<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
The Fleet UI now displays a policy's targeted platform, so repeating it
in the policy name is redundant. This strips the leading `macOS - ` /
`Windows - ` / `Linux - ` from all 84 prefixed policies in
`it-and-security`.
## Collisions
GitOps rejects duplicate policy names within a fleet
([`pkg/spec/gitops.go`](https://github.com/fleetdm/fleet/blob/main/pkg/spec/gitops.go#L2020)),
and the Workstations fleet includes macOS, Windows, and Linux policies
together. 14 stripped names would collide, so for those the platform
moves to a trailing suffix instead of being dropped:
| Before | After |
|---|---|
| `macOS - Gatekeeper enabled` | `Gatekeeper enabled` |
| `Windows - Secure Boot enabled` | `Secure Boot enabled` |
| `Linux - Removable storage is read-only` | `Removable storage is
read-only` |
| `macOS - Disk encryption enabled` | `Disk encryption enabled (macOS)`
|
| `Windows - Disk encryption enabled` | `Disk encryption enabled
(Windows)` |
| `Linux - Disk encryption enabled` | `Disk encryption enabled (Linux)`
|
49 policies lose the platform entirely; 35 keep it as a suffix. The 14
suffixed names are: Disk encryption enabled, Sufficient disk space
available, User .npmrc min-release-age at least 0.5 days, 1Password
installed, Battery healthy, and the 9 patch policies that exist for both
macOS and Windows (1Password, Google Chrome, Firefox, Slack, Zoom,
Visual Studio Code, Okta Verify, Claude, Adobe Acrobat Reader).
Also updates the descriptions of `macos-screen-lock-exclusions` and
`windows-screen-lock-exclusions`, which quote policy names.
## Notes for the reviewer
- **This is destructive on apply.** GitOps matches policies by name, so
applying this deletes the 84 existing policies and creates new ones.
Policy pass/fail history and host results reset. Automations defined in
the policy YAML (calendar events, install/script triggers) carry over,
but anything referencing these names outside the repo — saved filters,
dashboards, Slack workflows — needs updating separately.
- `tools/fleet-slackbot/system-prompt.js:338` still documents the
`<Platform> - <Description>` convention, and the `fleetctl new` macOS
template still ships a prefixed name. Both left alone intentionally —
out of scope for dogfood config.
- Four policy files appear unused by any fleet and were renamed only for
consistency: `lib/{macos,windows}/policies/update-claude.yml` and
`update-slack.yml`. Their names duplicate entries already in
`patch-fleet-maintained-apps.yml` for the same platform. Worth deleting
in a follow-up.
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
N/A — dogfood GitOps config only, no product code changes.
## Testing
- [x] QA'd all new/changed functionality manually
Verified locally:
- No `macOS - ` / `Windows - ` / `Linux - ` strings remain anywhere
under `it-and-security/`.
- Every fleet passes the same uniqueness rule GitOps enforces —
Workstations resolves to 78 policies with 0 duplicate names; all other
fleets unchanged.
- All 73 touched/related YAML files parse.
- The diff touches only `- name:` lines plus the two label descriptions.
- To verify best practice workflow for rollbacks:
https://fleetdm.com/guides/fleet-maintained-apps#rollback-to-a-previous-version
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Slack, Zoom, Google Chrome, and Claude to the macOS self-service
software catalog for the Testing & QA fleet.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA
Switches the dogfood "Collect Windows 11 hardware readiness" report from
`logging: differential` to `logging: snapshot`, so each run reports the
full current state of every host rather than only rows that changed
since the last run.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated Windows 11 hardware readiness reports to use snapshot logging,
ensuring each report captures a complete current-state view.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A
## Summary
Adds a new osquery report to Fleet's own dogfood GitOps config
(`it-and-security/`) that recreates the Microsoft Endpoint Analytics
Windows 11 hardware readiness check directly via osquery, instead of
relying on Intune's Graph summary.
- New file:
`it-and-security/lib/windows/reports/collect-windows-11-hardware-readiness.yml`
- Registered under the global `reports:` list in
`it-and-security/default.yml`, so it applies across all fleets (not
scoped to a single team)
- Scoped to `platform: windows` only, since `tpm_info`, `secureboot`,
and `logical_drives` are Windows-only osquery tables
The report evaluates per-host pass/fail against Microsoft's minimum
requirements: 64-bit CPU, 2+ cores, 1GHz+ clock speed, 4GB+ RAM, 64GB+
storage, TPM 2.0 enabled, and Secure Boot enabled, plus an overall
`win11_hardware_baseline` ready/not-ready column.
## Known gaps (carried over from the source query)
- No osquery equivalent for Microsoft's approved-CPU-family allowlist
check — `cpu_model` is surfaced for manual cross-reference instead.
- `secure_boot` / `tpm_enabled` reflect current firmware state, not
hardware capability — a host with TPM disabled in firmware or running
legacy BIOS will fail even though it may be fixable without new
hardware.
- If `boot_partition` doesn't populate reliably on some hosts, the disk
subquery may need a fallback to `WHERE device_id = 'C:'`.
# Checklist for submitter
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually (validated YAML parses
correctly and the query text round-trips unchanged; will be exercised
for real by the dogfood-gitops workflow on merge)
## New Fleet configuration settings
- [x] Setting(s) is/are explicitly excluded from GitOps (N/A — this is a
GitOps config change itself, not a new server setting)
systemd-run runs the detached child as a transient unit with
WorkingDirectory=/, so a relative $0 (e.g. ./uninstall-fleetd-linux.sh
per the uninstall guide) couldn't be found and the removal silently
never ran. Resolve $0 to an absolute path before re-exec.
Fixes#49411
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **Bug Fixes**
- Improved the Linux uninstall process so the detached cleanup task
always runs from the correct script location.
- Enhanced compatibility between systemd-based environments and
non-systemd systems.
- Better supports script paths that include spaces or special
characters.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
Sets the new `byod_fleet` option on both Apple Business Manager tokens
in the dogfood GitOps config, so BYOD hosts appearing in Apple Business
Manager are automatically added to the right fleet instead of
"Unassigned":
- **Fleet Device Management Inc.** → `📱🔐 Personal mobile devices`
- **Mactivate LLC** → `🧪 Testing & QA`
Fleet names match the definitions in
`it-and-security/fleets/personal-mobile-devices.yml` and
`it-and-security/fleets/testing-and-qa.yml` verbatim (including emoji
prefixes). The file keeps the existing `apple_business_manager` parent
key (deprecated alias for `apple_business`) to match the surrounding
config; the alias machinery renames the parent before resolving nested
keys, so `byod_fleet` resolves correctly under it.
Note for reviewers: this only affects where *newly appearing* BYOD hosts
are placed — existing BYOD hosts in "Unassigned" are not retroactively
moved.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] QA'd all new/changed functionality manually — verified the YAML
parses (yaml.v3) and both ABM entries resolve to the intended fleet
names; config-only change to the dogfood GitOps setup, no product code
touched.
I have external storage that I've been using for videos and VMs. My
current macOS storage is insufficient, so I need external storage for
dev work.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Configuration**
* Added Mac host `1310` to the list of devices excluded from external
storage restrictions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Update the x86 Windows Zoom Workplace label query to use a LIKE pattern
match instead of an exact match. This allows detection of different Zoom
Workplace versions and variants beyond just 'Zoom Workplace (X64)'.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Update `it-and-security/default.yml` to include
`windows_entra_client_ids` with `$DOGFOOD_ENTRA_CLIENT_ID` alongside the
existing Entra tenant ID setting. This ensures default Windows Entra
configuration includes both required identifiers for migration/auth
setup.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Configuration**
* Added support for supplying the Entra client ID in the Windows Entra
integration configuration.
* Updated the deployment workflow to pass the configured client ID
through automatically.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — dogfood GitOps configuration change
# What & why
Changes the 1Password patch automation on the **💻 Workstations** fleet
from calendar-event-driven remediation to **forced install**, on both
macOS and Windows.
For both `1password/darwin` and `1password/windows` patch policies in
`it-and-security/`:
- `install_software: false` → `install_software: true`
- Removed `calendar_events_enabled: true`
- Updated the `resolution` text to drop the "scheduled maintenance
window / check your calendar" language, matching the wording used by the
other IT-managed forced-install policies (Okta Verify, Adobe Acrobat,
etc.).
When a host now fails either 1Password patch policy, Fleet automatically
installs the latest Fleet-maintained 1Password with no end-user calendar
interaction. The fleet's `google_calendar` integration is left in place
since other policies (e.g. Firefox) still use calendar events.
# Checklist for submitter
- [x] QA'd all new/changed functionality manually (GitOps config only;
no code change)
Note: This is a dogfood GitOps config change only — no user-visible
product change, no code, no migrations, no new settings.
**Related issue:** N/A (dogfood GitOps change)
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually (YAML validated; will
verify install + patch policy on a Windows workstation after the GitOps
run applies)
## Details
Adds Okta Verify to Windows devices on the Workstations team following
the same pattern used for it on macOS, including the patch policy:
- Replaces the custom-package Okta Verify install
(`$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` + custom install/uninstall scripts)
with the `okta-verify/windows` Fleet-maintained app — `self_service:
true`, `setup_experience: true`, category Security, scoped to "x86-based
Windows hosts" (the FMA installer is x86-only).
- Adds a "Windows - Okta Verify up to date" patch policy with
`install_software: true` for automatic remediation, mirroring the macOS
policy.
- Adds the "x86 Windows hosts with Okta Verify installed" label that
scopes the patch policy to hosts that already have the app.
- Cleanup: deletes the now-orphaned custom package YAML and
`okta_verify_*.ps1` scripts. Follow-up (not in this PR — requires
`workflow` scope): remove the now-unused
`DOGFOOD_OKTA_VERIFY_WINDOWS_URL` env line from
`.github/workflows/dogfood-gitops.yml` and delete the GitHub secret.
Harmless in the meantime — the env var is exported but nothing consumes
it.
Hosts that installed Okta Verify from the old custom package are picked
up by the new label, and the patch policy will auto-update them to the
FMA version (currently 6.10.2.0) if they fall behind.
Related to: #39962
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added pre-install checks to prevent several fleet-managed app installs
from starting while the apps are already running (including Slack and
Zoom, plus others).
* Enabled automatic update installation with continuous automations for
a broad set of macOS and Windows apps, including Chrome, 1Password,
Slack, Zoom, and Visual Studio Code.
* **Bug Fixes**
* Updated update guidance to direct users to Self-service for the latest
versions, reducing conflicting “built-in update” instructions when apps
are already running.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added new workstation labels for **Team: g-apple-at-work** and **Team:
g-auto-patching**.
* **Changes**
* Updated team label coverage by removing the older **Team: g-mdm** and
**Team: g-software** labels.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- #g-mdm => #g-apple-at-work
- #g-software => #g-auto-patching
- Add #g-power-to-pc
- These teams now use ["continuous
flow"](https://fleetdm.com/handbook/company/product-groups#continuous-flow)
instead of scum so updated language from "Current sprint" to "Kanban
board"
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated Chrome managed bookmarks for the Engineering section with new
kanban board links.
* Added bookmarks for `#g-apple-at-work`, `#g-auto-patching`, and
`#g-power-to-pc`.
* **Bug Fixes**
* Removed outdated sprint bookmarks from the managed bookmarks list.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
I have a Fleet-provided external HDD that I use to permanently store VMs
and OS installers for testing.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Expanded the list of Mac hosts allowed for external storage access
under the relevant label, enabling read-write use on an additional
machine.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Permanent exclusion required to release fleetd (encrypted keys stored in
a USB stick)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Updated Mac exclusion coverage so an additional host is no longer
assigned the read-only external storage profile.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Replace explicit category lists with empty arrays for many software
entries in it-and-security/fleets/workstations.yml. This standardizes
the categories field (macOS, Linux, Windows entries across software,
app_store_apps, and fleet_maintained_apps) while keeping the key present
for tooling that expects it; no other metadata or behavior was changed.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Related to #47981
## What this does (dogfood GitOps unblock — step 1 of 2, workstations)
Follow-up to #47984. The mobile fleets are fixed (their stale rows were
purged and categories re-added), but GitOps still fails on the
**workstations** fleet with the same `software_categories` duplicate-key
error:
```
Error 1062 (23000): Duplicate entry '<team>-?️ Productivity' for key 'software_categories.idx_software_categories_team_id_name'
```
**Root cause (same as #47981):** the `software_categories.(team_id,
name)` unique index uses `utf8mb4_unicode_ci`, which treats the
variation selector `U+FE0F` as ignorable. A stale stored category row
(e.g. `🖥 Productivity` without the selector, from an earlier build) is
*equal* to today's canonical `🖥️ Productivity` per the index but
*distinct* to Go's `strings.EqualFold`, so the existence check misses it
and the insert collides.
**This PR (step 1):** removes the `categories:` blocks from
`workstations.yml`. With nothing to insert, the software batch applies
cleanly, and Fleet's `deleteUnusedSelfServiceCategories` cleanup then
purges the stale rows for that team. Software still installs; it's just
uncategorized until step 2.
**Step 2 (follow-up):** once this is applied, revert this PR to re-add
the categories. The team will have no stale rows by then, so canonical
categories get created fresh and software is categorized again.
This is the **last** fleet that needed it — `servers.yml`,
`testing-and-qa.yml`, and `unassigned.yml` define no categories. The
permanent fix (idempotent category insert) is tracked under #47981.
### Scope of the change
- Only `categories:` blocks removed: **109 lines deleted, 0 added.**
- All 109 package references and the 1 app store app are preserved; the
two commented-out `# categories:` examples are left untouched; file
remains valid YAML.
# Checklist for submitter
- [x] Changes file: N/A — dogfood GitOps config only, no product code or
user-visible product change.
## Testing
- [x] Verified `workstations.yml` remains valid YAML with all software
items intact (only `categories:` blocks removed).
- [ ] Confirm a GitOps dry run passes before merge.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Streamlined software package and application configurations by
removing unused metadata fields from multiple application entries across
packages and fleet-maintained apps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Related to #47981
## What this does (dogfood GitOps unblock — step 1 of 2)
The GitOps run for the mobile-device fleets fails while applying app
store apps:
```
applying app store apps for fleet: "📱🏢 Employee-issued mobile devices":
Validation Failed: Error 1062 (23000): Duplicate entry '303-?️ Productivity'
for key 'software_categories.idx_software_categories_team_id_name'
```
**Root cause:** the category names in the YAML are correct (plain
`"Productivity"`, etc., which translate server-side to the canonical
emoji names). The conflict is a **stale stored category row** for the
team. The `software_categories.(team_id, name)` unique index uses
`utf8mb4_unicode_ci`, which treats the Unicode variation selector
`U+FE0F` as ignorable. An earlier build stored Productivity as `🖥
Productivity` (no selector); today's code produces the canonical `🖥️
Productivity` (with selector). Those are *equal* to the index but
*distinct* to Go's `strings.EqualFold`, so the existence check misses
the stale row and the insert collides. This only affects the two
variation-selector categories — `🖥️ Productivity` and `🛠️ Utilities` —
which is why the failure is on Productivity.
**This PR (step 1):** temporarily removes the `categories:` blocks from
`company-owned-mobile-devices.yml` and `personal-mobile-devices.yml`.
With no categories to insert, the app store batch applies cleanly, and
Fleet's `deleteUnusedSelfServiceCategories` cleanup then purges the
stale rows for those teams. Apps still install; they're just
uncategorized until step 2.
**Step 2 (follow-up):** once this is applied, revert this PR to re-add
the categories. The teams will have no stale rows by then, so the
canonical categories get created fresh and the apps are categorized
correctly.
The permanent fix (makes the category insert idempotent so any stored
byte form is tolerated) is tracked separately under #47981.
> Note: `workstations.yml` uses the same categories and may need the
same treatment if that fleet also has a stale row — not included here
since only the mobile fleets are confirmed failing.
# Checklist for submitter
- [x] Changes file: N/A — dogfood GitOps config only, no product code or
user-visible product change.
- [x] Input data is properly validated: N/A — removing config, no new
inputs.
## Testing
- [x] Verified both files remain valid YAML and all 24 app store apps
per fleet are preserved (only `categories:` blocks removed;
comments/formatting intact).
- [ ] Confirm a GitOps dry run passes before merge.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Simplified app catalog entries for iOS and iPadOS devices by removing
category metadata while preserving all app functionality and settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Removed platform specification for Linux hosts in external storage
restrictions.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed platform-specific scoping from external storage restrictions
label configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add device IDs to manual labels to exempt specific machines from
read-only external/removable storage restrictions. The macs label now
includes host "1339" and the windows label includes host "1230",
allowing these devices to receive read-write external/removable storage
profiles.
Add a macOS Disk management declaration profile that sets
ExternalStorage to ReadOnly, and create a manual label "Macs excluded
from external storage restrictions" for opt-outs. Register the new label
in default.yml and reference the new Disk management settings.json in
the workstations fleet controls, excluding hosts in the manual label so
they retain read-write external storage.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
**New Features**
- Enforces external storage devices as read-only on macOS, Windows, and
Linux systems
- Introduces new host labels allowing administrators to selectively
exempt specific devices from external storage restrictions
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- @noahtalerman: For Windows, I think we want to squeeze turning off MDM
and uninstalling fleetd into one script.
- Why? Because Fleet automatically turns on Windows MDM, two scripts
means Fleet could beat the IT admin and turn MDM back on before they
uninstall fleetd.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Windows fleetd uninstall now proactively detects and disables MDM
enrollment before removal to help ensure a cleaner device unenrollment.
* **Bug Fixes**
* Improved uninstall error reporting by surfacing the underlying failure
message and exiting with a clear non-zero code.
* **Chores**
* Updated fleet testing and workstation configurations: removed the
Windows uninstall/MDM-related steps from QA and workstation controls,
and added new Windows security/setup scripts plus additional
cross-platform post-install and extension installation tasks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Steven Palmesano <3100993+spalmesano0@users.noreply.github.com>
Enable EndpointSecurity-based process and FIM events in fleet configs
and add the Full Disk Access profile for macOS. Adds
disable_endpointsecurity: false and disable_endpointsecurity_fim: false
to agent_options in testing-and-qa.yml and workstations.yml (enables
es_process_events and es_process_file_events). Adds an
apple_settings.configuration_profiles entry in testing-and-qa.yml
pointing to full-disk-access-for-fleetd.mobileconfig so osqueryd can
inherit Full Disk Access.
Uncomment the icon block for the Touch ID software entry in
it-and-security/fleets/workstations.yml so the icon path
(../lib/all/icons/touch-id.png) is active. This restores the UI icon for
the Security category entry without changing other fields.
Remove unnecessary surrounding double quotes from the `resolution` field
in
it-and-security/lib/all/policies/npm-supply-chain-compromised-packages.yml.
This cleans up the YAML and prevents literal quote characters from
appearing in rendered output; no functional change to the resolution
text.
Delete the explicit 'platform: darwin,linux,windows' line from the
hosts-with-npm-package-inventory label so the dynamic label applies
regardless of OS. The label still uses the same query (SELECT 1 FROM
npm_packages LIMIT 1) and remains dynamic; this change prevents
unintentionally excluding platforms.
## Summary
Adds a new policy `TanStack supply-chain attack - not affected` to the 💻
Workstations fleet that checks `npm_packages` on macOS, Windows, and
Linux hosts for any of the known-malicious `@tanstack/*` package
versions involved in the recent supply-chain compromise.
The policy returns **1 (passing)** when no compromised package/version
pair exists on the host, and **fails** when at least one match is found
— making it easy to triage affected workstations from the Fleet UI.
## Changes
- New file: `lib/all/policies/tanstack-supply-chain-attack.yml` — the
policy definition.
- Updated: `fleets/workstations.yml` — registers the new policy under
the `policies:` list.
## Notes
- `calendar_events_enabled` is left at the default (off).
- Platform is set to `darwin,windows,linux` because the `npm_packages`
osquery table is cross-platform and developer dependencies can land on
any workstation OS.
- Resolution guidance instructs users to remove/downgrade the affected
packages and rotate any developer credentials that may have been
exposed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Detect compromised npm packages on workstations (cross-platform) with
remediation guidance.
* Enforce per-user npm "min-release-age" on macOS, Linux, and Windows
with automated remediation.
* Add a host label for machines reporting an npm package inventory.
* **Chores**
* Add cross-platform scripts to automate updating per-user npm
configuration.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45264)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Clarify the user-facing resolution to instruct users to install Okta
Verify from Self-service, click Refetch, and contact #help-it if issues
persist. Also enable automatic installation by changing install_software
to true so Fleet can install the managed app when needed.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45160
Issue and fix: https://www.youtube.com/watch?v=Ow9GAFedEnQ
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Enhanced error handling in the admin user creation process to ensure
immediate failure on errors, preventing incomplete operations during
user account creation or group membership assignment.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45176)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Relocate the Safari extensions report to a macOS-specific directory and
update the fleet manifest to reference the new path. Also clean up
report descriptions by removing embedded compliance/mapping lines from
multiple reports (Chromium, Firefox, listening ports, local user
accounts, USB devices, and Safari) — queries and report logic unchanged.
Set macos_updates.update_new_hosts to false in the workstations fleet
config to prevent automatic updates from being applied to newly enrolled
macOS hosts. This change enables controlled rollout and testing of
updates before enabling automatic updates for new machines.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Modified macOS workstation update configuration to disable automatic
updates for newly provisioned hosts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Set apple_require_hardware_attestation: true in
it-and-security/fleets/workstations.yml under controls to require
hardware-backed attestation for Apple devices. This strengthens security
for managed macOS workstations by enforcing hardware attestation checks.
Remove the 1Password package entry from
it-and-security/fleets/workstations.yml (including its self_service,
setup_experience and categories fields) and delete the corresponding
descriptor file it-and-security/lib/macos/software/1password.yml which
contained the download URL.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Removed 1Password from macOS self-service software packages. The
application remains available through fleet-maintained apps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Replace the package_receipts-based query with a file table check for
/Library/LaunchAgents/com.fleetdm.fleet-desktop-hidden.plist. Update the
policy description and resolution to reference the plist presence and to
instruct confirming the installer drops that plist if the check fails.
Other policy fields (install_software, labels) remain unchanged.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automatic launch agent support for Fleet Desktop.app on macOS
devices, enabling the app to start automatically at system login without
user interaction
* Implemented MDM configuration profiles and policies for seamless
deployment and automatic management across macOS devices
* Added dynamic labeling capabilities to identify and track macOS hosts
with the Fleet Desktop launch agent profile installed
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Allen Houchins
