Windows removal script (#16172)

changes/15689-remove-fleetd-script

@@ -0,0 +1 @@
+* Added Windows scripts to unenroll MDM and remove fleetd.

orbit/pkg/scripts/exec_windows.go

@@ -13,7 +13,7 @@ func execCmd(ctx context.Context, scriptPath string) (output []byte, exitCode in
 	exitCode = -1
 
 	// for Windows, we execute the file with powershell.
-	cmd := exec.CommandContext(ctx, "powershell", "-ExecutionPolicy", "Bypass", "-File", scriptPath)
+	cmd := exec.CommandContext(ctx, "powershell", "-MTA", "-ExecutionPolicy", "Bypass", "-File", scriptPath)
 	cmd.Dir = filepath.Dir(scriptPath)
 	output, err = cmd.CombinedOutput()
 	if cmd.ProcessState != nil {

scripts/mdm/windows/windows-remove-fleetd.ps1

@@ -0,0 +1,110 @@
+function Test-Administrator  
+{  
+    [OutputType([bool])]
+    param()
+    process {
+        [Security.Principal.WindowsPrincipal]$user = [Security.Principal.WindowsIdentity]::GetCurrent();
+        return $user.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator);
+    }
+}
+
+# borrowed from Jeffrey Snover http://blogs.msdn.com/powershell/archive/2006/12/07/resolve-error.aspx
+function Resolve-Error-Detailed($ErrorRecord = $Error[0]) {
+  $error_message = "========== ErrorRecord:{0}ErrorRecord.InvocationInfo:{1}Exception:{2}"
+  $formatted_errorRecord = $ErrorRecord | format-list * -force | out-string
+  $formatted_invocationInfo = $ErrorRecord.InvocationInfo | format-list * -force | out-string
+  $formatted_exception = ""
+  $Exception = $ErrorRecord.Exception
+  for ($i = 0; $Exception; $i++, ($Exception = $Exception.InnerException)) {
+    $formatted_exception += ("$i" * 70) + "-----"
+    $formatted_exception += $Exception | format-list * -force | out-string
+    $formatted_exception += "-----"
+  }
+
+  return $error_message -f $formatted_errorRecord, $formatted_invocationInfo, $formatted_exception
+}
+
+#Stops Orbit service and related processes
+function Stop-Orbit {
+
+  # Stop Service
+  Stop-Service -Name "Fleet osquery" -ErrorAction "Continue"
+  Start-Sleep -Milliseconds 1000
+
+  # Ensure that no process left running
+  Get-Process -Name "orbit" -ErrorAction "SilentlyContinue" | Stop-Process -Force
+  Get-Process -Name "osqueryd" -ErrorAction "SilentlyContinue" | Stop-Process -Force
+  Get-Process -Name "fleet-desktop" -ErrorAction "SilentlyContinue" | Stop-Process -Force
+  Start-Sleep -Milliseconds 1000
+}
+
+#Remove Orbit footprint from registry and disk
+function Force-Remove-Orbit {
+
+  try {
+
+    #Stoping Orbit
+    Stop-Orbit
+
+    #Remove Service
+    $service = Get-WmiObject -Class Win32_Service -Filter "Name='Fleet osquery'"
+    if ($service) {
+      $service.delete() | Out-Null
+    }
+
+    #Removing Program files entries
+    $targetPath = $Env:Programfiles + "\\Orbit"
+    Remove-Item -LiteralPath $targetPath -Force -Recurse -ErrorAction "Continue"
+
+    #Remove HKLM registry entries
+    Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" -Recurse  -ErrorAction "SilentlyContinue" |  Where-Object {($_.ValueCount -gt 0)} | ForEach-Object {
+      
+      # Filter for osquery entries
+      $properties = Get-ItemProperty $_.PSPath  -ErrorAction "SilentlyContinue" |  Where-Object {($_.DisplayName -eq "Fleet osquery")}     
+      if ($properties) {
+      
+        #Remove Registry Entries
+        $regKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" + $_.PSChildName
+
+        Get-Item $regKey -ErrorAction "SilentlyContinue" | Remove-Item -Force -ErrorAction "SilentlyContinue"
+
+        return
+      }
+    }
+  }
+  catch { 
+    Write-Host "There was a problem running Force-Remove-Orbit"
+    Write-Host "$(Resolve-Error-Detailed)"
+    return $false
+  }
+  
+  return $true
+}
+
+function Main {
+
+  try {
+    # Is Administrator check
+    if (-not (Test-Administrator)) {
+      Write-Host "Please run this script with adming privileges."
+      Exit -1
+    }
+
+    Write-Host "About to uninstall fleetd..."
+
+    if (Force-Remove-Orbit) {
+        Write-Host "fleetd was uninstalled."
+        Exit 0
+    } else {
+        Write-Host "There was a problem uninstalling fleetd."
+        Exit -1
+    }
+
+  } catch {
+    Write-Host "Errorr: Entry point"  
+    Write-Host "$(Resolve-Error-Detailed)"
+    Exit -1
+  }
+}
+
+$null = Main

scripts/mdm/windows/windows-unenroll-mdm.ps1

@@ -0,0 +1,27 @@
+Add-Type -TypeDefinition @"
+using System;
+using System.Runtime.InteropServices;
+
+public class MdmRegistration
+{
+    [DllImport("mdmregistration.dll", SetLastError = true)]
+    public static extern int UnregisterDeviceWithManagement(IntPtr pDeviceID);
+
+    public static int UnregisterDevice()
+    {
+        return UnregisterDeviceWithManagement(IntPtr.Zero);
+    }
+}
+"@ -Language CSharp
+
+try {
+    $result = [MdmRegistration]::UnregisterDevice()
+
+    if ($result -ne 0) {
+        throw "UnregisterDeviceWithManagement failed with error code: $result"
+    }
+
+    Write-Host "Device unregistration called successfully."
+} catch {
+    Write-Error "Error calling UnregisterDeviceWithManagement: $_"
+}

tools/tuf/test/gen_pkgs.sh

@@ -50,7 +50,8 @@ if [ -n "$GENERATE_PKG" ]; then
         ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
         ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
         --update-url=$PKG_TUF_URL \
-        --disable-keystore
+        --disable-keystore \
+        --enable-scripts
 fi
 
 if [ -n "$GENERATE_DEB" ]; then
@@ -72,7 +73,8 @@ if [ -n "$GENERATE_DEB" ]; then
         ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
         ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
         ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
-        --update-url=$DEB_TUF_URL
+        --update-url=$DEB_TUF_URL \
+        --enable-scripts
 fi
 
 if [ -n "$GENERATE_RPM" ]; then
@@ -94,7 +96,8 @@ if [ -n "$GENERATE_RPM" ]; then
         ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
         ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
         ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
-        --update-url=$RPM_TUF_URL
+        --update-url=$RPM_TUF_URL \
+        --enable-scripts
 fi
 
 if [ -n "$GENERATE_MSI" ]; then
@@ -116,7 +119,8 @@ if [ -n "$GENERATE_MSI" ]; then
         ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \
         ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \
         ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \
-        --update-url=$MSI_TUF_URL
+        --update-url=$MSI_TUF_URL \
+        --enable-scripts
 fi
 
 echo "Packages generated."