Please give more details of your use case.  E.g.

- What are the version and build numbers of your server and device agent?

- How do you intend to instantiate your script?

- Do your deploy lockdown-menu/kiosk mode on your devices? 

- Can your device end-users access the configuration tab of the device agent under normal operation?

hi,

- server is 14.4.2

- agent 13.9

- manual over "send script" or file sync

- yes we are deploying an lockdown menu

- the users have no access to the device agent

If you intend to initiate "send script" from web-console, you should rather directly use the "request device check-in" action.

If the script associated with any file-sync rule is to be run on the device, check-in operation is automatically initiated from the server side.

In both case, the check-in operation is not initiated from the device side as you said in your original post.   Thus, I believe you actually do not have any problem.

Perhaps you should give more details of your use case.