Objective
To provide guidance, script references, and Automox execution context for collecting Windows Autopilot hardware hashes across managed Windows endpoints using PowerShell and Automox Worklets.
Overview
Enrolling existing Windows devices into Microsoft Windows Autopilot requires extracting each endpoint's unique Hardware Hash (along with serial number and Windows Product ID) and importing that data into Microsoft Intune or Microsoft Entra ID.
While Automox does not maintain a built-in prepackaged policy for hash harvesting, administrators can deploy standard PowerShell scripts across their Windows fleet using custom Automox Worklets.
Key Automox Execution Context (PowerShell Rules)
When developing or executing PowerShell scripts via Automox Worklets, keep the following runtime attributes in mind to ensure script compatibility:
| Execution Attribute | Operational Behavior |
| User Context |
Automox commands execute under the local NT AUTHORITY\SYSTEM account with elevated administrative privileges.
|
| Architecture Context |
Automox runs commands in 32-bit PowerShell (x86) by default on Windows endpoints.
|
| Testing Recommendation |
To replicate Automox execution locally for debugging, run your script in an elevated 32-bit PowerShell console (C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe).
|
Script Resources & External References
Administrators can leverage official Microsoft PowerShell modules and community-built scripts to collect and export hardware hashes to a centralized network share or cloud repository.
Primary Documentation & Scripts
Microsoft Documentation: Add devices to Windows Autopilot
-
Official AutoPilot Script (
Get-WindowsAutoPilotInfo): PowerShell Gallery - Get-WindowsAutoPilotInfoSynopsis: Retrieves Autopilot deployment details and hardware hashes directly from local or remote Windows endpoints.
-
ConfigMgr Hash Harvesting Script (
Get-CMAutopilotHashes): PowerShell Gallery - Get-CMAutopilotHashesSynopsis: Compiles serial numbers and hardware hashes from system inventory into CSV files ready for Intune import.
Implementation Workflow (Worklet Overview)
1.Obtain or Custom-Build the Hash Extraction Script:
Customize a PowerShell script (e.g., based on Get-WindowsAutoPilotInfo.ps1) to output the collected hardware hashes into a central location, such as a secure network share or cloud file storage endpoint.
2.Create a Custom Automox Worklet:
- In the Automox console, navigate to Policies > Create Policy and select Worklet.
- Set the OS target to Windows.
- Enter a clear policy name (e.g., Windows - Collect Autopilot Hardware Hashes).
3.Configure Worklet Code Blocks:
- Evaluation Code: Check if the device hardware hash has already been collected (or if an audit file exists) to avoid duplicate runs:
# Example: Evaluation code checks if output log exists
if (Test-Path "C:\ProgramData\amagent\AutopilotHashCollected.flag") {
exit 0 # Compliant - Skip Remediation
} else {
exit 1 # Non-Compliant - Trigger Remediation
}- Remediation Code: Place your hash extraction script logic within the Remediation block to perform the collection and set the local completion flag file.
4.Assign Target Groups & Execute:
Assign the Worklet to your target Windows Device Groups and run the policy during an approved maintenance window.