---
title: MDM deployment on Windows
sidebar:
  label: Windows
description: Deploy the scanner on Windows through Intune or Group Policy with a registry setting.
---

On Windows, the enrollment token is delivered as a **registry value** under a policy key the scanner reads.

## Before you begin

- An [enrollment token](/surface/admin/enrollment-tokens).
- The `.msi` from the console's **Downloads** page, or the pre-filled `install.ps1`.

1. **Write the registry values**

    Key: `HKLM\SOFTWARE\Policies\Superalign\Surface`

    | Value | Type | Required |
    | --- | --- | --- |
    | `EnrollmentToken` | REG_SZ | Yes |
    | `UserEmail` | REG_SZ | No |
    | `UserFullName` | REG_SZ | No |

    **Intune (PowerShell script)**

    ```powershell
    New-Item -Path "HKLM:\SOFTWARE\Policies\Superalign\Surface" -Force | Out-Null
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Superalign\Surface" -Name EnrollmentToken -Value "sae_xxxxxxxx.yyyyyyyyyyyyyyyy"
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Superalign\Surface" -Name UserEmail -Value (whoami /upn)
    ```
    Run as SYSTEM. Intune's settings catalog cannot fill in a per-user email, so the script resolves it.

    **Group Policy**

    Computer Configuration, Preferences, Windows Settings, Registry. Add the values above under the key.

    :::warning
    Windows does not tell the scanner who is signed in. Without `UserEmail`, the laptop appears in the console with a hostname but no person.
    :::

2. **Deploy the package**

    Assign the `.msi` to the same devices:

    ```powershell
    msiexec /i SuperAlign-surface-{version}-windows-amd64.msi /qn /norestart
    ```

3. **Verify**

    ```powershell
    reg query HKLM\SOFTWARE\Policies\Superalign\Surface
    Get-Service SurfaceScanner
    surface status
    ```

    The laptop appears on **Endpoints** within one scan interval.

## Uninstall through MDM

```powershell
msiexec /x {ProductCode} /qn /norestart
```

Or use Add/Remove Programs. Uninstall deregisters the laptop and removes the service, files, credentials, and the registry policy key.

## Next steps

- [Browser extension](/surface/deploy/mdm/browser-extension) if you plan to record AI websites
- [Troubleshooting](/surface/scanner/troubleshooting) if a laptop does not appear
- [Update and uninstall](/surface/scanner/update-and-uninstall) for upgrades through the same policy