DISCLAIMER: This document is a work-in-progress collection of quotes, links and notes related to management of Windows computers. Please contact the author if something is incorrect or missing, and the document will be updated accordingly.

Windows Client management notes

The Windows MDM APIs form the foundation for how MDM tools interact with the underlying operating system. MDM tools like InTune, ManageEngine, Ivanti, Workspace ONE, Jamf, Hexnode and similar are built on top of.these APIs. See Endpoint Management Tools Reviews and Ratings for a listing of different MDM solutions.

Overview of communication between Windows configuration service providers (CSPs), inbuilt MDM clients and MDM servers (figure from Enterprise settings and policy management):

Note: InTune is also deploying an additional Management Extension (IME) (Microsoft.Management.Services.IntuneWindowsAgent.exe) agent that supplements the inbuilt Windows MDM APIs.

Mobile device enrollment

Quotes: The enrollment process includes the following steps:

1. Discovery of the enrollment endpoint: This step provides the enrollment endpoint configuration settings.
2. Certificate installation: This step handles user authentication, certificate generation, and certificate installation. The installed certificates will be used in the future to manage client/server (TLS/SSL) mutual authentication.
3. DM Client provisioning: This step configures the Device Management (DM) client to connect to a Mobile Device Management (MDM) server after enrollment via DM SyncML over HTTPS (also known as Open Mobile Alliance Device Management (OMA DM) XML).

Quote: "The DMClient that is configured via the enrollment process is granted access to enterprise related settings. During the enrollment process, the task scheduler is configured to invoke the DMClient to periodically poll the MDM server."

Misc notes:

• Protocol used: Mobile Device Enrollment Protocol Version 2 [MS-MDE2]
• ClientCertificateInstall CSP (SCEP-based certificate enrollment)
• 2.2.9.3 DMClient Configuration Service Provider
• Certificate Renewal

Enrollment parameters:

Client certificate query string:

• MS-MDE2 SSLCLIENTCERTSEARCHCRITERIA defines how SW can discover the MDM client certificate required for network authentication. This certificate is used for communication with the MDM server, to download SW packages and more. Example: Subject=CN=Tester,O=Microsoft&Stores=My\User.
• The certificate query seem to be stored in HKLM\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\{GUID}\Protected\SslClientCertSearchCriteria in the Windows registry.

Client certificate lookup:

• The client certificate store & thumbprint appear to be stored in HKLM\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\{GUID}\SslClientCertReference in the Windows registry.
• The client certificate thumbprint is also exposed in HKLM\SOFTWARE\Microsoft\Enrollments\{GUID}\DMPCertThumbPrint and HKLM\SOFTWARE\Microsoft\Enrollments\{GUID}\DMClient\MS DM Server\EntDMID.

TODO: Ask Microsoft on the reocmmended way for discovering the correct client certificate.

Mobile Device Management overview

Notes:

• Quote: "MDM servers don't need to create or download a client to manage Windows".
• Protocol used: Mobile Device Management Protocol [MS-MDM]

Manage apps

Notes:

• Inventory all apps for all users of a Windows device.
• Suports app installation ffrom an arbitrary PackageUri with certificate-based authentication.
• EnterpriseModernAppManagement CSP (limited to MSIX-packaged apps)
• EnterpriseDesktopAppManagement CSP: Exposes a Device/MSI/{ProductID}/DownloadInstall node for MSI app installation from ContentURL . Also see MsiInstallJob example below.
• Win32AppInventory CSP: provide an inventory of installed applications on a device

EnterpriseDesktopAppManagement CSP MSI installation example:

<MsiInstallJob id="{f5645004-3214-46ea-92c2-48835689da06}">
  <Download>
    <ContentURL>https://myorg.com/app-installers/myapp.msi</ContentURL>
  </Download>
  <Validation>
    <FileHash>7D127BA8F8CC5937DB3052E2632D672120217D910E271A58565BBA780ED8F05C</FileHash>
  </Validation>
  <Enforcement>
    <CommandLine>/quiet</CommandLine>
    <TimeOut>10</TimeOut>
    <RetryCount>1</RetryCount>
  </Enforcement>
</MsiInstallJob>

... from Abusing_the_MDM_Client_Stack_Typhooncon_2024-2.pdf.

Mobile device management (MDM) for device updates

Notes:

• Quote_ "keep devices up to date with the latest Microsoft updates".
• Quote: "Get device compliance information (the list of updates that are needed but not yet installed)."
• Policy CSP - Update

Collect MDM logs

Notes:

• DiagnosticLog CSP supports log file retrieval from arbitrary ETW channels

Configuration Service Providers (CSPs)

The MDM Bridge WMI Provider appear to expose CSPs over WMI, so that they can also be accessed locally on the device. Also, see WMI providers supported in Windows for additional WMI MDM providers.

TODO: Test this out Using PowerShell scripting with the WMI Bridge Provider.

External resources

• Windows MDM Overview, from Windows Agentless C2: (Ab)using the MDM Client Stack, Black Hat 2023.