How can I enroll an unmanaged Windows device without touching it locally?

Check whether the machines already have an approved tool that can deploy software, such as endpoint security, remote support, or another agent. In some environments, that existing tool can be used to install the proper management client. Otherwise, plan for a supported enrollment workflow that requires local user involvement or a technician visit.

WMI, PowerShell remoting, and similar tools can run commands remotely, but they do not bypass access controls. You still need administrator rights, suitable firewall and network settings, and the relevant services enabled. If those prerequisites are missing, another remote execution method will not solve the problem.

If the user can run an installer, an authorized remote-support or management agent with a silent enrollment package may work. The package should come from your organization’s approved tooling, use tightly controlled enrollment credentials, and be distributed through a trusted channel. An unmanaged computer cannot safely self-enroll from nothing without some initial authorized action.

If a device has no existing management agent, no reachable remote-service configuration, and no valid administrator credentials, there is no legitimate way to manage it remotely. That access is intentionally restricted. To enroll it, you generally need an authorized admin credential plus reachable services, or someone physically present to start the process.