Do MDM Enrollment

<#
    .SYNOPSIS
        Device Management - Microsoft Intune MDM Enrollment
    .DESCRIPTION
        This script creates a scheduled task to handle Endpoint Manager (formerly Intune) MDM enrollment.
        The scheduled task runs as the SYSTEM user so this script should be run as an administrator or as SYSTEM.
    .NOTES
        2025-06-27: Fix small bug with variable handling.
        2020-10-02: Initial version.
    .LINK
        Not blogged yet.
#>
Begin {
    $regKeyMDM = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\MDM'
    $regKeyTenantInfo = 'HKLM:\SYSTEM\CurrentControlSet\Control\CloudDomainJoin\TenantInfo\*'
    $tenantInfo = Get-Item $regKeyTenantInfo -ErrorAction SilentlyContinue
    $GUID = $tenantInfo.Name
    $detailedTenantInfo = ('HKLM:\SYSTEM\CurrentControlSet\Control\CloudDomainJoin\TenantInfo\{0}' -f $GUID)
    $taskName = 'MDM Enrollment'
    $taskDescription ='Automatically enroll in Microsoft Intune MDM.'
    $action = New-ScheduledTaskAction -Execute '%windir%\system32\deviceenroller.exe' -Argument '/c /AutoEnrollMDM'
    $startAt = (Get-Date).AddMinutes(5)
    $repeat = (New-TimeSpan -Minutes 5)
    $duration = (New-TimeSpan -Days 1)
    $trigger = New-ScheduledTaskTrigger -Once -At $startAt -RepetitionInterval $repeat -RepetitionDuration $duration
    $timeToComplete = (New-TimeSpan -Hours 1)
    $settings = New-ScheduledTaskSettingsSet -MultipleInstances Queue -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RunOnlyIfNetworkAvailable -ExecutionTimeLimit $timeToComplete -Priority 7    
    $principal = New-ScheduledTaskPrincipal -UserID 'S-1-5-18' -RunLevel Limited
}
Process {
    # Test for the MDM URLs needed for enrollment
    $enrollmentURL = Get-ItemPropertyValue -Path $detailedTenantInfo -Name 'MdmEnrollmentURL' -ErrorAction SilentlyContinue
    $termsOfUseURL = Get-ItemPropertyValue -Path $detailedTenantInfo -Name 'MdmTermsOfUseUrl' -ErrorAction SilentlyContinue
    $complianceURL = Get-ItemPropertyValue -Path $detailedTenantInfo -Name 'MdmComplianceUrl' -ErrorAction SilentlyContinue
    if ([String]::IsNullOrWhiteSpace($enrollmentURL)) {
        New-ItemProperty -Path $detailedTenantInfo -Name 'MdmEnrollmentURL' -Value 'https://enrollment.manage.microsoft.com/enrollmentserver/Discovery.svc' -PropertyType String -Force -ErrorAction SilentlyContinue | Out-Null
    }
    if ([String]::IsNullOrWhiteSpace($termsOfUseURL)) {
        New-ItemProperty -Path $detailedTenantInfo -Name 'MdmTermsOfUseUrl' -Value 'https://portal.manage.microsoft.com/TermsOfUse.aspx' -PropertyType String -Force -ErrorAction SilentlyContinue | Out-Null
    }
    if ([String]::IsNullOrWhiteSpace($complianceURL)) {
        New-ItemProperty -Path $detailedTenantInfo -Name 'MdmComplianceUrl' -Value 'https://portal.manage.microsoft.com/?portalAction=Compliance' -PropertyType String -Force -ErrorAction SilentlyContinue | Out-Null
    }
    Try {
        if (Get-ScheduledTask -TaskName $taskName -ErrorAction SilentlyContinue) {
            Write-Host "Scheduled task already exists."
            exit 0
        }
        New-Item -Path $regKeyMDM -Name 'AutoEnrollMDM' -Value 1 -Force | Out-Null
        (Register-ScheduledTask -TaskName $taskName -Description $taskDescription -Action $action -Settings $settings -Trigger $trigger -Principal $principal -Force) | Out-Null
        Write-Host "Successfully created MDM Enrollment registry key and task."
        Exit 0
    } Catch {
        Write-Host "There was an error creating the registry key or scheduled task."
        Exit 1
    }
}