diff --git a/docs/Configuration/configuration-files/README.md b/docs/Configuration/configuration-files/README.md index b803bfe033..298b2a7f4f 100644 --- a/docs/Configuration/configuration-files/README.md +++ b/docs/Configuration/configuration-files/README.md @@ -1131,12 +1131,10 @@ Enables or disables Windows MDM support. **Applies only to Fleet Premium**. -The following options allow configuring the behavior of Nudge for macOS hosts that belong to no team and are enrolled into Fleet's MDM. +The following options allow configuring OS updates for macOS hosts. ##### mdm.macos_updates.minimum_version -Hosts that belong to no team and are enrolled into Fleet's MDM will be nudged until their macOS is at or above this version. - Requires `mdm.macos_updates.deadline` to be set. - Default value: "" @@ -1151,8 +1149,6 @@ Requires `mdm.macos_updates.deadline` to be set. A deadline in the form of `YYYY-MM-DD`. The exact deadline time is at 04:00:00 (UTC-8). -Hosts that belong to no team and are enrolled into Fleet's MDM won't be able to dismiss the Nudge window once this deadline is past. - Requires `mdm.macos_updates.minimum_version` to be set. - Default value: "" @@ -1163,6 +1159,36 @@ Requires `mdm.macos_updates.minimum_version` to be set. deadline: "2022-01-01" ``` +##### mdm.windows_updates + +**Applies only to Fleet Premium**. + +The following options allow configuring OS updates for Windows hosts. + +##### mdm.windows_updates.deadline + +A deadline in days. + +- Default value: "" +- Config file format: + ```yaml + mdm: + windows_updates: + deadline_days: "5" + ``` + +##### mdm.windows_updates.grace_period + +A grace period in days. + +- Default value: "" +- Config file format: + ```yaml + mdm: + windows_updates: + grace_period_days: "2" + ``` + ##### mdm.macos_settings The following settings are macOS-specific settings for Fleet's MDM solution. diff --git a/docs/Using Fleet/MDM-OS-updates.md b/docs/Using Fleet/MDM-OS-updates.md new file mode 100644 index 0000000000..c10adb06a3 --- /dev/null +++ b/docs/Using Fleet/MDM-OS-updates.md @@ -0,0 +1,50 @@ +# OS updates + +_Available in Fleet Premium_ + +In Fleet you can enforce OS updates on your macOS and Windows hosts remotely. + +## Enforce OS updates + +You can enforce OS updates using the Fleet UI, Fleet API, or [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops). + +Fleet UI: + +1. Head to the **Controls** > **OS updates** tab. + +2. To enforce OS updates for macOS, select **macOS** and set a **Minimum version** and **Deadline**. + +3. For Windows, select **Windows** and set a **Deadline** and **Grace period**. + +Fleet API: API documentation is [here](https://fleetdm.com/docs/rest-api/rest-api#modify-team). + +## End user experience + +### macOS + +End users are encouraged to update macOS (via [Nudge](https://github.com/macadmins/nudge)). + +![Nudge window](https://raw.githubusercontent.com/fleetdm/fleet/main/docs/images/nudge-window.png) + +| | > 1 day before deadline | < 1 day before deadline | Past deadline | +| ------------------------------------ | ----------------------- | ----------------------- | --------------------- | +| Nudge window frequency | Once a day at 8pm GMT | Once every 2 hours | Immediately on login | +| End user can defer | ✅ | ✅ | ❌ | +| Nudge window is dismissible | ✅ | ✅ | ❌ | + +### Windows + +End users are encouraged to update Windows via the native Windows dialog. + +| | Before deadline | Past deadline | +| ----------------------------------------- | ----------------| ------------- | +| End user can defer automatic restart | ✅ | ❌ | + +If an end user was on vacation when the deadline passed, the end user is given a grace period (configured) before the host automatically restarts. + +Fleet enforces OS updates for quality and feature updates. Read more about the types of Windows OS updates in the Microsoft documentation [here](https://learn.microsoft.com/en-us/windows/deployment/update/get-started-updates-channels-tools#types-of-updates). + + + + + diff --git a/docs/Using Fleet/MDM-macOS-updates.md b/docs/Using Fleet/MDM-macOS-updates.md deleted file mode 100644 index d6380301d6..0000000000 --- a/docs/Using Fleet/MDM-macOS-updates.md +++ /dev/null @@ -1,160 +0,0 @@ -# macOS updates - -## End user macOS update reminders via Nudge - -_Available in Fleet Premium_ - -End users can be reminded and encouraged to update macOS (via [Nudge](https://github.com/macadmins/nudge)). - -![Nudge window](https://raw.githubusercontent.com/fleetdm/fleet/main/docs/images/nudge-window.png) - -A Fleet admin can set a minimum version and deadline for Fleet-enrolled hosts. If an end user's machine is below the minimum version, the Nudge window above will periodically appear to encourage them to upgrade. The end user has the option to defer the update, but as the deadline approaches, the Nudge window appears more frequently. - -When the end user machine is below the minimum version, Nudge applies the following behavior: - -| | > 1 day before deadline | < 1 day before deadline | past deadline | -| ------------------------------------ | ----------------------- | ----------------------- | --------------------- | -| Nudge window frequency | Once a day at 8pm GMT | Once every 2 hours | Immediately on login | -| End user can defer | ✅ | ✅ | ❌ | -| Nudge window is dismissable | ✅ | ✅ | ❌ | - - -### How to set up - -To set the macOS updates settings in the UI, visit the **Controls** section and then select the **macOS updates** tab. - -To set the macOS updates settings via CLI, use the configurations listed [here](https://fleetdm.com/docs/using-fleet/configuration-files#mdm-macos-updates). - -### End user experience - -After the user clicks "update" in the Nudge window, they will be taken to the standard Apple software update screen: - -![Apple software update screen on macOS 12](https://user-images.githubusercontent.com/5359586/228936740-2e8acf2e-6523-4710-9b3f-8243398bd98e.png) - -Here, the user would follow Apple's standard two-step process for macOS updates: -1. Download the macOS update. This occurs in the background and does not interrupt the end user's work. -2. Initiate the update which does prevent the end user from using the host for a time. - -On Intel Macs, Fleet triggers step 1 (downloading the macOS update) programmatically when a new version is available. This way, when the user arrives on the software update screen, they only need to initiate step 2. - -> On Macs with Apple Silicon (e.g. M1), downloading the macOS update may require end user action. Apple doesn't support downloading the update programmatically on Macs with Apple silicon. - -Step 2 (installing the update) always requires end user action. - -### Known issues - -#### Apple Rapid Security Responses (RSRs) - -Currently, end user macOS update reminders via Nudge don't support RSR versions (ex. "13.4.1 (a)"). - -You can use custom MDM commands in Fleet to trigger built-in macOS update reminders for RSRs. Learn how [here](#end-user-macos-update-via-built-in-macos-notifications). - -#### Mac is up to date - -Sometimes after the end user clicks "update" on the Nudge window, the end user's Mac will say that macOS is up to date when it isn't. This known issue can create a frustrating experience for the end user. Ask the end user to follow the steps below to troubleshoot: - -1. From the Apple menu in the top left corner of your screen, select **System Settings** or **System Preferences**. - -2. In the search bar, type "Software Update." Select **Software Update**. - -3. Type "Command (⌘)-R" to check for updates. If you see an available update, select **Restart Now** to update. - -4. If you still don't see an available update, from the Apple menu in the top left corner of your screen, select **Restart...** to restart your Mac. - -5. After your Mac restarts, from the Apple menu in the top left corner of your screen, select **System Settings** or **System Preferences**. - -6. In the search bar, type "Software Update." Select **Software Update** and select **Restart Now** to update. - -## End user macOS update via built-in macOS notifications - -Built-in macOS update reminders are available in Fleet Free and Fleet Premium. - -To trigger these reminders, we will do the following steps: - -1. Force a macOS update scan - -2. List available macOS updates - -3. Trigger macOS update reminder - -### Step 1: force a macOS update scan - -Use the request payload below when running a custom MDM command with Fleet. Documentation on how to run a custom command is [here](https://fleetdm.com/docs/using-fleet/mdm-commands#custom-commands). - -Request payload: - -```xml - - - - - Command - - ForceUpdateScan - - RequestType - ScheduleOSUpdateScan - - - -``` - -### Step 2: list available macOS updates - -1. Run another custom MDM command using the request payload below. - -Request payload: - -```xml - - - - - Command - - RequestType - AvailableOSUpdates - - - -``` - -2. Copy the `ProductKey` from the command's results. Documentation on how to view a command's results is [here](https://fleetdm.com/docs/using-fleet/mdm-commands#step-4-view-the-commands-results). - -Example product key: `MSU_UPDATE_22F770820d_patch_13.4.1_rsr` - -### Step 3: trigger macOS update reminder - -Run another custom MDM command using the request payload below. Replace the product key with your product key. - -> This payload will trigger the "Install ASAP" behavior which displays a macOS notification with a 60 seconds timer before the Mac automatically restarts. The end user can dismiss the timer. To trigger different behavior, update the `InstallAction`. Options are documented by Apple [here](https://developer.apple.com/documentation/devicemanagement/scheduleosupdatecommand/command/updatesitem). - -Request payload: - -```xml - - - - - Command - - RequestType - ScheduleOSUpdate - Updates - - - InstallAction - InstallASAP - ProductKey - MSU_UPDATE_22F770820d_patch_13.4.1_rsr - - - - - -``` - - - - - diff --git a/frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/NudgePreview.tsx b/frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/NudgePreview.tsx index bb1a822bcb..dd34cb565a 100644 --- a/frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/NudgePreview.tsx +++ b/frontend/pages/ManageControlsPage/OSUpdates/components/NudgePreview/NudgePreview.tsx @@ -23,7 +23,7 @@ const NudgeDescription = ({ platform }: INudgeDescriptionProps) => {

As the deadline gets closer, Fleet provides stronger encouragement.

@@ -31,15 +31,14 @@ const NudgeDescription = ({ platform }: INudgeDescriptionProps) => { <>

End user experience on Windows

- When a new Windows update is published, the update will be downloaded - and installed automatically before 8am and after 5pm (end user’s local - time). Before the deadline passes, users will be able to defer restarts. - After the deadline passes restart will be forced regardless of active - hours. + When a Windows host becomes aware of a new update, end users are able to + defer restarts. Automatic restarts happen before 8am and after 5pm (end + user’s local time). After the deadline, restarts are forced regardless + of active hours.

diff --git a/handbook/company/pricing-features-table.yml b/handbook/company/pricing-features-table.yml index fac8335144..4bcb9b125a 100644 --- a/handbook/company/pricing-features-table.yml +++ b/handbook/company/pricing-features-table.yml @@ -571,8 +571,8 @@ productCategories: [Device management] pricingTableCategories: [Device management] waysToUse: - - description: Ship a macOS workstation to the end users home and have them automatically enroll to Fleet during out-of-the-box setup. - - description: Ship a Windows workstation to the end users home and have them automatically enroll to Fleet during out-of-the-box setup. + - description: Ship a macOS workstation to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup. + - description: Ship a Windows workstation to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup. - description: Customize the out-of-the-box setup experience for your end users. - description: Require end users to authenticate with your identity provider (IdP) and agree to an end user license agreement (EULA) before they can use their new workstation - industryName: Enforce OS updates @@ -583,7 +583,7 @@ pricingTableCategories: [Device management] waysToUse: - description: Enforce macOS updates via Nudge. - - description: Automatically update Windows after the end user reaches a deadline. Coming soon (2023-12-30) #Customer-preston + - description: Automatically update Windows after the end user reaches a deadline. - industryName: Encrypt macOS hard disks with FileVault documentationUrl: https://fleetdm.com/docs/using-fleet/mdm-disk-encryption tier: Premium diff --git a/server/fleet/nudge.go b/server/fleet/nudge.go index 4e824553cb..3b6f75c4ce 100644 --- a/server/fleet/nudge.go +++ b/server/fleet/nudge.go @@ -62,7 +62,7 @@ func NewNudgeConfig(macOSUpdates MacOSUpdates) (*NudgeConfig, error) { RequiredMinimumOSVersion: macOSUpdates.MinimumVersion.Value, AboutUpdateURLs: []nudgeAboutUpdateURLs{{ Language: "en", - AboutUpdateURL: "https://fleetdm.com/docs/using-fleet/mdm-macos-updates", + AboutUpdateURL: "https://fleetdm.com/learn-more-about/os-updates", }}, }}, UserInterface: nudgeUserInterface{ diff --git a/website/config/routes.js b/website/config/routes.js index ea6e9797a8..4ae838ad4c 100644 --- a/website/config/routes.js +++ b/website/config/routes.js @@ -467,6 +467,7 @@ module.exports.routes = { 'GET /handbook/company/software-engineer-windows-go': '/handbook/company/open-positions/software-engineer-windows-go', 'GET /osquery-management': '/endpoint-ops', 'GET /guides/using-github-actions-to-apply-configuration-profiles-with-fleet': 'https://github.com/fleetdm/fleet-gitops', + 'GET /docs/using-fleet/mdm-macos-updates': '/docs/using-fleet/mdm-os-updates', 'GET /example-windows-profile': 'https://github.com/fleetdm/fleet-gitops/blob/860dcf2609e2b25a6d6becf8006a7118a19cd615/lib/windows-screenlock.xml',// « resuable link for OS settings doc page 'GET /docs/using-fleet/mdm-custom-macos-settings': '/docs/using-fleet/mdm-custom-os-settings', @@ -515,8 +516,9 @@ module.exports.routes = { // maintained by Fleet. These help avoid broken links by reducing surface area of links to maintain in the UI. 'GET /learn-more-about/chromeos-updates': 'https://support.google.com/chrome/a/answer/6220366', 'GET /learn-more-about/just-in-time-provisioning': '/docs/deploy/single-sign-on-sso#just-in-time-jit-user-provisioning', - 'GET /learn-more-about/custom-os-settings': '/docs/using-fleet/mdm-custom-os-settings', + 'GET /learn-more-about/os-updates': '/docs/using-fleet/mdm-os-updates', 'GET /sign-in-to/microsoft-automatic-enrollment-tool': 'https://portal.azure.com', + 'GET /learn-more-about/custom-os-settings': '/docs/using-fleet/mdm-custom-os-settings', 'GET /learn-more-about/enrolling-hosts': '/docs/using-fleet/adding-hosts', // Sitemap