From b9be12b604a66b1edd440adea30aa2cf6ea3a1eb Mon Sep 17 00:00:00 2001
From: Roberto Dip <me@roperzh.com>
Date: Thu, 25 Jan 2024 17:37:36 -0300
Subject: [PATCH] fix query to get windows MDM enrollment (#16348)

for #16332, this updates the windows mdm query to always return at least
one row, so we can detect windows unenrollments
---
 changes/16332-windows-mdm-unenroll      |  1 +
 server/service/osquery_utils/queries.go | 59 ++++++++++++-------------
 2 files changed, 29 insertions(+), 31 deletions(-)
 create mode 100644 changes/16332-windows-mdm-unenroll

diff --git a/changes/16332-windows-mdm-unenroll b/changes/16332-windows-mdm-unenroll
new file mode 100644
index 0000000000..6ffb4131d8
--- /dev/null
+++ b/changes/16332-windows-mdm-unenroll
@@ -0,0 +1 @@
+* Fix queries that report MDM enrollment status in Windows.
diff --git a/server/service/osquery_utils/queries.go b/server/service/osquery_utils/queries.go
index b17ecb78da..5cb32e4dbf 100644
--- a/server/service/osquery_utils/queries.go
+++ b/server/service/osquery_utils/queries.go
@@ -457,32 +457,34 @@ var extraDetailQueries = map[string]DetailQuery{
 		//
 		// For more information, refer to issue #15362
 		Query: `
-			WITH registry_keys AS (
-			    SELECT *
-			    FROM registry
-			    WHERE path LIKE 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\%%'
-			),
-			enrollment_info AS (
-			    SELECT
-			        MAX(CASE WHEN name = 'UPN' THEN data END) AS upn,
-			        MAX(CASE WHEN name = 'IsFederated' THEN data END) AS is_federated,
-			        MAX(CASE WHEN name = 'DiscoveryServiceFullURL' THEN data END) AS discovery_service_url,
-			        MAX(CASE WHEN name = 'ProviderID' THEN data END) AS provider_id
-			    FROM registry_keys
-			    GROUP BY key
-			)
-			SELECT
-			    e.is_federated,
-			    e.discovery_service_url,
-			    e.provider_id,
-			    (
-			        SELECT data
-			        FROM registry
-			        WHERE path = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallationType'
-			    ) AS installation_type
-			FROM enrollment_info e
-			WHERE e.upn IS NOT NULL
-			LIMIT 1;
+                    WITH registry_keys AS (
+                        SELECT *
+                        FROM registry
+                        WHERE path LIKE 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\%%'
+                    ),
+                    enrollment_info AS (
+                        SELECT
+                            MAX(CASE WHEN name = 'UPN' THEN data END) AS upn,
+                            MAX(CASE WHEN name = 'IsFederated' THEN data END) AS is_federated,
+                            MAX(CASE WHEN name = 'DiscoveryServiceFullURL' THEN data END) AS discovery_service_url,
+                            MAX(CASE WHEN name = 'ProviderID' THEN data END) AS provider_id
+                        FROM registry_keys
+                        GROUP BY key
+                    ),
+                    installation_info AS (
+                        SELECT data AS installation_type
+                        FROM registry
+                        WHERE path = 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\InstallationType'
+                        LIMIT 1
+                    )
+                    SELECT
+                        e.is_federated,
+                        e.discovery_service_url,
+                        e.provider_id,
+                        i.installation_type
+                    FROM installation_info i
+                    LEFT JOIN enrollment_info e ON e.upn IS NOT NULL
+                    LIMIT 1;
 		`,
 		DirectIngestFunc: directIngestMDMWindows,
 		Platforms:        []string{"windows"},
@@ -1527,11 +1529,6 @@ func directIngestMDMWindows(ctx context.Context, logger log.Logger, host *fleet.
 		return nil
 	}
 
-	if len(rows) > 1 {
-		logger.Log("component", "service", "method", "directIngestMDMWindows", "warn",
-			fmt.Sprintf("mdm expected single result got %d", len(rows)))
-	}
-
 	data := rows[0]
 	var enrolled bool
 	var automatic bool