From 943a4566f4cf2f0e82e466eec657aeade4cf18e2 Mon Sep 17 00:00:00 2001 From: Martin Angers Date: Wed, 12 Jun 2024 09:34:57 -0400 Subject: [PATCH] Fix the `windows-remove-fleetd.ps1` script so that the agent can be reinstalled (#19643) --- .../19197-fix-windows-remove-fleetd-script | 1 + it-and-security/lib/windows-remove-fleetd.ps1 | 48 ++++++++++++++----- scripts/mdm/windows/windows-remove-fleetd.ps1 | 48 ++++++++++++++----- 3 files changed, 71 insertions(+), 26 deletions(-) create mode 100644 changes/19197-fix-windows-remove-fleetd-script diff --git a/changes/19197-fix-windows-remove-fleetd-script b/changes/19197-fix-windows-remove-fleetd-script new file mode 100644 index 0000000000..b1af6701c3 --- /dev/null +++ b/changes/19197-fix-windows-remove-fleetd-script @@ -0,0 +1 @@ +* Fixed an issue with the Windows-specific `windows-remove-fleetd.ps1` script provided in the Fleet repository where running the script did remove `fleetd` but made it impossible to reinstall the agent. diff --git a/it-and-security/lib/windows-remove-fleetd.ps1 b/it-and-security/lib/windows-remove-fleetd.ps1 index f532843c09..77a420781d 100644 --- a/it-and-security/lib/windows-remove-fleetd.ps1 +++ b/it-and-security/lib/windows-remove-fleetd.ps1 @@ -1,5 +1,5 @@ -function Test-Administrator -{ +function Test-Administrator +{ [OutputType([bool])] param() process { @@ -58,11 +58,11 @@ function Force-Remove-Orbit { #Remove HKLM registry entries Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" -Recurse -ErrorAction "SilentlyContinue" | Where-Object {($_.ValueCount -gt 0)} | ForEach-Object { - + # Filter for osquery entries - $properties = Get-ItemProperty $_.PSPath -ErrorAction "SilentlyContinue" | Where-Object {($_.DisplayName -eq "Fleet osquery")} + $properties = Get-ItemProperty $_.PSPath -ErrorAction "SilentlyContinue" | Where-Object {($_.DisplayName -eq "Fleet osquery")} if ($properties) { - + #Remove Registry Entries $regKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" + $_.PSChildName @@ -72,12 +72,12 @@ function Force-Remove-Orbit { } } } - catch { + catch { Write-Host "There was a problem running Force-Remove-Orbit" Write-Host "$(Resolve-Error-Detailed)" return $false } - + return $true } @@ -92,19 +92,41 @@ function Main { Write-Host "About to uninstall fleetd..." - if (Force-Remove-Orbit) { - Write-Host "fleetd was uninstalled." - Exit 0 + if ($mode -eq "remove") { + # "remove" is received as argument to the script when called as the + # sub-process that will actually remove the fleet agent. + + # sleep to give time to fleetd to send the script results to Fleet + Start-Sleep -Seconds 20 + if (Force-Remove-Orbit) { + Write-Host "fleetd was uninstalled." + Exit 0 + } else { + Write-Host "There was a problem uninstalling fleetd." + Exit -1 + } } else { - Write-Host "There was a problem uninstalling fleetd." - Exit -1 + # when this script is executed from fleetd, it does not immediately + # remove the agent. Instead, it starts a new detached process that + # will do the actual removal. This is done to avoid the agent being + # killed by the removal process, which prevents it from sending the + # script execution results to Fleet, causing the script to remain + # "Pending" and being re-executed when/if the host reinstalls the + # agent. + # + # See https://github.com/fleetdm/fleet/issues/19197#issuecomment-2150020270 + $execName = $MyInvocation.ScriptName + $proc = Start-Process -PassThru -FilePath "powershell" -WindowStyle Hidden -ArgumentList "-MTA", "-ExecutionPolicy", "Bypass", "-File", "$execName remove" + Start-Sleep -Seconds 5 # give time to process to start running + Write-Host "Removal process started: $($proc.Id)." } } catch { - Write-Host "Errorr: Entry point" + Write-Host "Errorr: Entry point" Write-Host "$(Resolve-Error-Detailed)" Exit -1 } } +$mode = $args[0] $null = Main diff --git a/scripts/mdm/windows/windows-remove-fleetd.ps1 b/scripts/mdm/windows/windows-remove-fleetd.ps1 index f532843c09..77a420781d 100644 --- a/scripts/mdm/windows/windows-remove-fleetd.ps1 +++ b/scripts/mdm/windows/windows-remove-fleetd.ps1 @@ -1,5 +1,5 @@ -function Test-Administrator -{ +function Test-Administrator +{ [OutputType([bool])] param() process { @@ -58,11 +58,11 @@ function Force-Remove-Orbit { #Remove HKLM registry entries Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" -Recurse -ErrorAction "SilentlyContinue" | Where-Object {($_.ValueCount -gt 0)} | ForEach-Object { - + # Filter for osquery entries - $properties = Get-ItemProperty $_.PSPath -ErrorAction "SilentlyContinue" | Where-Object {($_.DisplayName -eq "Fleet osquery")} + $properties = Get-ItemProperty $_.PSPath -ErrorAction "SilentlyContinue" | Where-Object {($_.DisplayName -eq "Fleet osquery")} if ($properties) { - + #Remove Registry Entries $regKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" + $_.PSChildName @@ -72,12 +72,12 @@ function Force-Remove-Orbit { } } } - catch { + catch { Write-Host "There was a problem running Force-Remove-Orbit" Write-Host "$(Resolve-Error-Detailed)" return $false } - + return $true } @@ -92,19 +92,41 @@ function Main { Write-Host "About to uninstall fleetd..." - if (Force-Remove-Orbit) { - Write-Host "fleetd was uninstalled." - Exit 0 + if ($mode -eq "remove") { + # "remove" is received as argument to the script when called as the + # sub-process that will actually remove the fleet agent. + + # sleep to give time to fleetd to send the script results to Fleet + Start-Sleep -Seconds 20 + if (Force-Remove-Orbit) { + Write-Host "fleetd was uninstalled." + Exit 0 + } else { + Write-Host "There was a problem uninstalling fleetd." + Exit -1 + } } else { - Write-Host "There was a problem uninstalling fleetd." - Exit -1 + # when this script is executed from fleetd, it does not immediately + # remove the agent. Instead, it starts a new detached process that + # will do the actual removal. This is done to avoid the agent being + # killed by the removal process, which prevents it from sending the + # script execution results to Fleet, causing the script to remain + # "Pending" and being re-executed when/if the host reinstalls the + # agent. + # + # See https://github.com/fleetdm/fleet/issues/19197#issuecomment-2150020270 + $execName = $MyInvocation.ScriptName + $proc = Start-Process -PassThru -FilePath "powershell" -WindowStyle Hidden -ArgumentList "-MTA", "-ExecutionPolicy", "Bypass", "-File", "$execName remove" + Start-Sleep -Seconds 5 # give time to process to start running + Write-Host "Removal process started: $($proc.Id)." } } catch { - Write-Host "Errorr: Entry point" + Write-Host "Errorr: Entry point" Write-Host "$(Resolve-Error-Detailed)" Exit -1 } } +$mode = $args[0] $null = Main