GPOAutoIntuneEnrollment

This PowerShell script creates a Group Policy Object (GPO) configured for automatic Microsoft Intune device enrollment without linking it to any Organizational Unit (OU) by default. The GPO can be manually linked to target OUs as needed.

Required Modules

RSAT Group Policy & RSAT Active Directory.
Run below if modules are not installed.

    Get-WindowsCapability -Name Rsat.GroupPolicy* -Online | Add-WindowsCapability -Online
    Get-WindowsCapability -Name Rsat.ActiveDirectory* -Online | Add-WindowsCapability -Online

How to use the script

Copy script to domain controller or domain-joined device with Group Policy Management tools installed.
Open in text editor, modify the variables with related Urls

    $GpoName = "Intune_Device_Enrollment"  # Name for your GPO
    $IntuneEnrollmentUrl = "https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc"
    $MdmTermsUrl = "https://portal.manage.microsoft.com/TermsofUse.aspx"
    $MdmComplianceUrl = "https://portal.manage.microsoft.com/?portalAction=Compliance"

Run in PowerShell as Administrator
Link GPO to target OUs

What the Script Configures

Path	Value	Type	Data	Purpose
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM	AutoEnrollMDM	DWORD	1	Enables automatic MDM enrollment
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM	UseAADCredentialType	DWORD	1	Uses Azure AD credentials
HKLM\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts{GUID}	DiscoveryServiceUrl	String	Enrollment URL	Intune discovery endpoint
HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceEnrollment	TermsUrl	String	Terms URL	MDM terms of use
HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\DeviceEnrollment	ComplianceUrl	String	Compliance URL	MDM compliance portal
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	AADJoinAuthEndpoint	String	Login URL	Azure AD authentication

Verification Steps

On a test device in target OU, run: 'gpupdate /force'
On a test device in target OU, run: 'dsregcmd /status'
Check enrollment status in intune: Intune Portal > Devices > All Devices

Troubleshooting Steps

Verify GPO Applicaton with: 'gpresult /r' or 'gpresult /h gpreport.html'
Check registry settings on test device, all configured keys should be present
Verify network connectivity to Intune endpoints
Check Azure AD device registration settings
check Azure AD Connet synchronization status
check network connectivity to:

    https://enrollment.manage.microsoft.com
    https://login.microsoftonline.com

2.6 KiB Raw Permalink Blame History