From 819ae07d3d7dd9ea0c46ec97a560595e4e0ac837 Mon Sep 17 00:00:00 2001
From: Steven Palmesano <3100993+spalmesano0@users.noreply.github.com>
Date: Wed, 17 Dec 2025 15:35:44 -0600
Subject: [PATCH] Improve Windows migrate to Fleet notification (#37310)

This version shows the notification every five minutes, has a custom
title, runs in the user context, and has a more detailed message since
we no longer have the 255 character limit.

---------

Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
---
 .../scripts/turn-on-mdm-notification.ps1      | 66 +++++++++++++++----
 1 file changed, 55 insertions(+), 11 deletions(-)

diff --git a/docs/solutions/windows/scripts/turn-on-mdm-notification.ps1 b/docs/solutions/windows/scripts/turn-on-mdm-notification.ps1
index c3d7cc90fa..2fdbc75c41 100644
--- a/docs/solutions/windows/scripts/turn-on-mdm-notification.ps1
+++ b/docs/solutions/windows/scripts/turn-on-mdm-notification.ps1
@@ -1,18 +1,62 @@
-# Set message and MDM Window variables
-$message = @'
-Mobile device management is off. MDM lets your org change settings & install software.
+$scriptBlock = @'
+# Locate the MDM Enrollment Key in the registry
+$enrollmentKey = Get-Item -Path HKLM:\SOFTWARE\Microsoft\Enrollments\* | Get-ItemProperty | Where-Object {$_.ProviderID -eq 'Fleet'} | Where-Object {$_.EnrollmentState -match '1|6|13'}
 
-A 'Setup work or school' prompt will appear soon. Enter your work credentials.
+if($enrollmentKey){
+    $isMDMTurnedOn = $true
+} else {
+    $isMDMTurnedOn = $false
+}
 
-Click Fleet Desktop from your system tray, My device, and Refetch to confirm MDM is on.
+# Set the task name now, so we can remove it
+$taskName = "Turn on MDM notification"
+
+if ($isMDMTurnedOn) {
+    Write-Output "Thank you for turning MDM on."
+    Unregister-ScheduledTask -TaskName "$taskName" -Confirm:$false
+    Start-Sleep -Seconds 10
+} else {
+    $Title = "Migrate to Fleet"
+    $Message = "Mobile device management is off. MDM allows your organization to change settings and install software.
+    
+Turn on MDM by following these steps:
+    
+Close this window, go to Settings and search `"Access work or school`".
+    
+Select **Connect** and enter your work email and password.
+    
+Open Fleet Desktop (Fleet icon) in your system tray (^) and select **Refetch** on your **My device** page to tell your organization that MDM is on.
+    
+This **Migrate to Fleet** window will pop up every 5 minutes until you finish."
+    
+    # Send the message
+    (New-Object -ComObject WScript.Shell).Popup($Message, 0, $Title, 0)
+}
 '@
 
-$uri = "ms-device-enrollment:?mode=mdm"
+# Encode the script as Base64, so we can use it with a scheduled task
+$bytes = [System.Text.Encoding]::Unicode.GetBytes($scriptBlock)
+$encodedCommand = [Convert]::ToBase64String($bytes)
 
+# Pop up at the top, shows a PowerShell window
+$action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -EncodedCommand $encodedCommand"
 
-# Send the message first
-msg.exe * $message
+$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 5)
+$userID = Get-CimInstance -ClassName Win32_ComputerSystem | Select-Object -expand UserName
+
+# Use `-RunLevel Highest` here so that `Unregister-ScheduledTask` will work later; otherwise it fails with a `PermissionDenied` error
+$principal = New-ScheduledTaskPrincipal -UserId "$userID" -RunLevel Highest
+
+# `ExecutionTimeLimit` is used in case the user didn't close the popup, so that it will take focus again
+$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -RunOnlyIfNetworkAvailable -ExecutionTimeLimit (New-TimeSpan -Minutes 4)
+
+$task = New-ScheduledTask -Action $action -Trigger $trigger -Principal $principal -Settings $settings
+
+Write-Host "Logged in user is $userID."
+Write-Host "Starting ScheduledTask."
+
+# Register and start task
+$taskName = "Turn on MDM notification"
+Register-ScheduledTask "$taskName" -InputObject $task
+Start-ScheduledTask -TaskName "$taskName"
 
-# Wait a few seconds before opening the "Set up a work or school account" window to give the end user a chance to read the message
-Start-Sleep -Seconds 5
-Start-Process $uri -ErrorAction Stop