ToolBox Guide to
*Updated Jan 2018 to include a more robust deployment with a powershell script.
AirWatch has the ability to silently enroll Windows 10 systems using command line parameters on the AirWatch Agent msi. You can use SCCM to deploy the AirWatch msi to your Windows 10 systems to automatically enroll them into AirWatch without any user interaction. AirWatch just needs a bulk-import template uploaded to the console and then a staging account setup which will be used in our command line switch. The basic steps for this process are:
1. Setup a staging account setup in the AirWatch console
2. Run SQL query on your SCCM SQL server to output username and serial number information for each device into the correct AirWatch bulk-import template
3. Import the devices into AirWatch
4. Deploy the AirWatch agent to those systems with SCCM
- Script must be run as the current logged in user
- This user must have administrative rights
- Domain membership NOT required (Although it makes it a lot easier to do serial/username mapping)
Setup Staging Account
If you use VMware Workspace One (WS1) for identity management and authentication you will need to do a couple extra steps to setup the staging account. This is because the staging account can't use WS1 for authentication and instead must use a simple username/password.
1. Create a Staging Organization Group (OG) as a "Sibling" to your production OG
2. As you can see in my instance, we have "Production" and "Staging"
3. Once the OG is created, simply create a "Basic" user account with the following settings:
Note: If you look at the dropdown by "Single User Devices" setting, it might make sense to change it to "Advanced", but this actually needs to stay as "Standard". I'm not 100% why on this but this is what the Product team has told me.
4. Click save and this account is ready to go.
Run SQL Query to export serials
1. On your SCCM SQL server, open SQL Server Management Studio.
2. Go to Tools-->Options and make sure you have the "Include column headers when copying or saving results" checked. If it's not set, set it and then close and reopen SQL Management Studio.
3. Create a new query on your primary SCCM database
4. This query will output device information into the correct format that AirWatch needs to do a bulk import. The keys components are the serial number and username. These devices will become "prestaged" so that when you push out the MSI it will automatically enroll the device based on this information. I've also added a line so you can lookup a single collection as well as excluding usernames such as Administrator.
sys.User_Name0 as 'Username*',
'' as 'Password',
'1' as 'Active',
'Directory' as 'Security Type*',
'' as 'Security Type*',
'' as 'Enable Device Staging',
'' as 'Pre Register for Vpp',
'' as 'Email Username',
vru.User_Principal_Name0 as 'Email Address*',
'' as 'Email Password',
'' as 'User Principal Name',
vru.givenName0 as 'First Name*',
'' as 'Middle Name',
vru.sn0 as 'Last Name*',
'VMware' as 'GroupID*',
'' as 'Authorized GroupIDs',
'' as 'Enrollment Organization Group',
'' as 'Domain',
'' as 'Phone Number',
'' as 'Mobile Phone',
'' as 'Department',
'' as 'User Category',
'' as 'User Role',
'' as 'User Message Type',
'' as 'User Message Subject',
'' as 'User Message Body',
'' as 'Employee Identifier',
'' as 'Cost Center',
'' as 'Manager DN',
'VMWprod' as 'Device GroupID',
'' as 'Device Friendly Name',
'c' as 'Device Ownership(C/E/S/None)',
'' as 'Device Message Type',
'' as 'Device UDID(No special Characters)',
'' as 'Device IMEI',
'' as 'Device SIM',
'' as 'Device Asset Number',
v_GS_PC_BIOS.SerialNumber0 as 'Device Serial Number',
'' as 'Device Platform',
'' as 'Device Model',
'' as 'Device OS',
'' as 'DeviceOem',
'' as 'Tags',
'' as 'Custom Attribute Name 1',
'' as 'Custom Attribute Name 2',
'' as 'Custom Attribute Name 3'
FROM v_R_System sys JOIN v_GS_PC_BIOS on sys.ResourceID = v_GS_PC_BIOS.ResourceID JOIN v_GS_COMPUTER_SYSTEM on sys.ResourceID = v_GS_COMPUTER_SYSTEM.ResourceID
join v_FullCollectionMembership FCM on FCM.ResourceID = v_GS_COMPUTER_SYSTEM.ResourceID
v_GS_COMPUTER_SYSTEM cs on sys.resourceID = cs.resourceID
V_GS_Operating_system os on sys.resourceID = os.resourceID
v_R_User vru ON sys.User_Name0 = vru.User_Name0
Where FCM.CollectionID = 'PAL00088'
and sys.User_Name0 != 'Null'
and sys.User_Name0 != 'Administrator'
and vru.User_Principal_Name0 != 'Null'
and vru.givenName0 != 'Null'
and vru.sn0 != 'Null'
and v_GS_PC_BIOS.SerialNumber0 not like '%vmware%'
5. After running, right-click anywhere in the results and click "Save output as", name the file, and save it.
Bulk Import into AirWatch
Now that we have all of our device information exported, we will now import them into AirWatch.
(Note: My console version is 220.127.116.11)
1. Login to your AirWatch console and go to Devices-->Lifecycle and then click on Enrollment Status
2. On that page, click on the "Add" dropdown and click on "Batch Import.
3. Fill out the required fields:
Batch Name: Name it accordingly
Batch Description: Describe the upload accordingly (i.e. the site or group you are uploading)
Batch Type: Users and/or Devices
Batch file: Select the csv file you created earlier.
4. Click on Import
Note: It can take some time to upload depending on how many devices you have in your csv. To check the status of it, go to Hub-->Reports and Analytics--> Events--> Console Events.
Deploy AirWatch Agent with SCCM
lyNow that your devices are pre-staged, it's time to deploy the AirWatch agent MSI via a powershell script to those same devices. This script adds additional logic to make the deployment more robust:
- Checks the client device for registry keys associated with enrollment. If they are null or still "staging" then it will remove agent from client and try again
- Application "Detection" is configured in the same way so that SCCM will only report "installed" if the agent is installed AND it has a valid enrollment. This also means the application will keep running until it has a proper enrollment.
- Optionally send email based on results.
1. Download the latest AirWatch agent from https://awagent.com/Home/Welcome
2. Download latest SCCM integration client from here
3. Download latest script and update the top section of the script (Variables section) with the correct values for your environment. You can also un-comment out the section at the bottom to enable emailing results (whether success or fail). I've also included an AirWatch jpg for you to use as the Application icon in Software Center.
4. Create folder on your SCCM server that includes all 3 of those files
6. On the "General Information" and "Application Catalog" fill out the information per your preference.
7. On "Deployment Types", click "Add" and then select "Script Installer"
8. On "General Information" tab, fill out as needed.
9. On "Content" Tab:
10. On "Detection Method", click "Use a custom script to detect presence..." and then "Edit". Select PowerShell and then use this script:
#Checking first for Airwatch Enrollment
$PATH = "HKLM:SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\*"
$val = (Get-ItemProperty -Path $PATH -ErrorAction SilentlyContinue).PSChildname
#Now checking whether enrollment is with a real user or the staging user
$path2 = "HKLM:\SOFTWARE\Microsoft\Enrollments\$val"
$val2 = (Get-ItemProperty -Path $PATH2 -ErrorAction SilentlyContinue).UPN
if ($val2 -eq "StagingWin10@Staging.com" -or $val2 -eq "email@example.com" -or $val2 -eq $null)
11. On "User Experience" tab, complete as follows:
12. For "Requirements" and "Dependencies" page, leave blank. Note: You can setup the SCCM integration client as a separate application and then create that as a dependency. I've chosen to just include with the deployment of this script.
13. Distribute this application to your distribution points and deploy to your collection. I highly recommend you deploy first to a test collection with only a few devices to ensure the automatic enrollment happens. Make sure you deploy is as a "required" application.
Once it successfully deploys to a device, go to the Access Work or School area and check the enrollment status. It should have your AirWatch server information and the correct email address. Sometimes the enrollment can show the staging account for a short period before flipping over to the correct user. Keep clicking out of the UI and back in to see if it switches properly.
I'm Brooks Peppin and I love God, my family, AirWatch, VMware, EUC products, all things systems management, Windows 10, Powershell, and operating system deployment.