MDM deployment on Windows

Deploy the scanner on Windows through Intune or Group Policy with a registry setting.

On Windows, the enrollment token is delivered as a registry value under a policy key the scanner reads.

Before you begin

An enrollment token.
The .msi from the console’s Downloads page, or the pre-filled install.ps1.

Write the registry values

Key: HKLM\SOFTWARE\Policies\Superalign\Surface

Value	Type	Required
`EnrollmentToken`	REG_SZ	Yes
`UserEmail`	REG_SZ	No
`UserFullName`	REG_SZ	No

New-Item -Path "HKLM:\SOFTWARE\Policies\Superalign\Surface" -Force | Out-Null
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Superalign\Surface" -Name EnrollmentToken -Value "sae_xxxxxxxx.yyyyyyyyyyyyyyyy"
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Superalign\Surface" -Name UserEmail -Value (whoami /upn)

Run as SYSTEM. Intune’s settings catalog cannot fill in a per-user email, so the script resolves it.

Computer Configuration, Preferences, Windows Settings, Registry. Add the values above under the key.

Deploy the package

Assign the .msi to the same devices:

msiexec /i SuperAlign-surface-{version}-windows-amd64.msi /qn /norestart

Verify

reg query HKLM\SOFTWARE\Policies\Superalign\Surface
Get-Service SurfaceScanner
surface status

The laptop appears on Endpoints within one scan interval.

Uninstall through MDM

msiexec /x {ProductCode} /qn /norestart

Or use Add/Remove Programs. Uninstall deregisters the laptop and removes the service, files, credentials, and the registry policy key.

Next steps

Browser extension if you plan to record AI websites
Troubleshooting if a laptop does not appear
Update and uninstall for upgrades through the same policy