diff --git a/it-and-security/fleets/workstations.yml b/it-and-security/fleets/workstations.yml index da63cf490f..8a96f021ef 100644 --- a/it-and-security/fleets/workstations.yml +++ b/it-and-security/fleets/workstations.yml @@ -299,13 +299,6 @@ software: # - Browsers # labels_include_any: # - "ARM-based Windows hosts" - - path: ../lib/windows/software/okta-verify.yml # Okta Verify for Windows (x86) - self_service: true - setup_experience: true - categories: - - Security - labels_include_any: - - "x86-based Windows hosts" app_store_apps: - app_store_id: "361285480" # Keynote display_name: "Keynote" @@ -552,6 +545,13 @@ software: - Communication labels_include_any: - "x86-based Windows hosts" + - slug: okta-verify/windows # Okta Verify for Windows (x86) + self_service: true + setup_experience: true + categories: + - Security + labels_include_any: + - "x86-based Windows hosts" - slug: visual-studio-code/windows # Microsoft Visual Studio for Windows self_service: true labels_include_any: diff --git a/it-and-security/lib/all/labels/windows-with-fleet-maintained-apps-installed.yml b/it-and-security/lib/all/labels/windows-with-fleet-maintained-apps-installed.yml index 98378501f8..7ec297a125 100644 --- a/it-and-security/lib/all/labels/windows-with-fleet-maintained-apps-installed.yml +++ b/it-and-security/lib/all/labels/windows-with-fleet-maintained-apps-installed.yml @@ -33,6 +33,11 @@ query: SELECT 1 FROM programs WHERE name LIKE 'Microsoft Visual Studio Code%' AND EXISTS (SELECT 1 FROM os_version WHERE arch NOT LIKE 'ARM%'); label_membership_type: dynamic platform: windows +- name: x86 Windows hosts with Okta Verify installed + description: x86 Windows hosts with Okta Verify installed + query: SELECT 1 FROM programs WHERE name = 'Okta Verify' AND EXISTS (SELECT 1 FROM os_version WHERE arch NOT LIKE 'ARM%'); + label_membership_type: dynamic + platform: windows - name: x86 Windows hosts with Adobe Acrobat Reader installed description: x86 Windows hosts with Adobe Acrobat Reader installed (excludes Adobe Acrobat Pro, which shares the 'Adobe Acrobat (64-bit)' program name on Windows; differentiated by the Reader install_location). query: SELECT 1 FROM programs WHERE ((name = 'Adobe Acrobat (64-bit)' AND publisher LIKE 'Adobe%' AND install_location LIKE '%\Reader\%') OR (name LIKE 'Adobe Acrobat Reader%' AND publisher LIKE 'Adobe%')) AND EXISTS (SELECT 1 FROM os_version WHERE arch NOT LIKE 'ARM%'); diff --git a/it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml b/it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml index 13550ae80b..df5fa99f7b 100644 --- a/it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml +++ b/it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml @@ -55,6 +55,14 @@ install_software: false labels_include_any: - x86 Windows hosts with Visual Studio Code installed +- name: Windows - Okta Verify up to date + description: The host may have an outdated version of Okta Verify, potentially risking security vulnerabilities or compatibility issues. + resolution: "Okta Verify is an app managed by IT and should be kept up to date automatically. If you are failing this policy, install the latest version from Self-service, then click Refetch. If you are still failing after Refetch completes, drop a note in #help-it." + type: patch + fleet_maintained_app_slug: okta-verify/windows + install_software: true + labels_include_any: + - x86 Windows hosts with Okta Verify installed - name: Windows - Adobe Acrobat Reader up to date description: This device may have an outdated version of Adobe Acrobat Reader, posing a critical security risk. Adobe Reader is a frequent target for exploits and must be kept up to date at all times. resolution: "Adobe Acrobat Reader is managed by IT and should be updated automatically. If you are failing this policy, install the latest version from Self-service. If you are still failing after Refetch completes, drop a note in #help-it." diff --git a/it-and-security/lib/windows/scripts/okta_verify_install.ps1 b/it-and-security/lib/windows/scripts/okta_verify_install.ps1 deleted file mode 100644 index 3bb090659c..0000000000 --- a/it-and-security/lib/windows/scripts/okta_verify_install.ps1 +++ /dev/null @@ -1,27 +0,0 @@ -# Learn more about .exe install scripts: -# http://fleetdm.com/learn-more-about/exe-install-scripts - -$exeFilePath = "${env:INSTALLER_PATH}" - -try { - -# WiX Burn bootstrapper uses /quiet for silent installation -$processOptions = @{ - FilePath = "$exeFilePath" - ArgumentList = "/quiet /norestart" - PassThru = $true - Wait = $true -} - -# Start process and track exit code -$process = Start-Process @processOptions -$exitCode = $process.ExitCode - -# Prints the exit code -Write-Host "Install exit code: $exitCode" -Exit $exitCode - -} catch { - Write-Host "Error: $_" - Exit 1 -} diff --git a/it-and-security/lib/windows/scripts/okta_verify_uninstall.ps1 b/it-and-security/lib/windows/scripts/okta_verify_uninstall.ps1 deleted file mode 100644 index faf25b164f..0000000000 --- a/it-and-security/lib/windows/scripts/okta_verify_uninstall.ps1 +++ /dev/null @@ -1,96 +0,0 @@ -# Fleet extracts name from installer (EXE) and saves it to PACKAGE_ID -# variable -$softwareName = $PACKAGE_ID - -# It is recommended to use exact software name here if possible to avoid -# uninstalling unintended software. -$softwareNameLike = "*Okta Verify*" - -# WiX Burn bootstrapper uses /quiet for silent uninstall -$uninstallArgs = "/quiet /norestart" - -$paths = @( - 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall', - 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall' -) - -$exitCode = 0 - -try { - -[array]$uninstallKeys = Get-ChildItem ` - -Path $paths ` - -ErrorAction SilentlyContinue | - ForEach-Object { Get-ItemProperty $_.PSPath } - -$foundUninstaller = $false -foreach ($key in $uninstallKeys) { - # If needed, add -notlike to the comparison to exclude certain similar - # software - if ($key.DisplayName -like $softwareNameLike) { - $foundUninstaller = $true - # Get the uninstall command. Some uninstallers do not include - # 'QuietUninstallString' and require a flag to run silently. - $uninstallCommand = if ($key.QuietUninstallString) { - $key.QuietUninstallString - } else { - $key.UninstallString - } - - # The uninstall command may contain command and args, like: - # "C:\Program Files\Software\uninstall.exe" /quiet - # Split the command and args - $splitArgs = $uninstallCommand.Split('"') - if ($splitArgs.Length -gt 1) { - if ($splitArgs.Length -eq 3) { - $existingArgs = $splitArgs[2].Trim() - if ($existingArgs -notmatch '/quiet') { - $uninstallArgs = "$existingArgs /quiet /norestart".Trim() - } else { - $uninstallArgs = $existingArgs - } - } elseif ($splitArgs.Length -gt 3) { - Throw ` - "Uninstall command contains multiple quoted strings. " + - "Please update the uninstall script.`n" + - "Uninstall command: $uninstallCommand" - } - $uninstallCommand = $splitArgs[1] - } else { - if ($uninstallCommand -notmatch '/quiet') { - $uninstallArgs = "/quiet /norestart" - } else { - $uninstallArgs = "" - } - } - Write-Host "Uninstall command: $uninstallCommand" - Write-Host "Uninstall args: $uninstallArgs" - - $processOptions = @{ - FilePath = $uninstallCommand - PassThru = $true - Wait = $true - } - - if ($uninstallArgs -ne '') { - $processOptions.ArgumentList = $uninstallArgs - } - - $process = Start-Process @processOptions - $exitCode = $process.ExitCode - Write-Host "Uninstall exit code: $exitCode" - break - } -} - -if (-not $foundUninstaller) { - Write-Host "Uninstall entry not found for $softwareNameLike" - Exit 0 -} - -Exit $exitCode - -} catch { - Write-Host "Error: $_" - Exit 1 -} diff --git a/it-and-security/lib/windows/software/okta-verify.yml b/it-and-security/lib/windows/software/okta-verify.yml deleted file mode 100644 index f6c8f0fc01..0000000000 --- a/it-and-security/lib/windows/software/okta-verify.yml +++ /dev/null @@ -1,5 +0,0 @@ -url: $DOGFOOD_OKTA_VERIFY_WINDOWS_URL -install_script: - path: ../scripts/okta_verify_install.ps1 -uninstall_script: - path: ../scripts/okta_verify_uninstall.ps1