deviceenroller.exe

Windows ProcessMicrosoft Corporation

Also called deviceenroller, device enroller, mdm enroller

WindowsSystem Component

Device Enroller. Work or school MDM uses it to enroll the PC in management. It is not Windows Update and it is not Defender.

What you need to know

This enrolls the PC in mobile device management. It is not a consumer "optimizer."

deviceenroller.exe is the MDM enrollment client. Access work or school starts it. Ending it mid-enroll leaves a half-joined device.

Safe?: Yes, in System32, if you meant to enroll
Why is it running?: A work or school account is enrolling
Should I end it?: Enrollment can fail halfway

Feex says

If Device Enroller appeared after I added a work account, I would let it finish. I would not treat it as CompatTelRunner.

What is deviceenroller.exe?

deviceenroller.exe is Windows Device Enrollment. Intune and other MDM authorities use this client on Windows.

What does it do?

It talks to the enrollment service, installs the management certificate, and applies the first policy set. It does not scan your Documents folder for malware.

Why is it running?

You clicked Connect on a work or school account, or an admin pushed Autopilot. A home PC that never added work should not see it often.

Is it safe?

Usually safe if you enrolled

System32 deviceenroller is Microsoft. If you did not add a work account and a fake enroller is running from Temp, that is the path check.

A legitimate copy normally runs from:

C:\Windows\System32\deviceenroller.exe

MDM enrollment client
Started from Access work or school
Not Windows Update

Can I end it?

Can leave enrollment broken

Ending deviceenroller.exe mid-flight can strand a partial MDM join. Disconnect the account from Settings if you did not mean to enroll, after it settles.

Can I remove it?

Do not delete deviceenroller.exe. Disconnect work or school from Settings if you want the PC unmanaged.

Should it start with Windows?

Enrollment starts it. Some management agents may call it again after a reset.

Normal resource behavior

These are contextual labels, not universal averages.

CPU: Moderate during enroll
Network: Required for the tenant
Disk: Certificates and policy
Memory: Moderate

File information

deviceenroller.exe file information
Executable name	deviceenroller.exe
Common legitimate path	C:\Windows\System32\deviceenroller.exe
Publisher	Microsoft Corporation
Signature expectation	Signed by Microsoft Windows

Common problems

Stuck at "enrolling"

Check the work tenant and time sync (W32Time). Do not delete the enroller.

Home user surprise

A leftover school account will keep trying. Disconnect it in Accounts.

Troubleshooting

Diagnose before you change anything destructive.

Settings > Accounts > Access work or school

See the connection. That is the control.

Event Viewer > DeviceManagement-Enterprise-Diagnostics-Provider

Enrollment errors land there.

Technical details

deviceenroller.exe technical details
Image name	deviceenroller.exe
Role	MDM device enrollment

Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.

Microsoft Learn: MDM enrollment · deviceenroller role
Microsoft Support: work or school · User-facing enroll
Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.

Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.