--- title: "RMM Tool \"Single Run\" Script Onboarding for MDE (Windows)" description: Comprehensive guide for Windows MDE Single-Run RMM Script Deployment. --- [Skip to content](https://knowledge.sittadel.com/windows-mde-single-run-script-deployment#main-content) [![Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent copy](https://knowledge.sittadel.com/hs-fs/hubfs/Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent%20copy.png?width=55&height=55&name=Sittadel-Logo-Icon-Slim-Large-Square-Green-Transparent%20copy.png)](https://sittadel.com/) - [About Sittadel](https://sittadel.com/about/) - [Capabilities](https://sittadel.com/capabilities/microsoft-office365-azure-security/) Show submenu for Capabilities - [Microsoft Security Architecture](https://sittadel.com/capabilities/microsoft-office365-azure-security/) - [Detection & Response](https://sittadel.com/capabilities/managed-detection-and-response/) - [Employee Training](https://sittadel.com/capabilities/security-awareness-training/) - [Security Risk Advisors](https://sittadel.com/capabilities/virtual-information-security-officer/) - [Resources](https://sittadel.com/resources/) - [Knowledge Base](https://knowledge.sittadel.com/) Open main navigation Close main navigation - [About Sittadel](https://sittadel.com/about/) - [Capabilities](https://sittadel.com/capabilities/microsoft-office365-azure-security/) Show submenu for Capabilities - [Microsoft Security Architecture](https://sittadel.com/capabilities/microsoft-office365-azure-security/) - [Detection & Response](https://sittadel.com/capabilities/managed-detection-and-response/) - [Employee Training](https://sittadel.com/capabilities/security-awareness-training/) - [Security Risk Advisors](https://sittadel.com/capabilities/virtual-information-security-officer/) - [Resources](https://sittadel.com/resources/) - [Knowledge Base](https://knowledge.sittadel.com/) - [Get Sittadel](https://sittadel.com/start/) [Get Sittadel](https://sittadel.com/start/) Find answers to your security questions. - There are no suggestions because the search field is empty. 1. [Sittadel Knowledge Base](https://knowledge.sittadel.com/?hsLang=en) 2. [Deploy MDE](https://knowledge.sittadel.com/deploy-mde?hsLang=en) 3. [RMM Tool Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#rmm-tool-deployment) # RMM Tool "Single Run" Script Onboarding for MDE (Windows) ## Comprehensive guide for Windows MDE Single-Run RMM Script Deployment utilizing the previously created detection/remediation combo script and a preferred RMM tool for bulk deployment to desired Windows machines. **Required Windows Versions:** Windows 10 1803+, Windows 11 (All) ### **Deploying MDE Single-Run Script through RMM** 1. This deployment example will be leveraging **Ninja RMM** tool, while the **RMM** **tool** can vary **the process should remain relatively the same.** 2. From the console of your desired **RMM tool**, we will want to access the portal that will **allow the creation of scripts**, here we will want to **create the Scheduled Script that will verify if the agent is already present on the device and if not execute the onboarding script supplied by the organizations Microsoft Defender portal**. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-26-2024-04-55-58-8150-PM.png?width=670&height=379&name=image-png-Aug-26-2024-04-55-58-8150-PM.png)** 3. Within **Ninja RMM,** you can either **copy and paste the code into the console or leverage drag and drop functionality to upload the necessary code for script execution.** We will be leveraging traditional **copy and paste** methodology for our example. 4. Leveraging the previously created **MDEOnboarding.cmd** script from the **MDE Single-Run Script** steps, we will want to **open the file** directly from a **preferred text editor.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-26-2024-04-57-10-5241-PM.png?width=670&height=424&name=image-png-Aug-26-2024-04-57-10-5241-PM.png)** 5. Once opened, we will want to **copy all the contents of the file and then paste the contents from the text editor window into the RMM console.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-26-2024-04-57-35-2402-PM.png?width=670&height=472&name=image-png-Aug-26-2024-04-57-35-2402-PM.png)** 6. Once the **script has been successfully ported over**, provide a **Name** and **Description** that is relevant to the **detection/remediation of the MDE agent**. We will want to specify that this is a **Batch** **file (\*.bat,\*.cmd,\*.nt)**, the **OS** is **Windows**, the **Architecture** can be either **32-bit** or **64-bit**, and we want to leverage **administrative privileges** so specify **Run As System.** Once **the script and additional configuration items have been configured**, select **Save** to confirm the **script creation.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-26-2024-04-58-22-8090-PM.png?width=337&height=550&name=image-png-Aug-26-2024-04-58-22-8090-PM.png)** 7. After **the script have been generated**, we will want to access the area of the **RMM tool** **that allows task scheduling for devices.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-26-2024-04-58-52-3294-PM.png?width=670&height=379&name=image-png-Aug-26-2024-04-58-52-3294-PM.png)** 8. Provide a **Name** and **Description** that is relevant to the **detection/remediation of the MDE agent**. We will want to specify that this **policy enforcement** will be on **Windows devices**, and we will want to make sure that this **policy is active once creation is completed**, select **Create** to confirm the **policy creation.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-26-2024-04-59-31-1109-PM.png?width=593&height=500&name=image-png-Aug-26-2024-04-59-31-1109-PM.png)** 9. After the **creation** we will need to **specify what this policy is trying to achieve during execution.** For this example, we will be **utilizing a** **scheduled task**. Verify that the proper sections are selected to achieve this functionality within your designated **RMM tool**. **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-26-2024-05-00-10-1892-PM.png?width=670&height=177&name=image-png-Aug-26-2024-05-00-10-1892-PM.png)** 10. We will want to select the **MDE Onboarding script** we created earlier as the script that will be leveraged for **task scheduling**. Provide a **Name** and **Description** that is relevant to the **detection/remediation of the MDE agent.** Schedule the task to run at **your desired timeframe**. You can also specify **if you want individuals to receive notifications if** **your RMM tool allows it**. Select **Add,** to continue to **policy finalization.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-26-2024-05-00-53-7227-PM.png?width=623&height=330&name=image-png-Aug-26-2024-05-00-53-7227-PM.png)** 11. If done correctly the **task should be listed within the section**, select **Save** to **finalize the creation of the scheduled task policy for the MDE Schedules Script RMM Deployment.** **![](https://knowledge.sittadel.com/hs-fs/hubfs/image-png-Aug-26-2024-05-01-25-6772-PM.png?width=670&height=171&name=image-png-Aug-26-2024-05-01-25-6772-PM.png)** ### Need Assistance? Reach out to your Customer Success Manager to discuss how a Sittadel cybersecurity analyst can assist in managing these tasks for you. New to our services? [Inquire](https://sittadel.com/start/) about arranging a consultation to explore optimizing your Azure environment for painless management. - [UserOps](https://knowledge.sittadel.com/userops?hsLang=en#main-content) - [Access & Permissions](https://knowledge.sittadel.com/userops?hsLang=en#access-permissions) - [Account](https://knowledge.sittadel.com/userops?hsLang=en#account) - [Devices](https://knowledge.sittadel.com/userops?hsLang=en#devices) - [Document Sharing](https://knowledge.sittadel.com/userops?hsLang=en#document-sharing) - [Email](https://knowledge.sittadel.com/userops?hsLang=en#email) - [Requests](https://knowledge.sittadel.com/userops?hsLang=en#requests) - [Troubleshoot](https://knowledge.sittadel.com/userops?hsLang=en#troubleshoot) - [TechOps](https://knowledge.sittadel.com/techops?hsLang=en#main-content) - [Tenant Foundations](https://knowledge.sittadel.com/techops?hsLang=en#tenant-foundations) - [Collaboration Security](https://knowledge.sittadel.com/techops?hsLang=en#collaboration-security) - [Email Security](https://knowledge.sittadel.com/techops?hsLang=en#email-security) - [Device Security](https://knowledge.sittadel.com/techops?hsLang=en#device-security) - [Identity Security](https://knowledge.sittadel.com/techops?hsLang=en#identity-security) - [SecOps](https://knowledge.sittadel.com/secops?hsLang=en#main-content) - [Email SOC](https://knowledge.sittadel.com/secops?hsLang=en#email-soc) - [Identity SOC](https://knowledge.sittadel.com/secops?hsLang=en#identity-soc) - [Tenant SOC](https://knowledge.sittadel.com/secops?hsLang=en#tenant-soc) - [Device SOC](https://knowledge.sittadel.com/secops?hsLang=en#device-soc) - [Deploy Intune](https://knowledge.sittadel.com/deploy-intune?hsLang=en) - [Deploy MDE](https://knowledge.sittadel.com/deploy-mde?hsLang=en#main-content) - [Overview](https://knowledge.sittadel.com/deploy-mde?hsLang=en#overview) - [Intune Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#intune-deployment) - [Hands-On Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#hands-on-deployment) - [Azure Arc Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#azure-arc-deployment) - [RMM Tool Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#rmm-tool-deployment) - [MECM/SCCM Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#mecm-sccm-deployment) - [GPO Deployment](https://knowledge.sittadel.com/deploy-mde?hsLang=en#gpo-deployment) - [Deploy Services](https://knowledge.sittadel.com/deploy-services?hsLang=en#main-content) - [Cloud Enclave](https://knowledge.sittadel.com/deploy-services?hsLang=en#cloud-enclave) - [Azure Portals](https://knowledge.sittadel.com/azure-portals?hsLang=en#main-content) - [Entra ID](https://knowledge.sittadel.com/azure-portals?hsLang=en#entra-id) - [Intune](https://knowledge.sittadel.com/azure-portals?hsLang=en#intune) - [Defender](https://knowledge.sittadel.com/azure-portals?hsLang=en#defender) - [Purview](https://knowledge.sittadel.com/azure-portals?hsLang=en#purview) - [SharePoint Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#sharepoint-admin-center) - [Teams Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#teams-admin-center) - [Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#admin-center) - [Exchange Admin Center](https://knowledge.sittadel.com/azure-portals?hsLang=en#exchange-admin-center) [![](https://knowledge.sittadel.com/hs-fs/hubfs/Sittadel_LogoH_Color_BlackText.png?width=186&height=55&name=Sittadel_LogoH_Color_BlackText.png)](https://Sittadel.com) Security for Humans. Copyright © 2026, Sittadel