Devices
Set up Windows device management
Manage your organization's Windows PCs with Trustaige. Turn on Windows MDM, enroll PCs from Settings, then apply compliance checks and policies.
Trustaige manages Windows PCs through the device management built into Windows 10 and 11, so there’s nothing to install before a PC enrolls. Once it does, Trustaige installs its own agent on it, checks it’s compliant before anyone signs in from it, applies your policies (BitLocker, screen lock, apps and more), and can lock, restart or reset it.
Before you begin
| You need | Why |
|---|---|
| The Scale or Premier plan | Windows device management is part of these plans. |
| Your organization’s primary domain, verified in the hub | People enroll with their work email address, and Trustaige recognizes your organization from its domain. A PC whose user’s email domain isn’t verified can’t enroll. |
| Windows 10 or 11 Pro, Enterprise or Education | Windows Home doesn’t support enrolling in device management. A few settings (personalization, some app-install restrictions) apply fully only on Enterprise and Education. |
Setup happens in the hub under Devices → Providers → Windows.
1. Turn on Windows MDM
- Open Devices → Providers and choose Windows.
- Click Enable Windows MDM. You’ll be asked to confirm it’s you. This creates your organization’s device certificate authority and the starting compliance checks.
If the page says your organization needs a primary domain, click Configure organization domain, set and verify it, and come back.
Optional: let Windows find Trustaige from an email address
To let people enroll by typing just their work email into Windows Settings, add this DNS record for your domain, then click Verify DNS on the same page:
enterpriseenrollment.<your-domain> CNAME id.trustaige.comWithout it, enrolling from the hub (below) still works.
2. Enroll PCs
Every Windows PC that enrolls is a Corporate device, tied to the person who enrolled it. People can’t remove management from it themselves; only an administrator can.
From the hub (recommended)
Send people these steps, to do on the PC they’re enrolling:
- Sign in to Trustaige, open Devices and choose Enroll a device.
- Choose Windows MDM, then Enroll this Windows device.
- The browser asks to open an external app: click Open. Windows enrolls the PC on its own, with no second sign-in.
The link is good for 10 minutes and only once. If it expires, start again from step 2.
From Windows Settings
- On the PC, open Settings → Accounts → Access work or school.
- Click the Enroll only in device management link. Don’t use Connect, which starts a different kind of join.
- Enter your work email. If Windows asks for a server, enter
id.trustaige.com. - Windows shows Enroll this device with a QR code and an enrollment code that expires in 10 minutes. Scan the code with your phone, sign in with your passkey and tap Approve enrollment. The PC enrolls on its own.
What happens next
The PC checks in with Trustaige, every hour by default, and Trustaige installs its agent on it automatically. The agent is what installs apps, escrows BitLocker recovery keys, protects the PC through a reset, applies firmware lockdown and handles local admin rights.
3. Set compliance checks
Compliance decides whether a PC is trusted when someone signs in from it. Open Devices → Policy, choose the Windows MDM tab, and turn on what a PC must meet:
- Require BitLocker, a startup PIN, full-disk encryption, an escrowed recovery key
- Require Windows Firewall
- Require screen lock
- Require a current Windows build (the minimum is set here)
- Require Secure Boot
- Require reset protection, firmware lockdown
Click Apply these checks. Until you do, the card says Not applied yet and PCs are evaluated with no requirements.
4. Apply policies
Policies change the PC itself. From the same card, open a section, change it, and click Save & push. PCs pick up the change on their next check-in.
| Section | What it sets |
|---|---|
| Security baseline | BitLocker disk encryption (with startup PIN, full-disk encryption, hidden recovery options and XTS-AES strength), screen lock timeout, block USB storage, disable the camera, block Windows Recall |
| Reset protection | Whether a reset PC comes back into management, and whether Windows recovery stays available |
| Firmware lockdown | Firmware settings on Dell, HP and Lenovo PCs, applied by the agent |
| Apps | Apps from winget and the Microsoft Store: required or removed, a version pin, automatic updates, and Restrict app installs |
| Branding & announcements, Device naming, Support contact | What people see on their PC and how PCs are named |
To give some PCs different settings, use Scope overrides for Windows on the policy page.
Commands
Open a PC from Devices → Fleet and go to the Configuration tab.
| Command | What it does |
|---|---|
| Request sync | Wakes the PC to check in now instead of at its next scheduled check-in. |
| Refresh Posture | Asks the PC to report its compliance now. |
| Remote Lock, Restart Device | Lock or restart the PC. |
| Enforce screen lock, Remove screen lock policy | Turn the screen-lock policy on or off for this PC. |
| Renew device cert | Renew the certificate the PC uses to talk to Trustaige. |
| Rotate login secret | Rotate the PC’s managed sign-in secret. |
Each PC’s BitLocker panel holds its escrowed recovery key, revealed only after you confirm it’s you.
Reset a PC
Factory reset is in the PC’s Danger Zone, with four choices: Reset and return to management, Lost or stolen, Repair, keep files and Crypto-erase. A second administrator must approve it, from the Awaiting another admin banner.
With reset protection on, a PC that is reset, by you or by someone with the PC, re-enrolls itself and keeps its record in Trustaige.
Remove a PC from management
Choose Unenroll on the PC. The hub walks you through it: it cleans up the PC, removes Trustaige’s agent and unenrolls it. You confirm by typing the PC’s name.
Troubleshooting
| You see | What it means |
|---|---|
| DNS Not found or Misconfigured | The enterpriseenrollment record is missing or points elsewhere. It’s optional; enrolling from the hub works without it. |
| DNS Discovery not responding | The record is right but enrollment discovery isn’t answering for it yet. Check the domain is verified, and wait a few minutes. |
| A PC can’t find Trustaige when enrolling from Settings | Enter id.trustaige.com as the server, or enroll from the hub instead. Check the person’s email domain is your verified domain. |
| “Failed to prepare enrollment. Please try again.” | The enrollment link couldn’t be created. Try again from Enroll a device. |
| “{n} policy push(es) failed” | The PC rejected a policy. The banner gives the most recent reason. |
| “device has not yet reported a push channel” on Request sync | The PC hasn’t checked in since enrolling. It can be woken after its next scheduled check-in. |
| Install failed / Restart required on an app | The app couldn’t install, or the PC must restart to finish. |
| “Recovery key escrow is failing” | BitLocker is on but the key hasn’t reached Trustaige. Check the PC is checking in and its agent is running. |