Azure Intune: Windows

Witness Anywhere – Intune Admin Guide (Windows Physical devices)

Lifecycle Overview

1. The registration script runs on a device, installs the WitnessAI Root CA certificate to the Local Machine trusted root store, generates a device fingerprint, registers with WitnessAI, writes the configuration to the user's registry (`HKEY_USERS\<SID>\Software\WitnessAI`), applies the PAC URL to the system proxy settings, and deploys STunnel for encrypted proxy communication.
2. The flush script can be assigned on-demand to revert all proxy settings, remove the Root CA certificate, uninstall STunnel, and delete the local configuration.

Generate Witness Anywhere Registration Scripts

• On your WitnessAI console, click Settings in the left-side menu, then select Proxy Configuration.

• Type your preferred token name in the Key Name field and select the Expiration Date. The Expiration Date should allow time for you to complete the current deployment.

• Click the Generate PAC Token

Download the Intune bundle from the Witness console

1. In the Witness console, open the Download Device Registration Script dialog.
2. Configure the download options:
• Platform: select Intune (Windows).
• Static Domain (Optional): enter the static domain if one is used for your tenant (e.g. witness.ai).
• STunnel (Optional): this toggle controls what the generated detection script validates:
• Enabled — the detection script includes stunnel health logic: it verifies that stunnel is installed under the user profile, the process is running, and it is listening as expected, in addition to the PAC/registry checks.
• Disabled — the detection script contains no stunnel logic and validates only the Witness Anywhere PAC/registry configuration.
3. Click Download.

4. Extract the downloaded bundle. It contains two folders: platform_scripts and remediation_scripts.

5. For this deployment, use the scripts from the platform_scripts folder: flush.ps1 and register_device.ps1.

Setting Up Intune Scripts

Upload the Registration Script

1. Go to Devices  → Manage devices → Scripts and remediations → Platform Scripts
2. Click ADD and select Windows 10 and later from the dropdown

3. On the Basics tab:
• Name: Witness Anywhere - Register Device
• Click Next
4. On the Script settings tab:
• Script location: Browse and select the register_device.ps1 file downloaded from the WitnessAI console
• Run this script using the logged on credentials: No
• Enforce script signature check: No
• Run script in 64 bit PowerShell Host: No
• Click Next

5. On the Assignments tab
• Assign to the relevant device or user groups.
• Click Next
6. Click Review + create tab → Create

Upload the Flush Script

1. Go to Devices  → Manage devices → Scripts and remediations → Platform Scripts
2. Click ADD and select Windows 10 and later from the dropdown
3. On the Basics tab:
• Name: Witness Anywhere - Flush Device
• Click Next
4. On the Script settings tab:
• Script location: Browse and select the flush.ps1 file downloaded from the WitnessAI console
• Run this script using the logged on credentials: No
• Enforce script signature check: No
• Run script in 64 bit PowerShell Host: No
• Click Next

5. On the Assignments tab
• Assign only to the devices you want to offboard.
• Click Next
6. Click Review + create tab → Create

Logs