How can I enroll an unmanaged Windows device without touching it locally?

If the user can run an installer, an authorized remote-support or management agent with a silent enrollment package may work. The package should come from your organization’s approved tooling, use tightly controlled enrollment credentials, and be distributed through a trusted channel. An unmanaged computer cannot safely self-enroll from nothing without some initial authorized action.

WMI, PowerShell remoting, and similar tools can run commands remotely, but they do not bypass access controls. You still need administrator rights, suitable firewall and network settings, and the relevant services enabled. If those prerequisites are missing, another remote execution method will not solve the problem.

Check whether the machines already have an approved tool that can deploy software, such as endpoint security, remote support, or another agent. In some environments, that existing tool can be used to install the proper management client. Otherwise, plan for a supported enrollment workflow that requires local user involvement or a technician visit.