To provide a layer of automation to discover what onboarding methods are used for a subset of devices in Defender for Endpoint, the following PowerShell script can be used to run on a set of devices you are troubleshooting and determine what method was used. It can be a useful alternative for administrators who do not have access to one or any of the MDE onboarding platforms.
In its simplest form, what the script does is, interrogate a list of computers in a .txt file, run a detection logic to find indicators that points to what method was used to do the onboarding e.g., ...
Updated Aug 19, 2025
Version 1.0
edgarus71
Microsoft
Microsoft