**Related issue:** N/A (dogfood GitOps change)
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually (YAML validated; will
verify install + patch policy on a Windows workstation after the GitOps
run applies)
## Details
Adds Okta Verify to Windows devices on the Workstations team following
the same pattern used for it on macOS, including the patch policy:
- Replaces the custom-package Okta Verify install
(`$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` + custom install/uninstall scripts)
with the `okta-verify/windows` Fleet-maintained app — `self_service:
true`, `setup_experience: true`, category Security, scoped to "x86-based
Windows hosts" (the FMA installer is x86-only).
- Adds a "Windows - Okta Verify up to date" patch policy with
`install_software: true` for automatic remediation, mirroring the macOS
policy.
- Adds the "x86 Windows hosts with Okta Verify installed" label that
scopes the patch policy to hosts that already have the app.
- Cleanup: deletes the now-orphaned custom package YAML and
`okta_verify_*.ps1` scripts. Follow-up (not in this PR — requires
`workflow` scope): remove the now-unused
`DOGFOOD_OKTA_VERIFY_WINDOWS_URL` env line from
`.github/workflows/dogfood-gitops.yml` and delete the GitHub secret.
Harmless in the meantime — the env var is exported but nothing consumes
it.
Hosts that installed Okta Verify from the old custom package are picked
up by the new label, and the patch policy will auto-update them to the
FMA version (currently 6.10.2.0) if they fall behind.
- @noahtalerman: For Windows, I think we want to squeeze turning off MDM
and uninstalling fleetd into one script.
- Why? Because Fleet automatically turns on Windows MDM, two scripts
means Fleet could beat the IT admin and turn MDM back on before they
uninstall fleetd.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Windows fleetd uninstall now proactively detects and disables MDM
enrollment before removal to help ensure a cleaner device unenrollment.
* **Bug Fixes**
* Improved uninstall error reporting by surfacing the underlying failure
message and exiting with a clear non-zero code.
* **Chores**
* Updated fleet testing and workstation configurations: removed the
Windows uninstall/MDM-related steps from QA and workstation controls,
and added new Windows security/setup scripts plus additional
cross-platform post-install and extension installation tasks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Steven Palmesano <3100993+spalmesano0@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45160
Issue and fix: https://www.youtube.com/watch?v=Ow9GAFedEnQ
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
* **Bug Fixes**
* Enhanced error handling in the admin user creation process to ensure
immediate failure on errors, preventing incomplete operations during
user account creation or group membership assignment.
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45176)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
- Adds Okta Verify as a custom package for x86 Windows workstations in
the Fleet GitOps configuration
- Creates `it-and-security/lib/windows/software/okta-verify.yml` using
the `$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` secret for the download URL
- Configures the app in `workstations.yml` with `self_service: true`,
`setup_experience: true`, the "Security" category, and scoped to
`x86-based Windows hosts` label
## Changes
1. **New file**: `it-and-security/lib/windows/software/okta-verify.yml`
— Software definition with the secret-referenced URL
2. **Modified**: `it-and-security/teams/workstations.yml` — Added Okta
Verify package reference under `software.packages` in the Windows apps
section
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772924912095649)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38252
This pull request improves the Windows MDM unregistration PowerShell
script by adding extra checks and cleanup steps to ensure devices are
properly unenrolled and that the state is clearly reported. The script
now checks for relevant registry values before and after unregistration,
and explicitly clears any remaining values to guarantee correct
detection by Fleet.
Enhancements to device unregistration and registry cleanup:
* Added a pre-check for `DiscoveryServiceFullURL` registry values before
attempting to unregister the device, to provide clearer output about the
device's enrollment state.
* After calling the `UnregisterDeviceWithManagement` API, the script now
explicitly removes any remaining `DiscoveryServiceFullURL` values from
enrollment keys that have a `UPN`, ensuring Fleet properly detects the
device as unenrolled.
* Improved output messages to clearly indicate the actions taken and the
resulting device state, including whether registry values were found,
cleared, or already absent.
* Added error handling to exit with a non-zero code if an error occurs
during unregistration.
This fixes an issue where the background process invocation fails if the
script is located in a path containing white spaces, due to improper
path escaping, which can occur when the uninstall script is executed via
Microsoft Intune.
Changes:
- Windows MDM setup guide update: include instructions how to turn off
MDM
- Redirect: new link `learn-more-about/windows-mdm` that will be used in
the error message.
Allen Houchins
