diff --git a/changes/15689-remove-fleetd-script b/changes/15689-remove-fleetd-script new file mode 100644 index 0000000000..80c307d4ab --- /dev/null +++ b/changes/15689-remove-fleetd-script @@ -0,0 +1 @@ +* Added Windows scripts to unenroll MDM and remove fleetd. \ No newline at end of file diff --git a/orbit/pkg/scripts/exec_windows.go b/orbit/pkg/scripts/exec_windows.go index 7167827b61..08bcf358e5 100644 --- a/orbit/pkg/scripts/exec_windows.go +++ b/orbit/pkg/scripts/exec_windows.go @@ -13,7 +13,7 @@ func execCmd(ctx context.Context, scriptPath string) (output []byte, exitCode in exitCode = -1 // for Windows, we execute the file with powershell. - cmd := exec.CommandContext(ctx, "powershell", "-ExecutionPolicy", "Bypass", "-File", scriptPath) + cmd := exec.CommandContext(ctx, "powershell", "-MTA", "-ExecutionPolicy", "Bypass", "-File", scriptPath) cmd.Dir = filepath.Dir(scriptPath) output, err = cmd.CombinedOutput() if cmd.ProcessState != nil { diff --git a/scripts/mdm/windows/windows-remove-fleetd.ps1 b/scripts/mdm/windows/windows-remove-fleetd.ps1 new file mode 100644 index 0000000000..f532843c09 --- /dev/null +++ b/scripts/mdm/windows/windows-remove-fleetd.ps1 @@ -0,0 +1,110 @@ +function Test-Administrator +{ + [OutputType([bool])] + param() + process { + [Security.Principal.WindowsPrincipal]$user = [Security.Principal.WindowsIdentity]::GetCurrent(); + return $user.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator); + } +} + +# borrowed from Jeffrey Snover http://blogs.msdn.com/powershell/archive/2006/12/07/resolve-error.aspx +function Resolve-Error-Detailed($ErrorRecord = $Error[0]) { + $error_message = "========== ErrorRecord:{0}ErrorRecord.InvocationInfo:{1}Exception:{2}" + $formatted_errorRecord = $ErrorRecord | format-list * -force | out-string + $formatted_invocationInfo = $ErrorRecord.InvocationInfo | format-list * -force | out-string + $formatted_exception = "" + $Exception = $ErrorRecord.Exception + for ($i = 0; $Exception; $i++, ($Exception = $Exception.InnerException)) { + $formatted_exception += ("$i" * 70) + "-----" + $formatted_exception += $Exception | format-list * -force | out-string + $formatted_exception += "-----" + } + + return $error_message -f $formatted_errorRecord, $formatted_invocationInfo, $formatted_exception +} + +#Stops Orbit service and related processes +function Stop-Orbit { + + # Stop Service + Stop-Service -Name "Fleet osquery" -ErrorAction "Continue" + Start-Sleep -Milliseconds 1000 + + # Ensure that no process left running + Get-Process -Name "orbit" -ErrorAction "SilentlyContinue" | Stop-Process -Force + Get-Process -Name "osqueryd" -ErrorAction "SilentlyContinue" | Stop-Process -Force + Get-Process -Name "fleet-desktop" -ErrorAction "SilentlyContinue" | Stop-Process -Force + Start-Sleep -Milliseconds 1000 +} + +#Remove Orbit footprint from registry and disk +function Force-Remove-Orbit { + + try { + + #Stoping Orbit + Stop-Orbit + + #Remove Service + $service = Get-WmiObject -Class Win32_Service -Filter "Name='Fleet osquery'" + if ($service) { + $service.delete() | Out-Null + } + + #Removing Program files entries + $targetPath = $Env:Programfiles + "\\Orbit" + Remove-Item -LiteralPath $targetPath -Force -Recurse -ErrorAction "Continue" + + #Remove HKLM registry entries + Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" -Recurse -ErrorAction "SilentlyContinue" | Where-Object {($_.ValueCount -gt 0)} | ForEach-Object { + + # Filter for osquery entries + $properties = Get-ItemProperty $_.PSPath -ErrorAction "SilentlyContinue" | Where-Object {($_.DisplayName -eq "Fleet osquery")} + if ($properties) { + + #Remove Registry Entries + $regKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" + $_.PSChildName + + Get-Item $regKey -ErrorAction "SilentlyContinue" | Remove-Item -Force -ErrorAction "SilentlyContinue" + + return + } + } + } + catch { + Write-Host "There was a problem running Force-Remove-Orbit" + Write-Host "$(Resolve-Error-Detailed)" + return $false + } + + return $true +} + +function Main { + + try { + # Is Administrator check + if (-not (Test-Administrator)) { + Write-Host "Please run this script with adming privileges." + Exit -1 + } + + Write-Host "About to uninstall fleetd..." + + if (Force-Remove-Orbit) { + Write-Host "fleetd was uninstalled." + Exit 0 + } else { + Write-Host "There was a problem uninstalling fleetd." + Exit -1 + } + + } catch { + Write-Host "Errorr: Entry point" + Write-Host "$(Resolve-Error-Detailed)" + Exit -1 + } +} + +$null = Main diff --git a/scripts/mdm/windows/windows-unenroll-mdm.ps1 b/scripts/mdm/windows/windows-unenroll-mdm.ps1 new file mode 100644 index 0000000000..2ffc3be05d --- /dev/null +++ b/scripts/mdm/windows/windows-unenroll-mdm.ps1 @@ -0,0 +1,27 @@ +Add-Type -TypeDefinition @" +using System; +using System.Runtime.InteropServices; + +public class MdmRegistration +{ + [DllImport("mdmregistration.dll", SetLastError = true)] + public static extern int UnregisterDeviceWithManagement(IntPtr pDeviceID); + + public static int UnregisterDevice() + { + return UnregisterDeviceWithManagement(IntPtr.Zero); + } +} +"@ -Language CSharp + +try { + $result = [MdmRegistration]::UnregisterDevice() + + if ($result -ne 0) { + throw "UnregisterDeviceWithManagement failed with error code: $result" + } + + Write-Host "Device unregistration called successfully." +} catch { + Write-Error "Error calling UnregisterDeviceWithManagement: $_" +} diff --git a/tools/tuf/test/gen_pkgs.sh b/tools/tuf/test/gen_pkgs.sh index 0feba9979e..85dc91e1cd 100755 --- a/tools/tuf/test/gen_pkgs.sh +++ b/tools/tuf/test/gen_pkgs.sh @@ -50,7 +50,8 @@ if [ -n "$GENERATE_PKG" ]; then ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \ ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \ --update-url=$PKG_TUF_URL \ - --disable-keystore + --disable-keystore \ + --enable-scripts fi if [ -n "$GENERATE_DEB" ]; then @@ -72,7 +73,8 @@ if [ -n "$GENERATE_DEB" ]; then ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \ ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \ ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \ - --update-url=$DEB_TUF_URL + --update-url=$DEB_TUF_URL \ + --enable-scripts fi if [ -n "$GENERATE_RPM" ]; then @@ -94,7 +96,8 @@ if [ -n "$GENERATE_RPM" ]; then ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \ ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \ ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \ - --update-url=$RPM_TUF_URL + --update-url=$RPM_TUF_URL \ + --enable-scripts fi if [ -n "$GENERATE_MSI" ]; then @@ -116,7 +119,8 @@ if [ -n "$GENERATE_MSI" ]; then ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-certificate=./tools/test-orbit-mtls/client.crt} \ ${USE_UPDATE_CLIENT_CERTIFICATE:+--update-tls-client-key=./tools/test-orbit-mtls/client.key} \ ${FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST:+--fleet-desktop-alternative-browser-host=$FLEET_DESKTOP_ALTERNATIVE_BROWSER_HOST} \ - --update-url=$MSI_TUF_URL + --update-url=$MSI_TUF_URL \ + --enable-scripts fi echo "Packages generated."