Windows devices

Oneleet manages company-owned Windows devices through the Oneleet Agent — a lightweight background service that starts reporting within minutes of installation. Admins get continuous visibility into each device’s security posture, can enforce security settings across the fleet, and can take action remotely when a device is lost, being offboarded, or needs attention.

There are no certificates, vendor portals, or enrollment infrastructure to set up first: install the agent, have the employee connect it to your workspace from the Oneleet Portal, and the device appears in the Oneleet Dashboard.

What Oneleet can do today

Continuous security checks

The agent checks each device’s security posture every few minutes and reports results to the device view, where they roll up into the device’s compliance status:

• Disk encryption — BitLocker is enabled and the system drive is fully encrypted;
• Firewall — Windows Firewall is enabled across all network profiles (domain, private, and public);
• Screen lock — the device requires a password within 10 minutes of inactivity;
• Local user accounts — which accounts exist, which have administrator rights, and which are disabled;
• Device inventory — hardware model and serial number, OS version and build, and storage capacity.

Organizations using Oneleet MDM also receive extended inventory such as battery health. See Data collection for the full list of what the agent reports.

Because these checks feed Oneleet’s compliance monitors directly, a failing device shows up as an actionable gap in your compliance program — not just a row in a device list.

One-click remediation

When a check fails, admins can often fix it remotely instead of walking the employee through system settings:

• turn Windows Firewall back on for every network profile;
• re-enable screen locking and, if nothing else locks the device within 10 minutes, set Windows to lock after 10 minutes of inactivity. Windows applies that limit after the device restarts. If a device policy manages the inactivity timeout, ask your administrator to set it to 10 minutes or less. If device configuration has not synced, wait for it to sync and try the fix again.

The fix is applied by the agent on the device and the check re-reports automatically. To turn BitLocker on, require it in your device configuration policy instead (see BitLocker below).

Device configuration policies

Admins can enforce Windows security settings fleet-wide from the Configuration Profiles tab, with per-device overrides when a specific machine needs different values:

• Screen lock — inactivity timeout, require password on wake, and the grace period before the password is required. Windows applies a new inactivity timeout after the device restarts;
• Removable storage — block removable media devices;
• Credential protection — run the Windows credential subsystem (LSASS) as a protected process, hardening the device against credential-theft tooling;
• Windows Update — the feature-update version devices run, an install deadline, and the hours when devices should not restart (see Windows Update below);
• BitLocker — require BitLocker on the system drive with its recovery key saved to Oneleet, the encryption method, and read-only removable drives that BitLocker doesn’t protect (see BitLocker below).

A CIS-aligned secure-defaults baseline can be applied in one click as a starting point. In workspaces with BitLocker management, the baseline turns on Require BitLocker on the system drive with XTS-AES 256, so applying it starts encrypting every managed Windows device that isn’t encrypted yet, once we’ve saved the device’s recovery key. Devices running Oneleet Agent 2.5.0 or later apply a policy change as soon as you save it, or when they next come online. The device activity log shows each one as a Configuration sync requested by the admin who saved the change. A save made before the device picks up its waiting sync doesn’t add another one, because that sync applies the latest settings. Devices with an older agent pick up changes within about 15 minutes while they’re online. The agent continuously re-checks policies afterward: if a setting drifts from policy, the agent restores it automatically and reports the correction back to Oneleet.

Each report of corrections from the agent appears in the device activity log as one entry: Windows registry setting corrected for a single change, or the number of settings for several, such as 12 Windows registry settings corrected. BitLocker changes appear as BitLocker setting corrected. Open the entry to see each registry value or BitLocker change the agent made in the Result section. If something on the device keeps changing a setting back, the log lists that setting’s correction about once an hour instead of on every check. On a device joined to an Active Directory domain, Group Policy is a common cause. Check Active Directory on the device’s page for the Group Policy objects the domain applied, and find the one that sets the value. A correction the agent makes from a policy you just replaced, before it picks up the new one, isn’t listed.

The agent only applies configuration policies carrying a valid Oneleet signature for that device, and it checks that signature when it downloads the policy. Policies refresh automatically while the device is online. If a refresh fails or returns something the agent can’t verify, the device keeps enforcing the last policy it accepted rather than falling back to an unverified one.

Device configuration policies are part of Oneleet MDM. Contact Oneleet to enable them for your organization.

Updates to Oneleet’s required agent configuration are included in the same automatic refresh. Tenant policies and device overrides keep their precedence; changes to the recommended secure-defaults baseline don’t overwrite settings you’ve already chosen.

Windows Update

Two sections on Configuration Profiles control how Windows feature updates reach your fleet. Both are enforced through Windows Update for Business, so devices keep installing updates from Microsoft as usual — Oneleet sets the rules, not the update source.

Feature updates

• Product version and Target release pin devices to a Windows release, for example Windows 11 and 25H2. Set both: a target release has no effect without a product version, and Oneleet sends the pin only as a pair. Devices stay on that release until you change or clear the pin.
• Enforce an install deadline gives devices a fixed number of days to install a feature update once it is offered, with an optional grace period after the deadline. While the deadline is on, devices hold their restart until the deadline and grace period pass rather than restarting earlier.

These controls use the deadline policies Microsoft introduced for Windows 11, version 22H2, and that is where Oneleet has tested them. Windows 10 and Windows 11 21H2 use an older, combined deadline policy with different settings: Microsoft documents that those versions ignore the separate feature-update grace period, and the restart protection above is 22H2 and later only. Treat the deadline as unsupported on earlier versions until we confirm it on a device, and pin those devices with the target version instead.

Update Restart Behavior

• Enforce active hours names the hours when devices should not restart for an update. Windows honors at most 18 hours from the start hour and shortens a longer window on the device, so keep the range within 18 hours.
• Prevent users from pausing updates removes the option for people to pause updates on their own device. It controls the pause option only, not when devices restart.

Both sections only take effect as a whole. A deadline switched on without a day count, or active hours without both a start and an end, is not sent to devices at all — Windows would otherwise fall back to its own defaults under a setting you appear to have configured. The dashboard flags the missing field rather than saving a half-configured section.

Pinning Product version to Windows 11 on a Windows 10 device starts an operating-system upgrade on that device, and Microsoft treats applying the policy as acceptance of the Windows 11 license terms on your organization’s behalf. Check device eligibility before pinning a product version across a mixed fleet.

A device in more than one Oneleet workspace takes each of these sections from a single workspace — the first one that configures it — so it never enforces one workspace’s deadline switch alongside another’s day count. The two sections are owned separately, so one workspace can still supply the deadline and another the active hours.

BitLocker

The BitLocker section on Configuration Profiles turns BitLocker on across your Windows fleet and saves each device’s recovery key to Oneleet, so you can unlock a device that asks for its key. It is part of Oneleet MDM and needs Oneleet Agent version 2.6.0 or later.

BitLocker management is in early access. To use it, ask your Oneleet contact and we’ll turn it on for your workspace.

BitLocker needs a TPM that Windows reports as ready and a Pro, Enterprise, or Education edition of Windows. The agent reports devices without a ready TPM, and Windows Home devices, but doesn’t change them. Their Disk encryption check keeps failing so you can find them.

Turn BitLocker on

Turn on Require BitLocker on the system drive. On each managed device the agent, in this order:

1. adds a TPM key protector, so Windows unlocks the drive at startup without asking the user for anything;
2. adds a recovery password key protector, which is the 48-digit recovery key;
3. sends the recovery key to Oneleet and waits for us to confirm we saved it;
4. starts encrypting.

Encryption starts only after we confirm the key is saved, so a managed drive is never encrypted with a key nobody holds. No restart or user action is needed, and encryption runs in the background while the device is in use. The agent checks the drive every 5 minutes. Like the other Windows sections, a device applies a BitLocker change as soon as you save it, or when it next comes online.

The other settings:

• Encryption method picks XTS-AES 128 or XTS-AES 256 for the drives the agent encrypts. XTS-AES 256 is used when nothing is set. It also sets Windows’ cipher policy for the system drive, so C: uses the same cipher even if someone turns BitLocker on by hand. Drives that are already encrypted keep their cipher.
• Encrypt used space only encrypts just the space in use, which is faster. Data deleted before encryption started stays recoverable from the disk.
• Resume suspended protection resumes BitLocker protection that somebody suspended indefinitely, once the suspension has lasted an hour. Suspensions that end after a number of restarts, which Windows Update uses, are left alone.
• Block writes to removable drives BitLocker doesn’t protect makes USB drives and other removable drives that BitLocker doesn’t protect read-only (BitLocker To Go). It has no effect while Block removable storage in the Removable Media section is on.

Drives that are already encrypted

A drive that is already encrypted keeps its encryption, whether the user turned BitLocker on or Windows pre-encrypted a new device with a clear key. The agent adds the TPM and recovery password protectors that are missing, saves the recovery key, and turns protection on if Windows had left it off. A drive that unlocks with a TPM and PIN, a TPM and startup key, a startup key on a USB drive, or a password keeps that protector; the agent doesn’t add a TPM-only protector beside it, which would let the device start without them, but it still adds a missing recovery password, saves the key, and turns protection on. A drive that is being decrypted is left alone until decryption finishes.

View a saved recovery key

Open the device page and select the eye icon next to Encryption key. Revealing a key is recorded in the audit log. The key is hidden again when you hide it, open another device, or a rotation replaces it.

Encryption key also shows the key protector ID. Its first 8 characters are the Recovery key ID on the BitLocker recovery screen, so you can check that the key you’re reading is the one the device is asking for.

We encrypt each saved key at rest under your workspace’s own key. A device that is in more than one workspace has its key saved once for each workspace that manages it and requires BitLocker.

Encryption key says Not the current key when the device no longer reports the key’s protector, for example right after a rotation whose new key we haven’t received yet. It also notes when the saved key comes from a recovery password Oneleet didn’t create, because the user or another system may hold that key too. Rotate the key to replace it with one only Oneleet holds.

Rotate the recovery key

Open the device’s Manage device menu and choose Rotate BitLocker recovery key…. The agent creates a new recovery password, has Oneleet save it, and only then removes every other recovery password on the drive, including ones saved to Active Directory or Microsoft Entra ID. A key that leaked, or a copy the user printed or saved to a Microsoft account, stops working. If we can’t save the new key, the previous keys are kept and the task fails.

Rotation is available to admins, and to custom roles with the Rotate BitLocker recovery key permission, on Windows devices in workspaces with Oneleet MDM. It requires your workspace’s policy to require BitLocker on the device, and agent version 2.6.0 or later. One rotation runs at a time per device.

Activity log

The device activity log records:

• BitLocker setting corrected for each change the agent made: added a TPM key protector, added a recovery password key protector, started encrypting C: with XTS-AES 256 (full disk), resumed encrypting C:, turned on BitLocker protection, or resumed BitLocker protection. It also lists the agent removing the key protectors it added, when Windows could turn protection on before we saved the recovery key. Like registry corrections, a change that keeps recurring is listed at most once an hour.
• BitLocker recovery key saved, with the drive, the key protector, and whether the agent created the protector.
• Each rotation request, with who requested it and how it completed.

Activity entries never include the recovery key.

Limitations

• TPM with PIN and startup keys can’t be set up remotely. They need the user at the keyboard, so the agent adds a TPM-only protector.
• Only the system drive (C:) is managed. Fixed data drives aren’t, and neither are devices that run Windows from another drive.
• If a Group Policy sets a different cipher, Windows encrypts with that cipher and the agent reports it.
• Excluding a device from management, or turning Require BitLocker on the system drive off, doesn’t decrypt anything. We stop enforcing, and the drive stays encrypted.

Remote wipe

Remote wipe performs a full factory reset of the Windows device, removing company data and user profiles. This is a destructive action and should be used only when the device should no longer keep company data.

Use this when:

• a device is lost or stolen and should be treated as unrecoverable;
• an employee has left the company and the device needs to be reset;
• a device is being prepared for reassignment, return, or disposal.

Restart

Restart lets an admin reboot a Windows device remotely. The signed-in user sees a warning before the restart so they can save their work.

Use this when:

• a user is having an issue and a restart is the next troubleshooting step;
• a device needs to restart after configuration changes;
• the user cannot easily restart the device themselves.

Manage local user accounts

Admins can manage a device’s local Windows accounts remotely: create an account (optionally with administrator rights), disable or re-enable it, reset its password, or delete it.

Use this when:

• offboarding an employee and their local account should be disabled immediately;
• reclaiming a device and IT needs its own administrator account on it;
• a user is locked out and needs a password reset.

Install applications

Upload installers up to 500 MB. The file extension must match the installer format.

Admins can push software to a Windows device from the Oneleet Dashboard. Upload a .msi or .exe installer to the App catalog tab on the Devices page, give it a name and version, and set the options the installer needs to run unattended: Windows Installer properties for an .msi, command-line arguments such as /S for an .exe, and an optional timeout. Then open the device, go to its Apps tab, and choose Install application to pick one or more applications from the catalog.

Use this when:

• a new device needs the company’s standard tools;
• a security tool has to be rolled out to a device;
• a user needs an application they can’t install themselves.

Installing applications requires Oneleet MDM to be enabled for your workspace. The device must be managed and run Oneleet Agent version 2.4.0 or later. The agent downloads the installer over a time-limited signed link, verifies its checksum, and runs it with the options you set. Uploading a file your workspace already has reuses the existing catalog entry. While an install of an application is pending or in progress on a device, another install of the same application on that device is rejected.

Every action above is recorded in the device activity log, and the agent keeps itself up to date after installation — see the Oneleet MDM introduction for these shared capabilities.

Choose which devices are managed

Use MDM enrollment rules to include devices by people group or make device-specific exceptions. Excluding a BYOD device keeps security monitoring active while preventing remote management and automatic fixes.

After you exclude a device, the agent stops enforcing your organization’s configuration policies after its next successful policy download from Oneleet, which happens within about 15 minutes while the device is online. Until then, it keeps re-applying the policies it already has, and a device that stays offline or can’t reach Oneleet may keep enforcing them indefinitely. Settings the agent already applied stay in place.

On a device that’s also linked to another Oneleet workspace, per-device overrides apply only while every linked workspace manages the device.

Getting started

1. Have the employee open the Oneleet Portal and go to Devices. They select Install Oneleet Agent, or Connect another device if they already set one up, and download the Oneleet Agent for Windows.
2. Run the installer (administrator rights are required), then log in by clicking Connect this device in the agent and confirming the workspace.
3. The device appears in the Oneleet Dashboard under Devices, with security checks reporting within a few minutes and configured device policies applying automatically when the device is included in MDM.

The agent supports Windows 10 and later (x64). See Setup for detailed install and uninstall steps.

Offboarding a device

When a Windows device leaves service or changes hands:

• disable or reset the departing employee’s local account if the device is being reclaimed;
• use remote wipe if the device is being reset, returned, or disposed of;
• delete the device or mark it out of scope in the dashboard once it is no longer part of your fleet.

If you are unsure whether a device should be wiped or removed from management, contact Oneleet support before taking action.