Windows MDM: Managing Company Laptops From One Console

Windows MDM manages laptops and desktops through the management protocol built into Windows itself, the same way an MDM manages phones. You enroll the device once, then push policies, apps, encryption and updates from a console instead of touching the machine. For most IT teams the real question is not whether Windows can be managed this way, but whether they need a separate tool to do it.

Since late September 2026, Appaloosa adds PowerShell scripts, remote support and an installed-applications inventory to its Windows MDM: all detailed below, with the limits.

Historically the answer was yes. Phones went to an MDM, laptops went to a domain controller or an endpoint suite, and nobody had one inventory. That split is what modern unified endpoint management removes: Windows MDM puts PCs in the same console as iPhones, Android devices and Macs.

How does Windows MDM actually work?

Windows exposes a management client natively. When a laptop enrolls, it registers with your MDM server and starts applying the configuration you defined: security baseline (password, BitLocker), application installs, update rules. No image to build and no on-premise server to keep alive. PowerShell scripts, remote support and the detailed application inventory also require the Appaloosa agent to be installed on the laptop.

Enrollment happens in one of two ways, and which one you pick mostly depends on how many machines you have to handle:

• Per device, by the user. The employee signs in and the laptop enrolls itself. Fastest to start with, and the usual path for machines already in the field.
• In batch, by IT. You enroll several machines at once with a provisioning package (.ppkg).

Windows Autopilot is not supported, and there is no zero-touch enrollment on Windows (that applies to iOS and Android): a laptop is enrolled by hand or in batch.

What can you enforce on a Windows laptop?

The useful set is narrower than what a full endpoint suite advertises, and broader than most people expect from an MDM.

Disk encryption. BitLocker can be required, enabled and verified remotely, with the recovery key escrowed in the console. This is the single most valuable control on a laptop fleet: it is the difference between a lost machine being an incident and a lost machine being a formality.

Passwords and lock policy. Minimum length, complexity, lock timeout, failed-attempt behavior.

Updates. You control when feature updates and quality updates land, defer them, set deadlines and active hours so a restart never happens in the middle of a client call.

Applications. Push .msi packages silently, or publish them in a catalog the employee installs from. Block access to the Microsoft Store if you want a closed fleet.

Remote actions. Wipe a device, retrieve its BitLocker recovery key when someone locks themselves out, and take control of the machine to troubleshoot. Locking or restarting a PC goes through a PowerShell script launched from the console, not through a dedicated command.

Windows MDM and PowerShell: how do you run a script on a laptop?

From a Windows device's page, the Scripts tab sends a PowerShell script (.ps1) to the machine. The console then shows the execution status, the exit code and the result, without anyone opening a session on the laptop. The Appaloosa agent must be installed on the machine.

It is the tool for one-off jobs: read a setting, apply a fix, or lock or restart a PC, since the console has no dedicated command for that on Windows. Four limits to know:

• the .ps1 file is 1 MB at most;
• execution is single-run: each send runs the script once, it does not repeat on its own;
• scripts are Windows only, not iOS, Android or macOS;
• a machine without the Appaloosa agent does not receive the script.

Can you troubleshoot a Windows PC remotely?

Yes, from the device page. Appaloosa installs and configures TeamViewer Host on the machine, then you take control to help the employee without leaving the console. The Appaloosa agent must be installed on the machine. This remote support is an option (Advanced Add-On or Enterprise) that covers iOS, Android and Windows, but not macOS.

How do you see which software is installed across a Windows fleet?

The Applications tab of a Windows device lists every application installed on the computer, including those not installed through Appaloosa, with their version. You can spot software nobody deployed, or a version that fell behind.

The list refreshes automatically every 24 hours: between two refreshes it can be up to a day old, and the Refresh button forces an immediate one. Here too, the Appaloosa agent must be installed on the machine.

Where Windows MDM stops, and why that is fine

Some things a mobile-first MDM does on phones do not exist on Windows. Kiosk lockdown and web filtering are mobile strengths, not laptop ones. Remote support is the exception: Appaloosa offers it through a TeamViewer integration, as an option (Advanced Add-On or Enterprise), on iOS, Android and Windows. Being explicit about that matters more than pretending otherwise: an IT team that expects phone-grade control on a PC will be disappointed, while a team that wants enrollment, encryption, updates, apps and passwords covered from one place will find nothing missing.

If your laptops need deep software distribution, scheduled or recurring scripts and hardware telemetry, you are looking for a full endpoint management suite. If they need to be enrolled, encrypted, patched and inventoried next to your phones, Windows MDM is the shorter path.

Do you really need a separate tool for laptops?

Run the count. Most companies with 50 to 500 devices have more phones than PCs, and the phones carry more sensitive access: mail, chat, internal apps, sometimes a VPN. Yet the PC often gets the expensive tool and the dedicated admin, while the phones get whatever came with the mail suite.

Managing both in one console changes three things in practice. Onboarding is one workflow instead of two. Offboarding actually completes, because nothing is forgotten in a second inventory. And compliance questions get one answer: you can say how many devices are encrypted, patched and enrolled, across every platform, from a single screen.

That is the argument for managing company-owned devices in one place rather than one tool per operating system.

What a Windows rollout looks like

Start with the machines you are already replacing. Enroll new laptops when you set them up, so the fleet converts as hardware rotates rather than in a disruptive migration weekend.

Set the security baseline before you enroll anything: BitLocker required, password policy, update deadlines. Devices then arrive compliant instead of being fixed afterwards.

Then add applications gradually. Push the two or three everyone needs silently, and put the rest in a self-service catalog. Most teams over-engineer this step and end up maintaining packages nobody installs.

Finally, decide what you do about the machines you cannot enroll: personal PCs, contractor laptops, that one workstation running an old production tool. Those need a policy, not a technical fix.

Managing Windows next to everything else

The value of putting Windows in an MDM is not the Windows features themselves. Microsoft has covered those for years. The value is that a laptop stops being a special case: it appears in the same inventory as an iPhone, follows the same assignment logic, and disappears from the same offboarding checklist.

Appaloosa manages Windows alongside iOS, Android and macOS from one European console, with remote support as an option. If you want the detail of what is supported per platform, the feature matrix lists it line by line.

What about personal Windows PCs?

A employee-owned PC is a different problem from a company laptop, and the honest answer is that full MDM enrollment rarely fits it. You are asking someone to let your console manage the machine their family also uses.

Two workable positions exist. Either the machine stays unmanaged and you protect the access instead, by requiring a managed device for sensitive apps and keeping company data in browser sessions that can be revoked. Or you provide a company laptop for the people who genuinely need one. What does not work is enrolling a personal PC with the same baseline as a corporate one and hoping nobody notices BitLocker was enabled on their home drive.

On phones this is solved cleanly with a work profile, which is why BYOD on mobile works and BYOD on Windows mostly does not.

Related reading: MDM for Education: How Schools Manage Devices at Scale · How to enforce a passcode (PIN) on company phones · Appaloosa Now Manages Windows and macOS

Frequently asked questions

Is Windows MDM the same as Group Policy?

No. Group Policy needs the machine to reach a domain controller, which means the corporate network or a VPN. MDM works over the internet, so a laptop that never comes back to an office still receives its configuration. Many companies run both during a transition, with MDM handling everything for new machines.

Does the laptop need to be joined to a domain?

No. MDM enrollment is independent of domain join. That is the point: a fleet spread across home offices and client sites stays managed without any network dependency.

Can I force Windows updates without breaking someone's day?

Yes, and this is where the control is worth having. You set a deferral period, a deadline, and active hours. The update installs within your window, the restart avoids working hours, and machines that ignore it hit the deadline instead of drifting for months.

What happens when someone leaves?

You wipe the device remotely, and the BitLocker recovery key stays available in the console if the machine has to be recovered or reassigned. The point of managing laptops next to phones is that this happens once, in one place, rather than being tracked in two systems.

Which Windows versions are supported?

Windows 10 and Windows 11, in their Pro and Enterprise editions. Home editions do not expose the management client, which is worth checking before buying laptops in a hurry.

Can I run a PowerShell script on a Windows PC from the MDM?

Yes. The Scripts tab of a Windows device's page sends a .ps1 script (1 MB at most, single run) and shows the status, the exit code and the result in the console. The Appaloosa agent must be installed on the machine. This applies to Windows only.

Can I lock or restart a Windows PC remotely?

Not through a dedicated command: on Windows, you lock or restart a PC with a PowerShell script launched from the console.

Can I take remote control of a Windows PC?

Yes, through TeamViewer, as an option (Advanced Add-On or Enterprise). Appaloosa installs and configures TeamViewer Host from the device page, provided the Appaloosa agent is installed. The option covers iOS, Android and Windows, not macOS.

How do I list the software installed on Windows PCs?

In the Applications tab of each device: every installed application, including those installed outside Appaloosa, with its version. The list refreshes every 24 hours.