Enroll Windows Server via Windows PowerShell

Deployment Overview

While graphical setup wizards are suitable for standalone servers, modern enterprise infrastructure often relies on headless architectures and automated deployment pipelines. Enrolling Windows Server via PowerShell is a highly efficient, command-line-driven method that completely eliminates the need for visual interaction.

Instead of downloading an installer and clicking through a GUI, System Administrators execute a pre-compiled PowerShell script provided by the Hexnode console. This script handles the entire lifecycle automatically: it temporarily bypasses local execution policies, securely fetches the generic Hexnode agent from the cloud, verifies its digital signature, silently installs the application using a Base64-encoded Enrollment Token, and cleans up the temporary files—all within seconds. This method is the required standard for provisioning GUI-less environments (like Windows Server Core) and integrating UEM enrollment into larger DevOps automation workflows.

Supported Platforms & Prerequisites

Before executing the deployment script, ensure the target Windows Server meets the necessary baseline requirements.

Supported Operating Systems:

• Windows Server 2019
• Windows Server 2022
• Windows Server 2025

Deployment Prerequisites:

• Elevated Privileges: The script must be executed within an elevated PowerShell session (Run as Administrator).
• Active Internet Connectivity: The Windows Server requires an active outbound connection (Port 443/HTTPS) to download the .msi package in real-time and authenticate the enrollment token against your Hexnode UEM portal.
• PowerShell Environment: Windows PowerShell 5.1 or later (standard on supported Server OS versions).

Enterprise Use Cases

System Administrators and DevOps engineers should choose the PowerShell enrollment method in the following scenarios:

• Windows Server Core Provisioning: Because Server Core completely lacks a graphical desktop (meaning standard .msi wizards cannot be displayed), this command-line method is the only way to natively enroll these lightweight, headless servers.
• DevOps & Automated Bootstrapping: The script can be seamlessly injected into post-deployment automation tools (like Terraform, Ansible, AWS UserData, or VMware customization specifications) to ensure Windows Servers are enrolled into Hexnode the moment they are provisioned.
• Bulk Silent Deployments: Infrastructure teams can push this script via existing legacy management tools (like an RMM or Group Policy) to silently enroll hundreds of existing Windows Servers in the background without interrupting active user sessions.

Enrollment Workflow

Step 1: Portal Configuration (Hexnode Admin Console)

To begin, you must act from your Hexnode UEM console to retrieve the specialized enrollment script.

1. Log in to the Hexnode UEM console.
2. Navigate exactly to: Enroll > Platform-Specific > Windows Server > Windows Server Enrollment > Information.
3. Select your desired Enrollment Profile from the dropdown menu.

   Understanding the Profile: In Hexnode UEM, an enrollment profile dictates the initial onboarding experience by defining general settings (like device ownership and group assignment), device configurations, and user authentication methods. Learn more about configuring Windows Enrollment Profiles.

4. Click the View option located beside the chosen profile. This allows you to quickly double-check the profile’s assignment rules before you deploy.
5. Scroll down to the Enrollment Instructions section and locate the Enroll using Windows PowerShell section.
6. Here, you will find the Installer download URL, the Enrollment Token, and a fully generated PowerShell script block. The Hexnode portal automatically embeds the universal download URL and your specific Enrollment Token directly inside this script for seamless execution.
   
7. Copy the entire script block to a secure clipboard.
   Reference PowerShell Script: Note that when copied from your portal, the <Installer_Download_URL> and <Enrollment_Token> placeholders will be automatically populated with your actual portal data.

   Store current execution policy to safely restore it post-installation

   $oldPolicy = Get-ExecutionPolicy -Scope Process # Temporarily bypass execution policy for this specific session only Set-ExecutionPolicy Bypass -Scope Process -Force try { # Define the temporary path for the downloaded installer $tempMsi = "$env:TEMP\hexnode_agent.msi" Write-Host "Downloading Hexnode Agent..." -ForegroundColor Cyan # Securely fetch the installer payload from the Hexnode UEM portal Invoke-WebRequest -Uri "<Installer_Download_URL>" -OutFile $tempMsi Write-Host "Verifying signature..." -ForegroundColor Cyan # Verify the digital signature to ensure payload integrity if ((Get-AuthenticodeSignature $tempMsi).Status -ne 'Valid') { throw "Security Alert: Invalid digital signature!" } Write-Host "Installing and enrolling server..." -ForegroundColor Cyan # Silently execute the MSI passing the unique enrollment token $process = Start-Process "msiexec.exe" -ArgumentList "/i `"$tempMsi`" /qn ENROLLMENTTOKEN=<Enrollment_Token>" -Wait -NoNewWindow -PassThru if ($process.ExitCode -eq 0) { Write-Host "Success! Server enrolled." -ForegroundColor Green } else { throw "Install failed with code: $($process.ExitCode)" } # Clean up the downloaded installer from local storage Remove-Item $tempMsi -Force } catch { Write-Host "Enrollment Failed: $_" -ForegroundColor Red } finally { # Safely revert the execution policy back to its original state Set-ExecutionPolicy $oldPolicy -Scope Process -Force }

   1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39

   $oldPolicy = Get-ExecutionPolicy -Scope Process     # Temporarily bypass execution policy for this specific session only Set-ExecutionPolicy Bypass -Scope Process -Force     try {       # Define the temporary path for the downloaded installer       $tempMsi = "$env:TEMP\hexnode_agent.msi"       Write-Host "Downloading Hexnode Agent..." -ForegroundColor Cyan       # Securely fetch the installer payload from the Hexnode UEM portal     Invoke-WebRequest -Uri "<Installer_Download_URL>" -OutFile $tempMsi       Write-Host "Verifying signature..." -ForegroundColor Cyan       # Verify the digital signature to ensure payload integrity     if ((Get-AuthenticodeSignature $tempMsi).Status -ne 'Valid') { throw "Security Alert: Invalid digital signature!" }       Write-Host "Installing and enrolling server..." -ForegroundColor Cyan       # Silently execute the MSI passing the unique enrollment token     $process = Start-Process "msiexec.exe" -ArgumentList "/i `"$tempMsi`" /qn ENROLLMENTTOKEN=<Enrollment_Token>" -Wait -NoNewWindow -PassThru       if ($process.ExitCode -eq 0) {           Write-Host "Success! Server enrolled." -ForegroundColor Green       } else {           throw "Install failed with code: $($process.ExitCode)"       }       # Clean up the downloaded installer from local storage     Remove-Item $tempMsi -Force      } catch {       Write-Host "Enrollment Failed: $_" -ForegroundColor Red   }   finally {       # Safely revert the execution policy back to its original state       Set-ExecutionPolicy $oldPolicy -Scope Process -Force   }

Step 2: Device-Side Execution (On the target Windows Server)

Now, transition to the command-line interface of the target Windows Server.

1. Open an elevated PowerShell session. (On a GUI-enabled Windows Server, right-click the Start button and select Windows PowerShell (Admin). On Server Core, the default command prompt can be transitioned by typing powershell).
2. Paste the copied script block directly into the PowerShell window and press Enter.
   
3. The script will execute autonomously. You will see colored output detailing its progress:
   1. Downloading Hexnode Agent…
   2. Verifying signature…
   3. Installing and enrolling server…
4. Wait for the process to finish. The agent will silently validate the token and authenticate the Windows Server.
5. Once complete, the console will output a green “Success! Server enrolled.” message.

Advanced: Bulk Silent Deployment

If you are managing a large fleet of Windows Servers, you do not need to log into each one manually. You can execute the Hexnode deployment script across hundreds of servers simultaneously by wrapping it in a remote execution loop (such as Invoke-Command), deploying it as a Group Policy Startup Script, or passing it as a payload through an existing RMM tool.

Here is a simplified example of passing the script to multiple servers remotely using native PowerShell remoting:

Post-Enrollment Validation

To confirm that the Windows Server is successfully communicating with your management portal, return to your Hexnode UEM console.

Navigate to the Manage > Devices tab. The newly enrolled Windows Server should now appear in your device list. By clicking on the Windows server’s name, you can view its comprehensive Device Summary, verifying its OS version, network status, and real-time health telemetry.

What This Method Does Not Do

To set clear expectations before running the script, review these common misconceptions:

Troubleshooting Common Errors

If the PowerShell output returns red text indicating an enrollment failure, check these common roadblocks: