Troubleshoot: Windows MDM

If a device fails to enroll in JumpCloud MDM, there are two common causes:

• It is still enrolled with another MDM provider.
• Or there are remnants of the previous MDM provider on the device.

When users try to enroll in JumpCloud MDM via the User Portal and enrollment fails, the following error may appear: The device is already being managed by an organization.

You can use JumpCloud Commands or the JumpCloud PowerShell Module to check the MDM enrollment status of your devices.

Using JumpCloud Commands to Confirm Enrollment

If the device has the JumpCloud Agent installed, you can use the following command to check the status of a specific device.

To check the device’s enrollment status using JumpCloud Commands:

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Commands. 

3. Click (+), then click Command to create a new command. The Details tab for the new command displays.
   1. In the Type field, click Windows. 
   2. Select Windows PowerShell.
   3. In the Command field, paste the following:
      get-jcsystem -hostname Workbox | select-object mdm
   4. Select the Devices tab. Select one or more devices where you want to apply this command.
   5. Click Save.  
4. From your list of commands, run the newly created command on the affected device by clicking Run Now. 
5. Go to the Results tab and click view. Locate the vendor value in the results.

In the following example, the vendor is Internal, meaning that this device has successfully enrolled in JumpCloud MDM. If the Vendor is None there is no detected MDM provider on this device. If the vendor value is External, that means another MDM provider has been detected on the system.

Using the PowerShell Module to Confirm Enrollment

You can also use the JumpCloud PowerShell Module to check the enrollment status of all of your devices in JumpCloud.

To use the PowerShell Module to check enrollment status:

1. Run the following command in the PowerShell Module:

2. Check the $MDMStatus and $Provider values in the command results:
   1. If the device is enrolled with another MDM provider, follow the vendor’s specified steps to unenroll the device. 
   2. If the device was unenrolled but it is still detected as an enrolled device, we recommend you contact the vendor for assistance with removing the remnants of the previous MDM enrollment.

There are times when a Windows device enrollment in JumpCloud MDM can’t be removed by normal methods, such as when the device is still linked with a previous MDM provider. When normal MDM removal methods don’t work, you can run the JumpCloud_MDM_Removal script to manually locate and remove an MDM profile.

Considerations:

• The MDM removal script can run either remotely (from the JumpCloud Admin Portal) or locally without user intervention. 
• The script locates existing MDM Enrollment IDs in the HKLM:\SOFTWARE\Microsoft\Enrollments location of the registry then removes all other keys related to the MDM enrollment.

Prerequisites:

• Your device must have the JumpCloud agent installed in order to receive PowerShell commands. See Install the JumpCloud Agent.

To run the MDM removal script on a Windows device in the JumpCloud Admin Portal:

1. Download the PowerShell script from GitHub: JumpCloud MDM Removal Script.
2. Log in to the JumpCloud Admin Portal.
3. Go to DEVICE MANAGEMENT > Commands. 

4. Click (+), then click Command to create a new command. The Details tab for the new command displays.
   1. In the Type field, click Windows. 
   2. Select Windows PowerShell.
   3. In the Command field, paste the contents of the JumpCloud MDM removal script.
   4. Select the Devices tab. Select one or more devices where you want to apply this command.
   5. Click Save.  
      

5. From your list of commands, run the newly created command on the affected device by clicking Run Now. 

6. (Optional) If the MDM enrollment removal script fails to run using JumpCloud Commands (or the device is inaccessible for other reasons), you can run the script locally:
   1. Open an elevated PowerShell or PowerShell_ISE session on your Windows device.
   2. Paste the contents of the JumpCloud MDM removal script.
   3. Press Enter to run the script.