Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 38 Packages Projects Releases Wiki Activity

Fix the windows-remove-fleetd.ps1 script so that the agent can be reinstalled (#19643)

Browse Source
This commit is contained in:
Martin Angers
2024-06-12 09:34:57 -04:00
committed by GitHub
parent a154f4ca04
commit 943a4566f4
3 changed files with 71 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
changes/19197-fix-windows-remove-fleetd-script
+1
View File
@@ -0,0 +1 @@
* Fixed an issue with the Windows-specific `windows-remove-fleetd.ps1` script provided in the Fleet repository where running the script did remove `fleetd` but made it impossible to reinstall the agent.
it-and-security/lib/windows-remove-fleetd.ps1
+35 -13
View File
@@ -1,5 +1,5 @@
function Test-Administrator
{
function Test-Administrator
{
[OutputType([bool])]
param()
process {
@@ -58,11 +58,11 @@ function Force-Remove-Orbit {
#Remove HKLM registry entries
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" -Recurse -ErrorAction "SilentlyContinue" | Where-Object {($_.ValueCount -gt 0)} | ForEach-Object {
# Filter for osquery entries
$properties = Get-ItemProperty $_.PSPath -ErrorAction "SilentlyContinue" | Where-Object {($_.DisplayName -eq "Fleet osquery")}
$properties = Get-ItemProperty $_.PSPath -ErrorAction "SilentlyContinue" | Where-Object {($_.DisplayName -eq "Fleet osquery")}
if ($properties) {
#Remove Registry Entries
$regKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" + $_.PSChildName
@@ -72,12 +72,12 @@ function Force-Remove-Orbit {
}
}
}
catch {
catch {
Write-Host "There was a problem running Force-Remove-Orbit"
Write-Host "$(Resolve-Error-Detailed)"
return $false
}
return $true
}
@@ -92,19 +92,41 @@ function Main {
Write-Host "About to uninstall fleetd..."
if (Force-Remove-Orbit) {
Write-Host "fleetd was uninstalled."
Exit 0
if ($mode -eq "remove") {
# "remove" is received as argument to the script when called as the
# sub-process that will actually remove the fleet agent.
# sleep to give time to fleetd to send the script results to Fleet
Start-Sleep -Seconds 20
if (Force-Remove-Orbit) {
Write-Host "fleetd was uninstalled."
Exit 0
} else {
Write-Host "There was a problem uninstalling fleetd."
Exit -1
}
} else {
Write-Host "There was a problem uninstalling fleetd."
Exit -1
# when this script is executed from fleetd, it does not immediately
# remove the agent. Instead, it starts a new detached process that
# will do the actual removal. This is done to avoid the agent being
# killed by the removal process, which prevents it from sending the
# script execution results to Fleet, causing the script to remain
# "Pending" and being re-executed when/if the host reinstalls the
# agent.
#
# See https://github.com/fleetdm/fleet/issues/19197#issuecomment-2150020270
$execName = $MyInvocation.ScriptName
$proc = Start-Process -PassThru -FilePath "powershell" -WindowStyle Hidden -ArgumentList "-MTA", "-ExecutionPolicy", "Bypass", "-File", "$execName remove"
Start-Sleep -Seconds 5 # give time to process to start running
Write-Host "Removal process started: $($proc.Id)."
}
} catch {
Write-Host "Errorr: Entry point"
Write-Host "Errorr: Entry point"
Write-Host "$(Resolve-Error-Detailed)"
Exit -1
}
}
$mode = $args[0]
$null = Main
scripts/mdm/windows/windows-remove-fleetd.ps1
+35 -13
View File
@@ -1,5 +1,5 @@
function Test-Administrator
{
function Test-Administrator
{
[OutputType([bool])]
param()
process {
@@ -58,11 +58,11 @@ function Force-Remove-Orbit {
#Remove HKLM registry entries
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" -Recurse -ErrorAction "SilentlyContinue" | Where-Object {($_.ValueCount -gt 0)} | ForEach-Object {
# Filter for osquery entries
$properties = Get-ItemProperty $_.PSPath -ErrorAction "SilentlyContinue" | Where-Object {($_.DisplayName -eq "Fleet osquery")}
$properties = Get-ItemProperty $_.PSPath -ErrorAction "SilentlyContinue" | Where-Object {($_.DisplayName -eq "Fleet osquery")}
if ($properties) {
#Remove Registry Entries
$regKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" + $_.PSChildName
@@ -72,12 +72,12 @@ function Force-Remove-Orbit {
}
}
}
catch {
catch {
Write-Host "There was a problem running Force-Remove-Orbit"
Write-Host "$(Resolve-Error-Detailed)"
return $false
}
return $true
}
@@ -92,19 +92,41 @@ function Main {
Write-Host "About to uninstall fleetd..."
if (Force-Remove-Orbit) {
Write-Host "fleetd was uninstalled."
Exit 0
if ($mode -eq "remove") {
# "remove" is received as argument to the script when called as the
# sub-process that will actually remove the fleet agent.
# sleep to give time to fleetd to send the script results to Fleet
Start-Sleep -Seconds 20
if (Force-Remove-Orbit) {
Write-Host "fleetd was uninstalled."
Exit 0
} else {
Write-Host "There was a problem uninstalling fleetd."
Exit -1
}
} else {
Write-Host "There was a problem uninstalling fleetd."
Exit -1
# when this script is executed from fleetd, it does not immediately
# remove the agent. Instead, it starts a new detached process that
# will do the actual removal. This is done to avoid the agent being
# killed by the removal process, which prevents it from sending the
# script execution results to Fleet, causing the script to remain
# "Pending" and being re-executed when/if the host reinstalls the
# agent.
#
# See https://github.com/fleetdm/fleet/issues/19197#issuecomment-2150020270
$execName = $MyInvocation.ScriptName
$proc = Start-Process -PassThru -FilePath "powershell" -WindowStyle Hidden -ArgumentList "-MTA", "-ExecutionPolicy", "Bypass", "-File", "$execName remove"
Start-Sleep -Seconds 5 # give time to process to start running
Write-Host "Removal process started: $($proc.Id)."
}
} catch {
Write-Host "Errorr: Entry point"
Write-Host "Errorr: Entry point"
Write-Host "$(Resolve-Error-Detailed)"
Exit -1
}
}
$mode = $args[0]
$null = Main