old agent is uninstalled before running the script.Defines policies nativelyMerely enrolls the device into the active UEM portal.Configure the desired Enrollment Profile inside the Hexnode console prior to copying the script.Troubleshooting Common Errors ----------------------------- If the PowerShell output returns red text indicating an enrollment failure, check these common roadblocks: Error / SymptomLikely CauseSolutionScript fails on “Downloading Hexnode Agent”Server lacks outbound internet access on Port 443.Verify firewall rules allow outbound HTTPS traffic to your Hexnode portal URL.Install fails with code 1603The Hexnode UEM agent is already installed or corrupted.Uninstall the existing agent and clean associated registry keys before re-running.“Execution of scripts is disabled”A domain GPO strictly enforces the Restricted execution policy at the Machine level.Temporarily bypass the GPO enforcement or deploy the script via an RMM tool running as SYSTEM.“Security Alert: Invalid digital signature!”A network proxy intercepted and altered the .msi file during transit.Allowlist Hexnode UEM domains in your web filtering or proxy appliance to prevent packet inspection.