Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Docs: Windows custom OS settings (profiles) (#16398)

Browse Source 
- Update "Custom macOS settings" page to cross-platform "Custom OS
settings" page
- Match format w/ "Disk encryption" and "OS updates" pages
- Cut content and make the docs more of reference
- Link to best practice GitOps
- Update pricing page
- Add redirects
This commit is contained in:
Noah Talerman
2024-02-07 17:51:23 -05:00
committed by GitHub
parent 45d1f91b48
commit 633768676a
7 changed files with 52 additions and 162 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Using Fleet/MDM-custom-OS-settings.md
+42
View File
@@ -0,0 +1,42 @@
# Custom OS settings
In Fleet you can enforce OS settings on your macOS and Windows hosts using configuration profiles.
## Enforce OS settings
You can enforce OS settings using the Fleet UI, Fleet API, or [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops).
For macOS hosts, Fleet recommends the [iMazing Profile Creator](https://imazing.com/profile-editor) tool for creating and exporting macOS configuration profiles.
For Windows hosts, copy out this [Windows configuration profile template](https://fleetdm.com/example-windows-profile) and update the profile using any configuration service providers (CSPs) from [Microsoft's MDM protocol](https://learn.microsoft.com/en-us/windows/client-management/mdm/).
Fleet UI:
1. In the Fleet UI, head to the **Controls > OS settings > Custom settings** page.
2. Choose which team you want to add a configuration profile to by selecting the desired team in the teams dropdown in the upper left corner. Teams are available in Fleet Premium.
3. Select **Upload** and choose your configuration profile.
Fleet API: API documentation is [here](../REST%20API/rest-api.md#add-custom-setting-configuration-profile)
### OS settings status
In the Fleet UI, head to the **Controls > OS settings** tab.
In the top box, with "Verified," "Verifying," "Pending," and "Failed" statuses, click each status to view a list of hosts:
* Verified: hosts that installed all configuration profiles. Fleet has verified with osquery.
* Verifying: hosts that have acknowledged all MDM commands to install configuration profiles. Fleet is verifying the profiles are installed with osquery. If the profile wasn't installed, Fleet will redeliver the profile.
* Pending: hosts that will receive MDM commands to install configuration profiles when the hosts come online.
* Failed: hosts that failed to install configuration profiles.
In the list of hosts, click on an individual host and click the **OS settings** item to see the status for a specific setting.
<meta name="pageOrderInSection" value="1505">
<meta name="title" value="Custom OS settings">
<meta name="description" value="Learn how to enforce custom settings on macOS and Window hosts using Fleet's configuration profiles.">
<meta name="navSection" value="Device management">
docs/Using Fleet/MDM-custom-macOS-settings.md
-107
View File
@@ -1,107 +0,0 @@
# Custom macOS settings
In Fleet you can enforce custom settings on your macOS hosts using configuration profiles.
## Enforce custom settings
To enforce custom settings, we will do the following steps:
1. Create a configuration profile with iMazing Profile editor
2. Upload the profiles to Fleet
3. Confirm the setting is enforced
### Step 1: create a configuration profile
How to create a configuration profile with iMazing Profile Creator:
1. Download and install [iMazing Profile Creator](https://imazing.com/profile-editor).
2. Open iMazing Profile Creator and select macOS in the top bar.
3. Find and choose the settings you'd like to enforce on your macOS hosts.
> The best practice is to limit the scope of a single profile: only include one setting (ex. Restrictions) per profile. To enforce more settings, create and add additional profiles.
4. In iMazing Profile Creator, select the **General** tab. Enter a descriptive name in the **Name** field. When you add this profile to Fleet, Fleet will display this name in the Fleet UI.
5. In your top menu bar select **File** > **Save As...** and save your configuration profile. Make sure the file is saved as .mobileconfig.
### Step 2: upload configuration profile to Fleet
In Fleet, you can upload configuration profiles using the Fleet UI or fleetctl command-line tool.
The Fleet UI method is a good start if you're just getting familiar with Fleet.
The fleetctl CLI method enables managing configuration profiles in a Git repository. This way you can enforce code review and benefit from Git's change history.
Fleet UI:
1. In the Fleet UI, head to the **Controls > macOS settings > Custom settings** page.
2. Choose which team you want to add the configuration profile to by selecting the desired team in the teams dropdown in the upper left corner. Teams are available in Fleet Premium.
3. Select **Upload** and choose your configuration profile. After your configuration profile is uploaded to Fleet, Fleet will apply the profile to all macOS hosts in the selected team. Thereafter, the profile will be applied to new macOS hosts that enroll to that team.
fleetctl CLI:
1. Choose which team you want to add the configuration profile to.
In this example, we'll add a configuration profile to the "Workstations (canary)" team so that the setting only gets enforced on hosts assigned to this team.
2. Create a `workstations-canary-config.yaml` file:
```yaml
apiVersion: v1
kind: team
spec:
team:
name: Workstations (canary)
mdm:
macos_settings:
custom_settings:
- /path/to/configuration_profile.mobileconfig
...
```
Learn more about team configurations options [here](./configuration-files/README.md#teams).
To enforce settings on hosts that aren't assigned to a team ("No team"), we'll need to create an `fleet-config.yaml` file:
```yaml
apiVersion: v1
kind: config
spec:
mdm:
macos_settings:
custom_settings:
- /path/to/configuration_profile.mobileconfig
...
```
Learn more about configuration options for hosts that aren't assigned to a team [here](./configuration-files/README.md#organization-settings).
3. Add an `mdm.macos_settings.custom_settings` key to your YAML document. This key accepts an array of paths to your configuration profiles.
4. Run the `fleetctl apply -f workstations-canary-config.yml` command to upload the configuration profiles to Fleet. Note that this will override any configuration profiles added using the Fleet UI method.
### Step 3: confirm the setting is enforced
1. In the Fleet UI, head to the **Controls > macOS settings** tab.
2. In the top box, with "Verified," "Verifying," "Pending," and "Failed" statuses, click each status to view a list of hosts:
* Verified: hosts that installed all configuration profiles. Fleet has verified with osquery.
* Verifying: hosts that have acknowledged all MDM commands to install configuration profiles. Fleet is verifying the profiles are installed with osquery. If the profile wasn't installed, Fleet will redeliver the profile.
* Pending: hosts that will receive MDM commands to install configuration profiles when the hosts come online.
* Failed: hosts that failed to install configuration profiles.
3. In the list of hosts, click on an individual host and click the **macOS settings** item to see the status for a specific setting.
<meta name="pageOrderInSection" value="1505">
<meta name="title" value="Custom macOS settings">
<meta name="description" value="Learn how to enforce custom settings on macOS hosts using Fleet's configuration profiles.">
<meta name="navSection" value="Device management">
docs/Using Fleet/MDM-disk-encryption.md
+2 -38
View File
@@ -12,7 +12,7 @@ For Windows hosts, disk encryption is enforced on the C: volume (default system/
## Enforce disk encryption
You can enforce disk encryption in the Fleet UI, with Fleet API, or with the fleetctl command-line interface (CLI).
You can enforce disk encryption using the Fleet UI, Fleet API, or [Fleet's GitOps workflow](https://github.com/fleetdm/fleet-gitops).
Fleet UI:
@@ -22,43 +22,7 @@ Fleet UI:
3. Check the box next to **Turn on** and select **Save**.
Fleet API: API documentation is [here](../REST%20API/rest-api.md#update-disk-encryption-enforcement)
`fleetctl` CLI:
1. Choose which team you want to enforce disk encryption on.
In this example, we'll enforce disk encryption on the "Workstations (canary)" team so that disk encryption only gets enforced on hosts assigned to this team.
2. Create a `workstations-canary-config.yaml` file:
```yaml
apiVersion: v1
kind: team
spec:
team:
name: Workstations (canary)
mdm:
enable_disk_encryption: true
...
```
To enforce settings on hosts that aren't assigned to a team ("No team"), we'll need to create an `fleet-config.yaml` file:
```yaml
apiVersion: v1
kind: config
spec:
mdm:
enable_disk_encryption: true
...
```
3. Set the `mdm.enable_disk_encryption` configuration option to `true`.
4. Run the `fleetctl apply -f workstations-canary-config.yml` command.
> Fleet auto-configures `DeferForceAtUserLoginMaxBypassAttempts` to `1`, ensuring mandatory disk encryption during new Mac setup.
Fleet API: API documentation is [here](../REST%20API/rest-api.md#update-disk-encryption-enforcement).
### Disk encryption status
docs/Using Fleet/MDM-migration-guide.md
-12
View File
@@ -195,18 +195,6 @@ If a host under the old MDM solution has Activation Lock enabled, we recommend a
This is because if the Activation Lock is enabled, you will need the Activation Lock bypass code to successfully wipe and reuse the Mac.
However, Activation Lock bypass codes can only be retrieved from the Mac up to 30 days after the device is enrolled. This means that when migrating from your old MDM solution, it’s likely that you’ll be unable to retrieve the Activation Lock bypass code.
## Migrating settings
To enforce the same settings on your macOS hosts in Fleet as you did using your old MDM solution, you can migrate these settings to Fleet to reduce manual work.
If your old MDM solution enforces FileVault, follow [these instructions](./MDM-disk-encryption.md) to enforce FileVault (disk encryption) using Fleet.
For all other settings:
1. Check if your old MDM solution is able to export settings as .mobileconfig files. If it does, download these files.
* If it does not export settings, you will need to re-create the configuration profiles. Learn how to do that [here](./MDM-custom-macOS-settings.md#step-1-create-a-configuration-profile)
2. Create [teams](https://fleetdm.com/docs/using-fleet/teams) according to the needs of your organization
3. Follow the instructions to add configuration profiles to Fleet [here](./MDM-custom-macOS-settings.md#step-2-upload-configuration-profile-to-fleet).
### How to turn on disk encryption