In this lab, you will prepare Workspace ONE UEM to accept Windows Server enrollments and then enroll a Windows Server device using scripted (silent) enrollment. You will start by creating the Servers Organization Group structure — a dedicated child OG, a scoped enrollment account, and Lab/Prod Smart Groups — before configuring the console-side settings that govern how Windows devices are managed, grouped, and assigned within that child OG. You will then run a pre-staged enrollment script on the Windows Server VM and confirm the enrollment process begins. 

By completing this lab, you will be able to: 

• Create a child Organization Group dedicated to Windows Server devices. 
• Create a scoped account for use with Windows Server enrollments. 
• Create Lab and Prod Smart Groups to separate Windows Server devices by purpose. 
• Log in to the Workspace ONE UEM administration console and confirm the correct Organization Group is selected. 
• Configure Intelligent Hub Managed Mode for Windows devices in the Servers Organization Group. 
• Set the default action for inactive users to restrict additional device enrollment. 
• Enable Fixed Organizational Group as the Group Assignment Mode for shared devices. 
• Set the default Windows enrollment user mode to Single User Mode. 
• Update a server's Group ID and run a scripted enrollment on a Windows Server VM. 
• Review the enrollment script and understand the parameters embedded within it. 

Task 1 — Windows Server pre-enrollment steps (child OG, enrollment account, Smart Groups) 

Task 2 — Configure console settings for Windows Server enrollment 

Task 3 — Enroll the Windows Server device using scripted enrollment 

Before configuring enrollment settings or enrolling a device, the Servers' Organization Group structure must exist. In this task, you will create a child OG dedicated to Windows Server devices, a scoped account for enrolling those servers, and two Smart Groups — Lab and Prod — to separate server devices by purpose. 

1. In the Workspace ONE UEM console, navigate to Groups & Settings > Groups > OG Details
2. Click Add Child Organization Group. 
3. Enter a Name for the new OG as [email protected] (matching the convention used within your StudentAdmin name) 
4. Set the Group ID to [email protected] (matching the convention used within your StudentAdmin name). 
5. Keep all remaining settings and click Save.

In this lab, the account used for Windows Server enrollment is based on a Basic account.  In production, you should designate an Active Directory Service Account for this purpose for greater security and to reduce risk of deletion. 

1. Confirm you are in the new child Server OG by navigating to the Organization Group selector in the top left of the console.
2. Navigate to Accounts > Users > Add > Add User 
3. Click Basic. 
4. Change the Username to ServerEnrollment  Note that there is no space in between. 
5. Change the password to Pa$$w0rd and repeat in the Confirm Password box. 
6. In the Full Name fields, enter Server as the First Name and Enrollment as the last name. 
7. In the Display Name field, enter ServerEnrollment
8. In the Email address field, enter [email protected]
9. Click Save.

When creating Smart Groups for Windows Server devices, please note the following equivalents: 

• Windows Server 2016 = Windows 10.0.14393 
• Windows Server 2019 = Windows 10 0.17763 
• Windows Server 2022 = Windows 10.0.20348 
• Windows Server 2025 = Windows 10.0.26100 

1. In the upper-left corner of the console, click the drop-down menu and verify that Studentlab.LabInstance.Id/ServerOGlab.LabInstance.Id is selected from the drop-down menu.  
2. In the navigation pane at the top, select Groups & Settings > Groups > Assignment Groups (Smart Groups). 
3. Click Add Smart Group. 
4. Enter SG WinSvr2025 Prod in the Name text box. 
5. Leave Criteria selected and expand Platform and Operating System in the left pane. 
6. In the top-left drop-down menu, select Windows, Equals, and Windows 11 (10.0.26100).   
7. Expand Model Type in the navigation pane. 
8. Click Selected and deselect Windows – Desktop and Windows – HoloLens such that Windows Server is the only option selected. 
9. Click Save. 
10. Repeat steps 3-9 to create a second Smart Group named SG WinSvr2022 Test but instead select Windows, Equals, and Windows 10 (10.0.20348). 

✔ Checkpoint: Two Smart Groups — SG WinSvr2025 Prod and SG WinSvr2022 Test — exist and are scoped to the ServerOGlab.LabInstance.Id child OG. 

In this task, you will first confirm you are working in the Servers Organization Group, and configure the enrollment, grouping, and Hub settings that will govern how the Windows Server device behaves once enrolled. 

1. Continue within the Studentlab.LabInstance.Id / ServerOGlab.LabInstance.Id organization group.  Ensure that it is selected from the Organization Group dropdown menu in the upper left corner. 

✔ Checkpoint: You are logged in to the Workspace ONE UEM console with the Servers organization group selected. 

2. In the navigation pane on the left, select Groups & Settings. 
3. Select All Settings > Devices & Users > General > Enrollment. 
4. Click the Management Mode tab, click Override next to Current Setting. 
5. Next to Windows, make sure No OMADM Management is selected. 
6. Next to Management Mode, verify that Intelligent Hub Managed Mode is selected.
7. For the All Windows devices in this Organization Group option, verify Enabled is selected.
8. Click Save. 

✔ Checkpoint: Intelligent Hub Managed Mode is enabled for all Windows devices in the Servers organization group. 

9. On the Grouping tab, click Override next to Current Setting. 
10. From the dropdown menu for Default Action for Inactive Users, select Restrict Additional Device Enrollment. 
11. Click Save. 

✔ Checkpoint: This ensures that seemingly inactive user devices will not be subjected to device wipe.   

12. In the navigation pane on the left, select Devices and Users > General > Shared Device. 
13. Click Override. 
14. Navigate to the Grouping section. 
15. For the Group Assignment Mode option, ensure that Fixed Organization Group is enabled.
16. Click Save. 

✔ Checkpoint: Fixed Organization Group is enabled as the Group Assignment Mode for shared devices. 

Note: This step is critical and enrollment will fail if not properly configured. 

17. In the navigation pane on the left, select Devices & Users. Then, select Microsoft > Windows > Intelligent Hub Settings. 
18. Click Override next to current setting. 
19. Scroll down to the section - Default User Mode for Enrollment and validate that Single User mode is selected.
20. Click Save. 
21. Close the All Settings window by clicking the X in the upper-right corner. 

✔ Checkpoint: Single User Mode is set as the default Windows enrollment user mode, and all console configuration for this task is complete.

Deploying apps to Windows Servers is similar to Windows Desktop.  First, you will view the Onboarding Freestyle Orchestrator workflow that installs the CrowdStrike Falcon agent, which has been pre-configured for you.  Onboarding enables apps to be installed immediately following enrollment and prior to all other resources.  Then, you will modify two App Files to append Windows Server deployment and then deploy those apps and configure enrollment.

1. In the top left corner of the Workspace ONE UEM console, click the Organization Group selector in the console header. and validate that you are in the Parent OG. 
2. Go to Orchestration > Freestyle > Freestyle Orchestrator. 
3. Select the Install Falcon Sensor workflow to view and focus on the Overview pane.  Because this has been configured in a higher OG, you cannot see the full workflow or duplicate it, but you can note that the Deployment type is designated as Onboarding.   

1. While still in the Parent OG, go to Resources > Apps > Native Apps. 
2. In the Notepad++ entry, click the pencil icon to Edit the App File. 
3. In the Details pane, scroll down to Supported Models.  Hover over the Server entry and press shift and click at the same time such that both Desktop and Server are selected.   
4. Click Save & Assign. 
5. Click Add Assignment.
6. In the Name field, designate the assignment name as Notepad++WinSvr Assignment
7. On the Assignment screen, keep the default Assignment Groups option. 
8. Select the To whom do you want to assign this app field, and within the drop-down, select both the SG WinSvr2025 Prod and SG WinSvr2022 Test Smart Groups. 
9. In the Deployment Begins, enter yesterday’s date. 
10. For the App Delivery Method, change to Auto. 
11. Enable Override Reboot Handling and ensure that both Device Restart and Uninstall Device Restart are set to Do not restart. 
12. Set both Keep Application on Device options to Disable, which causes the app to be removed from Windows Server upon unassignment or enterprise wipe. 
13. Click Create. 
14. Click Save.
15. Click Publish.
16. Go back to Resources>Apps>Native Apps.
17. Find the 7-Zip entry and click the pencil icon to open the App File. 
18. In the Details pane, scroll down to Supported Models.  Hover over the Server entry and press shift and click at the same time such that both Desktop and Server are selected.   
19. Click Save & Assign. 
20. On the Assignment screen, click Add Assignment. 
21. Designate the name as 7-Zip WinSvrDist Sept 2026
22. Select Phased Deployment. 
23. In the Target Assignment Groups dropdown, select, SG WinSvr2025 Prod.
24. Click Next. 
25. In the Phase Name box, enter Phase 1 and in the Phase Target box, select SG WinSvr2025 Prod from the dropdown.

Note: Although you would typically apply to test before production, there are no test machines in this lab, so we will deploy to the Prod group first.

26. Click Manual Progression. 

27. Select Automatic Progression.

28. In the Install Rate box, type 100

29. On the Wait Time line, deselect the blue check mark.  This causes only the Install Rate to be used as the criteria. 

30. Click Save in the upper right corner. 

31. Set Deployment Begins to yesterday. 

32. Enable Override Reboot Handling and ensure that both Device Restart and Uninstall Device Restart are set to Do not restart. 

33. Set both Keep Application on Device options to Disable, which causes the app to be removed from Windows Server upon unassignment or enterprise wipe. 

34. Click Create. 

35. Click Save.

36. Click Publish. 

In this task, you will switch to the Windows Server VM, update Group ID, and run a pre-staged script to silently enroll the device into Workspace ONE UEM.

1. From the VM Switcher, select WS2025-Server. 
2. If prompted to log in, enter the password for the local account: 

3. Navigate to C:\Resources. 
4. Double-click the “Update Group ID” file. 
5. Type the Group ID for the server OG you created earlier based on your student lab ID.   For example: [email protected]

! Make sure to preface the Group ID with “ServerOG”. 

6. Click OK. 
7. Click OK again to the “Replacement complete…” message. 

✔ Checkpoint: The Group ID file has been updated with the correct server Group ID. 

8. Right-click the newly created file, “Right-Click Me and choose Run as Administrator” batch file and choose Run as Administrator. 
9. A command window will appear briefly for about a minute and then close on its own. This starts the enrollment process. 

Note: You will have to wait about 2 minutes while the device enrolls. There will be no visible progress while enrollment is happening. 

10. Go to C:\Resources\Right click me and choose Run as Administrator.  DO NOT RUN again as Administrator! 
11. Right-click the file and select Show More Options.  Click Edit.  Do not click Open. 
12. Note the parameters that have been embedded within the script. 
13. Close Notepad after viewing, without saving any changes. 

✔ Checkpoint: The enrollment script has been run, and the Windows Server device is enrolling into Workspace ONE UEM using the correct Group ID.