Give [THIS](https://t3.chat/chat/83f7f410-f2b2-4a52-a60f-64bbce23e79d) a good read-through
- We do NOT need hash uploads for existing machines unless we intend to WIPE them
- We are ONLY trying to get them into Intune to manage them
- **It IS possible to still enroll them using a PowerShell script deployed by Altiris**:
>[!info]
>This SILENTLY triggers MDM enrollment without user interaction via the `/AutoEnrollMDM` flag on `deviceenroller.exe`
```powershell
# Intune MDM Enrollment Script
# Deploy via Altiris as SYSTEM context
$intuneEnrollmentPath = "C:\Windows\System32\deviceenroller.exe"
$tenantDomain = "stedwards.edu"
# Check if already enrolled
$enrolled = Get-Service -Name "IntuneManagementExtension" -ErrorAction SilentlyContinue
if ($enrolled) {
Write-Output "Device is already enrolled in Intune. Exiting."
exit 0
}
# Trigger enrollment
try {
Start-Process -FilePath $intuneEnrollmentPath `
-ArgumentList "/c /AutoEnrollMDM" `
-Wait `
-NoNewWindow
Write-Output "Enrollment triggered successfully."
exit 0
}
catch {
Write-Output "Enrollment failed: $_"
exit 1
}
```
## To Make This Work
- [x] MDM Auto-Enrollment Must Be Enabled in Azure AD (Set `MDM user scope` to `All`)
![[Pasted image 20260616115810.png]]
- [ ] The device MUST be Azure AD Regitered or Hybrid Joined ``
- [ ] ***ARE OUR DEVICES SOMEHOW REGISTED/JOINED WITH OUR AD ???***
- [ ] Every user/device being enrolled needs to have an **Intune License** assigned (this can be done via the M65 center)
---
Since machines are domain-joined but **not** Azure AD joined, you have two viable paths:
### Path 1 — Hybrid Azure AD Join + GPO Auto-Enrollment
- Configure Hybrid Azure AD Join so your on-prem AD machines get a synchronized identity in Azure AD
- Then use a GPO to trigger auto-enrollment into Intune
- More setup work upfront, but the **cleanest long-term solution**
### Path 2 — Altiris Script Enrollment (What We Were Planning)
- This may hit a wall because `deviceenroller.exe /AutoEnrollMDM` typically requires the device to have an Azure AD identity to authenticate enrollment
- Without Hybrid Azure AD Join, the script may fail