CUT-5058: Update MDM Removal Script

[gweinjc]

Issues

• CUT-5058 - Update MDM Removal Script

What does this solve?

The purpose of this is to create parity between the MDM Removal process in ADMU and in the Support repo. Currently, there is 2 different logic patterns between the two repos and we'd like to consolidate these so it is easier to maintain in ADMU.

The script has been edited to have clear function definitions that will be used in the ADMU Actions workflows to compare the definitions declared in the Support script versus the definitions declared in ADMU. If these definitions are different, the ADMU workflow will fail and prompt to be updated.

We also needed to add a check for the MmpcEnrollmentFlag in the registry. Basically if that key's value is something other than 0, the device could still think that it is MDM enrolled. The script will now check the value and if it is not 0, it will set it 0.

Is there anything particularly tricky?

The script has been updated to have function definitions for all steps. The actual MDM removal process has been refactored to be a new function called Remove-WindowsMDMProvider

The script will still be executed the same way as it was before; the main difference is the Remove-WindowsMDMProvider function is called with the -forcePrune optional param (this won't be used in ADMU however it is needed for the Support script).

How should this be tested?

1. Have a Windows device that is MDM enrolled in some capacity.
2. Save a copy of the script (remove_windowsMDM.ps1) locally on the device
3. Navigate to the directory where the script is saved and run the following:

./remove_windowsMDM.ps1

4. Validate that the MDM entries were removed from the device

Screenshots

Screenshot of jcMDMCleanup.log file

Screenshot of terminal after running remove_windowsMDM.ps1

---

Note

Medium Risk
Touches a destructive Windows cleanup script that deletes registry keys, scheduled tasks, and certificates, and changes its execution flow (new ForcePrune behavior and registry flag reset). Mistakes could remove the wrong artifacts or fail to fully unenroll devices.

Overview
Refactors the Windows MDM cleanup PowerShell script into clearer, reusable functions, centered around a new Remove-WindowsMDMProvider entry point with optional -EnrollmentGUID targeted cleanup and -ForcePrune orphaned-GUID sweep.

Adds a new pre-cleanup step to reset HKLM:\SOFTWARE\Microsoft\Enrollments\MmpcEnrollmentFlag to 0 when present, and updates the script’s main execution to call Remove-WindowsMDMProvider -ForcePrune with structured error handling and final verification via Get-WindowsMDMProvider.

^{Written by Cursor Bugbot for commit 0502a9d. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

[jworkmanjc]

Retested, working for me

[kmaranionjc]

Tested good on my end