Docs: Windows OS updates (#16270)
Docs for the "Windows OS updates" (#11951) user story - Update "macOS updates" doc page to cross-platform "OS updates" page - Update pricing page - Update copy in the UI to clarify behavior of Windows updates --------- Co-authored-by: Eric <eashaw@sailsjs.com> Co-authored-by: Rachael Shaw <r@rachael.wtf>
This commit is contained in:
Noah Talerman
co-authored by
Eric
Rachael Shaw
Eric
Rachael Shaw
parent
c723bd48b5
commit
50edcc07d0
@@ -1131,12 +1131,10 @@ Enables or disables Windows MDM support.
|
||||
|
||||
**Applies only to Fleet Premium**.
|
||||
|
||||
The following options allow configuring the behavior of Nudge for macOS hosts that belong to no team and are enrolled into Fleet's MDM.
|
||||
The following options allow configuring OS updates for macOS hosts.
|
||||
|
||||
##### mdm.macos_updates.minimum_version
|
||||
|
||||
Hosts that belong to no team and are enrolled into Fleet's MDM will be nudged until their macOS is at or above this version.
|
||||
|
||||
Requires `mdm.macos_updates.deadline` to be set.
|
||||
|
||||
- Default value: ""
|
||||
@@ -1151,8 +1149,6 @@ Requires `mdm.macos_updates.deadline` to be set.
|
||||
|
||||
A deadline in the form of `YYYY-MM-DD`. The exact deadline time is at 04:00:00 (UTC-8).
|
||||
|
||||
Hosts that belong to no team and are enrolled into Fleet's MDM won't be able to dismiss the Nudge window once this deadline is past.
|
||||
|
||||
Requires `mdm.macos_updates.minimum_version` to be set.
|
||||
|
||||
- Default value: ""
|
||||
@@ -1163,6 +1159,36 @@ Requires `mdm.macos_updates.minimum_version` to be set.
|
||||
deadline: "2022-01-01"
|
||||
```
|
||||
|
||||
##### mdm.windows_updates
|
||||
|
||||
**Applies only to Fleet Premium**.
|
||||
|
||||
The following options allow configuring OS updates for Windows hosts.
|
||||
|
||||
##### mdm.windows_updates.deadline
|
||||
|
||||
A deadline in days.
|
||||
|
||||
- Default value: ""
|
||||
- Config file format:
|
||||
```yaml
|
||||
mdm:
|
||||
windows_updates:
|
||||
deadline_days: "5"
|
||||
```
|
||||
|
||||
##### mdm.windows_updates.grace_period
|
||||
|
||||
A grace period in days.
|
||||
|
||||
- Default value: ""
|
||||
- Config file format:
|
||||
```yaml
|
||||
mdm:
|
||||
windows_updates:
|
||||
grace_period_days: "2"
|
||||
```
|
||||
|
||||
##### mdm.macos_settings
|
||||
|
||||
The following settings are macOS-specific settings for Fleet's MDM solution.
|
||||
|
||||
@@ -0,0 +1,50 @@
|
||||
# OS updates
|
||||
|
||||
_Available in Fleet Premium_
|
||||
|
||||
In Fleet you can enforce OS updates on your macOS and Windows hosts remotely.
|
||||
|
||||
## Enforce OS updates
|
||||
|
||||
You can enforce OS updates using the Fleet UI, Fleet API, or [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops).
|
||||
|
||||
Fleet UI:
|
||||
|
||||
1. Head to the **Controls** > **OS updates** tab.
|
||||
|
||||
2. To enforce OS updates for macOS, select **macOS** and set a **Minimum version** and **Deadline**.
|
||||
|
||||
3. For Windows, select **Windows** and set a **Deadline** and **Grace period**.
|
||||
|
||||
Fleet API: API documentation is [here](https://fleetdm.com/docs/rest-api/rest-api#modify-team).
|
||||
|
||||
## End user experience
|
||||
|
||||
### macOS
|
||||
|
||||
End users are encouraged to update macOS (via [Nudge](https://github.com/macadmins/nudge)).
|
||||
|
||||
|
||||
|
||||
| | > 1 day before deadline | < 1 day before deadline | Past deadline |
|
||||
| ------------------------------------ | ----------------------- | ----------------------- | --------------------- |
|
||||
| Nudge window frequency | Once a day at 8pm GMT | Once every 2 hours | Immediately on login |
|
||||
| End user can defer | ✅ | ✅ | ❌ |
|
||||
| Nudge window is dismissible | ✅ | ✅ | ❌ |
|
||||
|
||||
### Windows
|
||||
|
||||
End users are encouraged to update Windows via the native Windows dialog.
|
||||
|
||||
| | Before deadline | Past deadline |
|
||||
| ----------------------------------------- | ----------------| ------------- |
|
||||
| End user can defer automatic restart | ✅ | ❌ |
|
||||
|
||||
If an end user was on vacation when the deadline passed, the end user is given a grace period (configured) before the host automatically restarts.
|
||||
|
||||
Fleet enforces OS updates for quality and feature updates. Read more about the types of Windows OS updates in the Microsoft documentation [here](https://learn.microsoft.com/en-us/windows/deployment/update/get-started-updates-channels-tools#types-of-updates).
|
||||
|
||||
<meta name="pageOrderInSection" value="1503">
|
||||
<meta name="title" value="OS updates">
|
||||
<meta name="description" value="Learn how to manage OS updates on macOS and Windows devices.">
|
||||
<meta name="navSection" value="Device management">
|
||||
@@ -1,160 +0,0 @@
|
||||
# macOS updates
|
||||
|
||||
## End user macOS update reminders via Nudge
|
||||
|
||||
_Available in Fleet Premium_
|
||||
|
||||
End users can be reminded and encouraged to update macOS (via [Nudge](https://github.com/macadmins/nudge)).
|
||||
|
||||
|
||||
|
||||
A Fleet admin can set a minimum version and deadline for Fleet-enrolled hosts. If an end user's machine is below the minimum version, the Nudge window above will periodically appear to encourage them to upgrade. The end user has the option to defer the update, but as the deadline approaches, the Nudge window appears more frequently.
|
||||
|
||||
When the end user machine is below the minimum version, Nudge applies the following behavior:
|
||||
|
||||
| | > 1 day before deadline | < 1 day before deadline | past deadline |
|
||||
| ------------------------------------ | ----------------------- | ----------------------- | --------------------- |
|
||||
| Nudge window frequency | Once a day at 8pm GMT | Once every 2 hours | Immediately on login |
|
||||
| End user can defer | ✅ | ✅ | ❌ |
|
||||
| Nudge window is dismissable | ✅ | ✅ | ❌ |
|
||||
|
||||
|
||||
### How to set up
|
||||
|
||||
To set the macOS updates settings in the UI, visit the **Controls** section and then select the **macOS updates** tab.
|
||||
|
||||
To set the macOS updates settings via CLI, use the configurations listed [here](https://fleetdm.com/docs/using-fleet/configuration-files#mdm-macos-updates).
|
||||
|
||||
### End user experience
|
||||
|
||||
After the user clicks "update" in the Nudge window, they will be taken to the standard Apple software update screen:
|
||||
|
||||
|
||||
|
||||
Here, the user would follow Apple's standard two-step process for macOS updates:
|
||||
1. Download the macOS update. This occurs in the background and does not interrupt the end user's work.
|
||||
2. Initiate the update which does prevent the end user from using the host for a time.
|
||||
|
||||
On Intel Macs, Fleet triggers step 1 (downloading the macOS update) programmatically when a new version is available. This way, when the user arrives on the software update screen, they only need to initiate step 2.
|
||||
|
||||
> On Macs with Apple Silicon (e.g. M1), downloading the macOS update may require end user action. Apple doesn't support downloading the update programmatically on Macs with Apple silicon.
|
||||
|
||||
Step 2 (installing the update) always requires end user action.
|
||||
|
||||
### Known issues
|
||||
|
||||
#### Apple Rapid Security Responses (RSRs)
|
||||
|
||||
Currently, end user macOS update reminders via Nudge don't support RSR versions (ex. "13.4.1 (a)").
|
||||
|
||||
You can use custom MDM commands in Fleet to trigger built-in macOS update reminders for RSRs. Learn how [here](#end-user-macos-update-via-built-in-macos-notifications).
|
||||
|
||||
#### Mac is up to date
|
||||
|
||||
Sometimes after the end user clicks "update" on the Nudge window, the end user's Mac will say that macOS is up to date when it isn't. This known issue can create a frustrating experience for the end user. Ask the end user to follow the steps below to troubleshoot:
|
||||
|
||||
1. From the Apple menu in the top left corner of your screen, select **System Settings** or **System Preferences**.
|
||||
|
||||
2. In the search bar, type "Software Update." Select **Software Update**.
|
||||
|
||||
3. Type "Command (⌘)-R" to check for updates. If you see an available update, select **Restart Now** to update.
|
||||
|
||||
4. If you still don't see an available update, from the Apple menu in the top left corner of your screen, select **Restart...** to restart your Mac.
|
||||
|
||||
5. After your Mac restarts, from the Apple menu in the top left corner of your screen, select **System Settings** or **System Preferences**.
|
||||
|
||||
6. In the search bar, type "Software Update." Select **Software Update** and select **Restart Now** to update.
|
||||
|
||||
## End user macOS update via built-in macOS notifications
|
||||
|
||||
Built-in macOS update reminders are available in Fleet Free and Fleet Premium.
|
||||
|
||||
To trigger these reminders, we will do the following steps:
|
||||
|
||||
1. Force a macOS update scan
|
||||
|
||||
2. List available macOS updates
|
||||
|
||||
3. Trigger macOS update reminder
|
||||
|
||||
### Step 1: force a macOS update scan
|
||||
|
||||
Use the request payload below when running a custom MDM command with Fleet. Documentation on how to run a custom command is [here](https://fleetdm.com/docs/using-fleet/mdm-commands#custom-commands).
|
||||
|
||||
Request payload:
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>Command</key>
|
||||
<dict>
|
||||
<key>ForceUpdateScan</key>
|
||||
<true/>
|
||||
<key>RequestType</key>
|
||||
<string>ScheduleOSUpdateScan</string>
|
||||
</dict>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
### Step 2: list available macOS updates
|
||||
|
||||
1. Run another custom MDM command using the request payload below.
|
||||
|
||||
Request payload:
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>Command</key>
|
||||
<dict>
|
||||
<key>RequestType</key>
|
||||
<string>AvailableOSUpdates</string>
|
||||
</dict>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
2. Copy the `ProductKey` from the command's results. Documentation on how to view a command's results is [here](https://fleetdm.com/docs/using-fleet/mdm-commands#step-4-view-the-commands-results).
|
||||
|
||||
Example product key: `MSU_UPDATE_22F770820d_patch_13.4.1_rsr`
|
||||
|
||||
### Step 3: trigger macOS update reminder
|
||||
|
||||
Run another custom MDM command using the request payload below. Replace the product key with your product key.
|
||||
|
||||
> This payload will trigger the "Install ASAP" behavior which displays a macOS notification with a 60 seconds timer before the Mac automatically restarts. The end user can dismiss the timer. To trigger different behavior, update the `InstallAction`. Options are documented by Apple [here](https://developer.apple.com/documentation/devicemanagement/scheduleosupdatecommand/command/updatesitem).
|
||||
|
||||
Request payload:
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
|
||||
<plist version="1.0">
|
||||
<dict>
|
||||
<key>Command</key>
|
||||
<dict>
|
||||
<key>RequestType</key>
|
||||
<string>ScheduleOSUpdate</string>
|
||||
<key>Updates</key>
|
||||
<array>
|
||||
<dict>
|
||||
<key>InstallAction</key>
|
||||
<string>InstallASAP</string>
|
||||
<key>ProductKey</key>
|
||||
<string>MSU_UPDATE_22F770820d_patch_13.4.1_rsr</string>
|
||||
</dict>
|
||||
</array>
|
||||
</dict>
|
||||
</dict>
|
||||
</plist>
|
||||
```
|
||||
|
||||
<meta name="pageOrderInSection" value="1503">
|
||||
<meta name="title" value="macOS updates">
|
||||
<meta name="description" value="Learn how to manage macOS updates and set up end user reminders with Fleet MDM.">
|
||||
<meta name="navSection" value="Device management">
|
||||
+6
-7
@@ -23,7 +23,7 @@ const NudgeDescription = ({ platform }: INudgeDescriptionProps) => {
|
||||
<p>As the deadline gets closer, Fleet provides stronger encouragement.</p>
|
||||
<CustomLink
|
||||
text="Learn more about macOS updates in Fleet"
|
||||
url="https://fleetdm.com/docs/using-fleet/mdm-macos-updates"
|
||||
url="https://fleetdm.com/learn-more-about/os-updates"
|
||||
newTab
|
||||
/>
|
||||
</>
|
||||
@@ -31,15 +31,14 @@ const NudgeDescription = ({ platform }: INudgeDescriptionProps) => {
|
||||
<>
|
||||
<h3>End user experience on Windows</h3>
|
||||
<p>
|
||||
When a new Windows update is published, the update will be downloaded
|
||||
and installed automatically before 8am and after 5pm (end user’s local
|
||||
time). Before the deadline passes, users will be able to defer restarts.
|
||||
After the deadline passes restart will be forced regardless of active
|
||||
hours.
|
||||
When a Windows host becomes aware of a new update, end users are able to
|
||||
defer restarts. Automatic restarts happen before 8am and after 5pm (end
|
||||
user’s local time). After the deadline, restarts are forced regardless
|
||||
of active hours.
|
||||
</p>
|
||||
<CustomLink
|
||||
text="Learn more about Windows updates in Fleet"
|
||||
url="Links to: https://fleetdm.com/docs/using-fleet/mdm-windows-updates"
|
||||
url="https://fleetdm.com/learn-more-about/os-updates"
|
||||
newTab
|
||||
/>
|
||||
</>
|
||||
|
||||
@@ -571,8 +571,8 @@
|
||||
productCategories: [Device management]
|
||||
pricingTableCategories: [Device management]
|
||||
waysToUse:
|
||||
- description: Ship a macOS workstation to the end users home and have them automatically enroll to Fleet during out-of-the-box setup.
|
||||
- description: Ship a Windows workstation to the end users home and have them automatically enroll to Fleet during out-of-the-box setup.
|
||||
- description: Ship a macOS workstation to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup.
|
||||
- description: Ship a Windows workstation to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup.
|
||||
- description: Customize the out-of-the-box setup experience for your end users.
|
||||
- description: Require end users to authenticate with your identity provider (IdP) and agree to an end user license agreement (EULA) before they can use their new workstation
|
||||
- industryName: Enforce OS updates
|
||||
@@ -583,7 +583,7 @@
|
||||
pricingTableCategories: [Device management]
|
||||
waysToUse:
|
||||
- description: Enforce macOS updates via Nudge.
|
||||
- description: Automatically update Windows after the end user reaches a deadline. Coming soon (2023-12-30) #Customer-preston
|
||||
- description: Automatically update Windows after the end user reaches a deadline.
|
||||
- industryName: Encrypt macOS hard disks with FileVault
|
||||
documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-disk-encryption
|
||||
tier: Premium
|
||||
|
||||
@@ -62,7 +62,7 @@ func NewNudgeConfig(macOSUpdates MacOSUpdates) (*NudgeConfig, error) {
|
||||
RequiredMinimumOSVersion: macOSUpdates.MinimumVersion.Value,
|
||||
AboutUpdateURLs: []nudgeAboutUpdateURLs{{
|
||||
Language: "en",
|
||||
AboutUpdateURL: "https://fleetdm.com/docs/using-fleet/mdm-macos-updates",
|
||||
AboutUpdateURL: "https://fleetdm.com/learn-more-about/os-updates",
|
||||
}},
|
||||
}},
|
||||
UserInterface: nudgeUserInterface{
|
||||
|
||||
Vendored
+3
-1
@@ -467,6 +467,7 @@ module.exports.routes = {
|
||||
'GET /handbook/company/software-engineer-windows-go': '/handbook/company/open-positions/software-engineer-windows-go',
|
||||
'GET /osquery-management': '/endpoint-ops',
|
||||
'GET /guides/using-github-actions-to-apply-configuration-profiles-with-fleet': 'https://github.com/fleetdm/fleet-gitops',
|
||||
'GET /docs/using-fleet/mdm-macos-updates': '/docs/using-fleet/mdm-os-updates',
|
||||
'GET /example-windows-profile': 'https://github.com/fleetdm/fleet-gitops/blob/860dcf2609e2b25a6d6becf8006a7118a19cd615/lib/windows-screenlock.xml',// « resuable link for OS settings doc page
|
||||
'GET /docs/using-fleet/mdm-custom-macos-settings': '/docs/using-fleet/mdm-custom-os-settings',
|
||||
|
||||
@@ -515,8 +516,9 @@ module.exports.routes = {
|
||||
// maintained by Fleet. These help avoid broken links by reducing surface area of links to maintain in the UI.
|
||||
'GET /learn-more-about/chromeos-updates': 'https://support.google.com/chrome/a/answer/6220366',
|
||||
'GET /learn-more-about/just-in-time-provisioning': '/docs/deploy/single-sign-on-sso#just-in-time-jit-user-provisioning',
|
||||
'GET /learn-more-about/custom-os-settings': '/docs/using-fleet/mdm-custom-os-settings',
|
||||
'GET /learn-more-about/os-updates': '/docs/using-fleet/mdm-os-updates',
|
||||
'GET /sign-in-to/microsoft-automatic-enrollment-tool': 'https://portal.azure.com',
|
||||
'GET /learn-more-about/custom-os-settings': '/docs/using-fleet/mdm-custom-os-settings',
|
||||
'GET /learn-more-about/enrolling-hosts': '/docs/using-fleet/adding-hosts',
|
||||
|
||||
// Sitemap
|
||||
|
||||
Reference in New Issue
Block a user