DoHzel on Windows with Microsoft Intune#

Introduction#

This guide explains how to deploy DoHzel to Windows endpoints managed by Microsoft Intune (formerly Microsoft Endpoint Manager). It focuses on what is specific to Windows: there are two distinct ways to run DoHzel, and they are deployed very differently.

Option 1 — DoHzel Proxy Option 2 — Windows native DoH
How it works A local resolver runs as a Windows service. DNS requests are intercepted on the device and resolved locally over encrypted DoH. Windows' built-in DNS-over-HTTPS client is pointed at the DoHzel resolver via the device's DoH template.
Agent on device Yes (dohzel-proxy service) No agent
Device provisioning Required — performed by the proxy binary (enroll / profile join) Required — performed by an Intune PowerShell script (enroll API), exactly like macOS
Joins a DoHzel profile Yes Yes
DNS leak protection Strong — interception prevents Windows DNS leaks Relies on the Windows native DoH stack, which is known to leak under certain conditions
Best for Production fleets, full DoHzel capabilities Lightweight, agentless rollouts

Provisioning is the same for both options

There is no difference in provisioning between the two options. In both cases the device must be enrolled in DoHzel and added to the appropriate profile. For Option 1 the proxy binary does this; for Option 2 an Intune-side script does it. Provisioning is what issues the per-device DoH template that Windows native DoH then pushes to the endpoint.

Recommendation

For managed production fleets, prefer Option 1 (DoHzel Proxy). It delivers the full DoHzel feature set and is not subject to the native Windows DoH leak behaviour. Use Option 2 when an on-device agent is not acceptable.

Tokens#

Both options enroll the device with the same two tokens (identical to the macOS flow):

Token Used as Purpose Where to obtain
Context token -ContextToken Identifies the DoHzel tenant when registering the device with the Hafnova enrollment API Hafnova — Contact us
Join token -JoinToken Enrolls the device and adds it to a DoHzel profile as Managed or Freedom DoHzel console → Devices → Add Device → Managed (or Freedom)

Do not hard-code production tokens in public documentation.

The DoHzel Proxy installs as a Windows service, enrolls the device with Hafnova, optionally joins a DoHzel profile, and intercepts DNS so that all queries are resolved locally over DoH. The full command reference lives in the dedicated guide:

➡️ DoHzel Proxy installation for Windows

Packaging note#

DoHzel ships only the raw executable (dohzel-proxy.windows-x64-latest.exe / …-arm64-…). There is no MSI or MSIX installer at this stage. To deploy through Intune you therefore wrap your own logic around the binary, using one of:

  • a Win32 app (.intunewin) that bundles the binary together with an install script, or
  • an Intune platform PowerShell script (or a Proactive Remediation) that downloads the binary and runs the setup commands.

Intune deployment outline#

The install logic runs the same commands documented in the Windows proxy guide, in this order:

# Run elevated (Intune executes in SYSTEM context)
$exe = "$env:ProgramData\Hafnova\dohzel-proxy.exe"

# 1. Obtain the binary (bundle it in the .intunewin or download it)
Invoke-WebRequest `
  -Uri "https://download.hafnova.com/dohzel-proxy/dohzel-proxy.windows-x64-latest.exe" `
  -OutFile $exe

# 2. Initialize configuration
& $exe init

# 3. Enroll the device (align the DoHzel name with the computer name)
& $exe enroll -name $env:COMPUTERNAME

# 4. (Optional) join an existing DoHzel profile
& $exe profile join "<PROFILE_TOKEN>"

# 5. Install and start the service
& $exe service install
& $exe service start

# 6. Enable DNS interception (prevents Windows DNS leaks)
& $exe intercept set on
Intune setting Suggested value
App type Windows app (Win32) wrapping the binary + script, or a platform script
Run context System
Detection rule Presence of C:\Program Files\Hafnova\DoHzel-Proxy or the dohzel-proxy service
Assignment Required, targeted at your Windows device group

Locking down configuration

To prevent users from changing the proxy configuration, run init --no-grant. See Note on Permissions.

Uninstall (Intune)#

$exe = "C:\Program Files\Hafnova\DoHzel-Proxy\dohzel-proxy.exe"
& $exe intercept set off
& $exe service uninstall
Remove-Item "C:\Program Files\Hafnova\DoHzel-Proxy" -Recurse -Force

Option 2 — Windows native DoH (no agent)#

This approach uses the DoH client built into Windows 10/11. No DoHzel agent is installed on the device. Instead, an Intune-side PowerShell script:

  1. Provisions the device — enrolls it with DoHzel and joins it to the profile (same context token + join token as macOS). Enrollment returns the per-device DoH template URL.
  2. Registers that DoH template in Windows.
  3. Activates native DoH on the network interfaces so Windows encrypts DNS itself.

The DoH link comes from provisioning

Enrollment returns a per-device DoH identifier (data.doh). The DoH template URL Windows needs is built from it as https://<data.doh>.secure.hafnova.com/dns-query. It is issued by enrollment — not a static value you type in — so the device must be provisioned and added to a profile before the DoH link exists and can be pushed to the endpoint. enroll-dohzel.ps1 builds this URL for you.

Requirements#

  • Windows 10 or Windows 11 with native DNS-over-HTTPS support
  • PowerShell running as Administrator (Intune runs scripts as SYSTEM)
  • Outbound HTTPS to api.hafnova.com (enrollment) and to the DoHzel resolver
  • A context token (Hafnova) and a join token (DoHzel console) — see Tokens
DoHzel resolver IPs used by the scripts (override with -Servers if needed):
78.40.72.90
5.135.96.35

Note

Confirm the current resolver IPs for your tenant in the console; the values above are the defaults baked into the scripts. The DoH template itself is obtained per device at enrollment.

Scripts#

Script Role
enroll-dohzel.ps1 Provision — enroll the device, join the profile, return the per-device DoH template
populate-doh.ps1 Register the DoH template in Windows
activate-dohzel-doh.ps1 Enable encrypted DNS and point existing interfaces at the DoHzel servers
setup-dohzel-doh.ps1 All-in-one — enroll → populate → activate (recommended for Intune)
cleanup-dohzel-doh.ps1 Revert interfaces to their default (DHCP) DNS configuration

Deploy setup-dohzel-doh.ps1 (together with the scripts it calls) as an Intune platform script or Proactive Remediation, running in System context. It provisions the device and configures native DoH in one pass:

# Wrapper an Intune script can run (tokens hard-coded for the tenant/group)
& "$PSScriptRoot\setup-dohzel-doh.ps1" `
    -ContextToken "YOUR_CONTEXT_TOKEN" `
    -JoinToken    "YOUR_JOIN_TOKEN"
Intune setting Suggested value
Script type Platform script (Windows) or Proactive Remediation
Run context System (64-bit PowerShell)
Files Bundle setup-dohzel-doh.ps1, enroll-dohzel.ps1, populate-doh.ps1, activate-dohzel-doh.ps1 together
Assignment Required, targeted at your Windows device group

Manual run (single machine)#

Run PowerShell as Administrator from the scripts folder:

# Provision + configure native DoH in one step
.\setup-dohzel-doh.ps1 -ContextToken "YOUR_CONTEXT_TOKEN" -JoinToken "YOUR_JOIN_TOKEN"

Or step by step (e.g. for debugging):

# 1. Provision; capture the per-device DoH template
$template = .\enroll-dohzel.ps1 -ContextToken "YOUR_CONTEXT_TOKEN" -JoinToken "YOUR_JOIN_TOKEN"

# 2. Register the DoH definition and activate it
.\populate-doh.ps1 -Template $template
.\activate-dohzel-doh.ps1

Verify the DoH definitions are upgraded to encrypted mode (AutoUpgrade = True):

Get-DnsClientDohServerAddress -ServerAddress 78.40.72.90,5.135.96.35

Confirm the interfaces use the DoHzel servers:

Get-DnsClientServerAddress -AddressFamily IPv4 |
  Where-Object { $_.ServerAddresses -contains "78.40.72.90" -or $_.ServerAddresses -contains "5.135.96.35" }

To revert:

.\cleanup-dohzel-doh.ps1
# Full removal (also drops the DoH definitions):
.\cleanup-dohzel-doh.ps1 -RemoveDefinitions

Limitations of the native DoH approach

  • Configuration applies to the interfaces that exist when the script runs. New adapters (VPN, USB Ethernet, cellular, virtual switches) require re-running the activation — a Proactive Remediation on a schedule handles this well.
  • There is no background enforcement: a user with rights can change DNS back.
  • Some VPN clients and endpoint-security tools override DNS and may take precedence.

Choosing between the options#

Both options provision the device the same way (enroll + join profile). The choice is about the enforcement mechanism on the endpoint:

  • Want leak-proof, continuously enforced DNS with a managed local resolver? → Option 1 (DoHzel Proxy).
  • Want a no-agent footprint and accept the native Windows DoH limitations? → Option 2 (Windows native DoH).