**Related issue:** Resolves#44369
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevented operations on Windows MDM profiles for hosts without active
enrollments.
* Batch processing now skips hosts lacking current enrollments so only
enrolled hosts receive queued commands.
* Strengthened profile-removal checks to avoid acting on orphaned
profile rows.
* **Tests**
* Added regression tests covering orphaned enrollment/profile scenarios
and mixed-host batch processing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Konstantin Sykulev
5aac997101