Add macOS and Windows screen-lock configuration profiles and manual
exclusion labels, and wire them into fleet manifests and policies.
- Add macOS mobileconfig (screen-lock-inactivity) to start screensaver
after 900s and require a password with a 60s delay.
- Add Windows configuration (Screen lock timeout.xml) to set
InteractiveLogon_MachineInactivityLimit to 900s (15 minutes).
- Create manual labels: "macOS screen lock exclusions" and "Windows
screen lock exclusions" (empty host lists).
- Register the new labels in it-and-security/default.yml and include the
new profiles in workstations.yml with labels_exclude_any pointing to the
appropriate exclusion label.
- Update macOS and Windows policy YAMLs to exclude hosts in the
corresponding exclusion labels.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added macOS and Windows "screen lock exclusions" labels to allow
manual exemption of devices.
* Introduced a macOS configuration profile that enforces a 15-minute
inactivity screen lock and requires a password on resume.
* Introduced a Windows configuration profile setting an equivalent
15-minute inactivity timeout.
* Screen-lock policies now support label-based exclusions so exempted
devices are not affected.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add forceful Adobe Acrobat Reader patch policy for all devices
Add critical patch policies for Adobe Acrobat Reader on macOS and
Windows that enforce immediate automatic updates via install_software:
true. This ensures all devices running Adobe Reader are patched without
user intervention, addressing the high-risk security profile of PDF
readers.
Changes:
- Add macOS patch policy (adobe-acrobat-reader/darwin) with critical
flag
- Add Windows patch policy (adobe-acrobat-reader/windows) with critical
flag
- Register Adobe Acrobat Reader as a fleet_maintained_app for both
platforms
in workstations.yml
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Adobe Acrobat Reader added as self-service software for macOS and x86
Windows; categorized under Productivity.
* Adobe Acrobat Pro added as self-service software for macOS;
categorized under Productivity.
* Automatic device targeting now surfaces these apps only to hosts that
already have them installed.
* New critical patch policies for macOS and Windows enable automatic
updates with self-service fallback on install failures.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Add multiple endpoint security policies and telemetry reports and wire
them into the workstations fleet manifest. New macOS policies: firewall,
Gatekeeper, SIP (critical), Remote Login disabled, screen-lock
inactivity, and local-admin count; new Windows policies: Secure Boot,
Remote Desktop disabled, interactive screen-lock timeout; new Linux
policy: sshd PermitRootLogin restriction. Added cross-platform reports
for disk encryption (includes BitLocker), local user/admin inventory,
USB devices, listening ports, and Chromium-family browser extensions.
These changes improve compliance and detection coverage (SOC2/ISO
mappings included) and enable more comprehensive fleet monitoring.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added device compliance checks: macOS firewall, Gatekeeper, SIP, local
admin count, Windows Secure Boot, and Linux SSH root-login restriction
* Disabled high-risk remote access: macOS Remote Login and Windows
Remote Desktop checks
* Added screen-lock inactivity checks for macOS and Windows
* New inventory reports: local user accounts, connected USB devices,
open listening ports, and browser extensions (Safari, Firefox,
Chromium-family)
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Uncomment 1Password entries in workstations.yml so 1Password is managed
as a fleet_maintained_app for both macOS and Windows. Commented out the
separate Windows 1Password installed policy path and enabled the
corresponding patch checks in
macos/windows/patch-fleet-maintained-apps.yml to surface/update
out-of-date 1Password installations.
Comment out 1Password fleet-maintained app entries and related
install/patch policies for macOS and Windows. Updates remove/disable the
fleet_maintained_app references in
it-and-security/fleets/workstations.yml and comment out install_software
and patch entries in the macOS and Windows policy files to temporarily
stop automatic installation and patch enforcement for 1Password.
Replace ad-hoc 1Password update flow with fleet_maintained app handling:
remove the macOS updater script and platform-specific update policy
files; switch install_software refs in macOS/Windows 1Password policies
to fleet_maintained_app_slug; add fleet_maintained_apps entries for
1Password in the workstation fleet manifest; add dynamic labels and
patch policies to track/upkeep 1Password on macOS and Windows. Also
remove references to the removed update step from the dogfood CI
workflow and simplify PR title/branch generation logic accordingly.
Remove several x86-only Fleet-maintained Windows applications and their
associated dynamic labels and patch policies. Changes touch:
- it-and-security/fleets/workstations.yml: removed fleet app entries for
Brave, Docker Desktop, GitHub Desktop, Postman, Sublime Text, Spotify,
Figma, Google Drive, and Cursor.
-
it-and-security/lib/all/labels/windows-with-fleet-maintained-apps-installed.yml:
removed the matching x86 dynamic labels.
- it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml:
removed the corresponding patch policies for those apps.
This cleans up configuration related to x86-only Windows apps (labels
previously filtered on arch NOT LIKE 'ARM%').
Add multiple Fleet-maintained apps to workstations (macOS and x86
Windows), create dynamic labels to detect installed apps, and add patch
policies to flag out-of-date installs. workstations.yml: add numerous
macOS self-service entries (e.g. GitHub Desktop, Postman, iTerm2,
Sublime Text, Figma, Spotify, Google Drive, Cursor, etc.) and x86
Windows entries with labels_include_any for x86 hosts.
lib/all/labels/...: add dynamic macOS labels using bundle identifiers
and x86 Windows labels using program name plus arch checks.
lib/macos/policies/... and lib/windows/policies/...: add patch policies
for each new app to notify about outdated versions and provide
remediation guidance (Self-service or app update/uninstall). These
changes enable inventory, self-service deployment, and patch management
for additional developer and productivity applications.
Remove wording that suggested deleting/uninstalling apps from resolution
text in fleet-maintained app patch policies. Updated macOS and Windows
policy files to only advise updating via Self-service or each app's
built-in update functionality (no mention of deleting/uninstalling).
Affected files:
it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml and
it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml.
Comment out Zoom Fleet Maintained App entries and associated labels and
patch policies until Zoom FMA is present in Fleet. Files updated:
workstations.yml (zoom/darwin and zoom/windows software entries
commented), labels/* (macOS and x86 Windows Zoom labels commented), and
macOS/Windows patch policy files (Zoom patch policies disabled via
comments). This prevents Fleet from referencing or enforcing Zoom
policies while the FMA is not available.
Temporarily disable Zoom-related Fleet Maintained App (FMA) labels and
patch policies across macOS and Windows while the FMA installer issue is
resolved in gitops (SQL returned no rows). Commented out the Zoom label
entries in lib/all/labels/*-with-fleet-maintained-apps-installed.yml and
the corresponding Zoom patch policies in
it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml and
it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml,
with comments noting to uncomment them together when re-enabling.
Remove local Zoom software manifests and icon and replace them with
fleet-maintained app slugs. Workstations fleet now references
zoom/darwin and zoom/windows slugs; added dynamic labels for Macs and
x86 Windows hosts with Zoom installed. Patch policies for macOS and
Windows updated to include Zoom using the new slugs so patch
checks/notifications are centralized. Deleted legacy
it-and-security/lib/*/software/zoom.yml and the Zoom icon to avoid
duplicate/local package definitions.
Migrate Firefox management to the fleet-maintained app slug
(firefox/darwin): update workstations.yml to remove the old update
policy and replace the macOS software entry with the firefox/darwin
slug; add a dynamic label for Macs with Firefox installed; add a patch
policy that targets the fleet_maintained_app_slug and uses the new
label. Also remove legacy update policy and package files for Firefox
(macOS and Windows) and the hardcoded Firefox pkg URL. This consolidates
Firefox management under Fleet-maintained apps and removes
duplicated/obsolete artifacts.
Introduce dynamic labels for common Fleet-maintained apps on macOS and
Windows, and add corresponding patch policies for macOS and Windows.
Update it-and-security/default.yml to include the new labels and
it-and-security/fleets/workstations.yml to use the consolidated patch
policies (replacing individual update policies). macOS policies use
labels_include_any and reference fleet_maintained_app_slug entries;
Windows policies include platform and architecture filters where
applicable. This centralizes patch checks for Fleet-maintained apps and
simplifies fleet policy management.
## Summary
- Update the macOS "Claude up to date" policy minimum version from
`1.1.5749` to `1.1.9493` (latest Homebrew cask version)
- Update the Windows "Claude up to date" policy minimum version from
`1.1.5368` to `1.1.9310` (latest winget version)
These policies ensure all Workstations team hosts are running the latest
version of the Claude desktop app (Anthropic). The policies,
Fleet-maintained app entries (`claude/darwin`, `claude/windows`), and
workstations team references were already in place — this PR only bumps
the version numbers checked by the osquery queries.
## Changes
| File | Change |
|------|--------|
| `it-and-security/lib/macos/policies/update-claude.yml` |
`version_compare` threshold `1.1.5749` → `1.1.9493` |
| `it-and-security/lib/windows/policies/update-claude.yml` |
`version_compare` threshold `1.1.5368` → `1.1.9310` |
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1774884397872049)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds a **macOS battery health check** policy that verifies the battery
health is "Good" and condition is "Normal" using the osquery `battery`
table's macOS-specific `health` and `condition` columns.
- Adds a **Windows battery health check** policy that verifies the
battery's full charge capacity remains above 80% of its designed
capacity using the osquery `battery` table's `max_capacity` and
`designed_capacity` columns.
- References both new policies in the **Workstations** team config
(`it-and-security/fleets/workstations.yml`).
- **Desktop computers (no battery) automatically pass** both policies.
The queries use a `NOT EXISTS` pattern so that devices returning zero
rows from the `battery` table are not treated as failures.
## Changes
| File | Description |
|------|-------------|
| `it-and-security/lib/macos/policies/battery-health-check.yml` | New
macOS battery health policy |
| `it-and-security/lib/windows/policies/battery-health-check.yml` | New
Windows battery health policy |
| `it-and-security/fleets/workstations.yml` | Added policy references
for both platforms |
## Testing
- Policy queries validated against the [osquery `battery` table
schema](https://github.com/fleetdm/fleet/blob/main/schema/tables/battery.yml).
- macOS query: `SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM battery WHERE
health != 'Good' OR condition != 'Normal');`
- Windows query: `SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM battery WHERE
designed_capacity > 0 AND CAST(max_capacity AS REAL) / designed_capacity
<= 0.80);`
### Expected behavior
| Scenario | Result |
|----------|--------|
| Laptop with healthy battery | PASS |
| Laptop with unhealthy battery | FAIL |
| Desktop (no battery / zero rows) | PASS |
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1774454193574469?thread_ts=1774453340.076579&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Enables `calendar_events_enabled: true` for the **Windows - 1Password
up to date** and **Windows - Firefox up to date** policies on the
Workstations team.
- Updates the `description` and `resolution` text to match the pattern
already used by the macOS counterparts, referencing the scheduled
maintenance window and calendar.
This mirrors the calendar integration that was previously enabled for
the macOS 1Password and Firefox update policies.
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1774451322610839)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds a new **macOS - FileVault enabled** policy that checks whether
FileVault disk encryption is enabled on macOS devices by querying
`filevault_status` for an active status.
- Adds a new **Windows - BitLocker enabled** policy that checks whether
BitLocker disk encryption is enabled on the C: drive of Windows devices
by querying `bitlocker_info` for protection status.
- Both policies are added to the Workstations team configuration in
`workstations.yml`, placed alongside the existing disk encryption check
policies.
- Updated the resolution text for both policies to indicate that
settings should be automatically applied via MDM and to direct users to
#help-it for assistance.
- Changed resolution phrasing from "If you're still seeing this issue"
to "If you're still failing this policy" for both policies.
## Changes
| File | Change |
|------|--------|
| `it-and-security/lib/macos/policies/filevault-enabled.yml` | New
policy file for macOS FileVault check |
| `it-and-security/lib/windows/policies/bitlocker-enabled.yml` | New
policy file for Windows BitLocker check |
| `it-and-security/fleets/workstations.yml` | Added references to both
new policy files |
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1774388430297229?thread_ts=1774386241.477189&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Updates Firefox from 148.0.2 to 149.0 (released March 23, 2026) across
the Workstations team configuration
- Updates macOS custom package download URL to Firefox 149.0
- Updates macOS and Windows version-check policies to enforce version >=
149.0
## Changes
| File | Change |
|---|---|
| `it-and-security/lib/macos/software/mozilla-firefox.yml` | Updated
package URL from 148.0.2 to 149.0 |
| `it-and-security/lib/macos/policies/update-firefox.yml` | Updated
version check from 148.0.2 to 149.0 |
| `it-and-security/lib/windows/policies/update-firefox.yml` | Updated
version check from 148.0.2 to 149.0 |
## Notes
- Firefox on Windows uses the Fleet-maintained app (`slug:
firefox/windows`), which is managed by the Fleet catalog and will
auto-update when the catalog is refreshed
- Firefox on macOS uses a custom package URL since the existing pattern
uses a `.pkg` installer
- Both macOS and Windows already have self-service enabled and
corresponding update policies with calendar event enforcement (macOS)
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1774366778146629)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
## Summary
- Adds a Windows Firefox update policy (`update-firefox.yml`) to detect
outdated Firefox installations vulnerable to CVE-2025-2857
- Adds Firefox as a Fleet-maintained app for Windows workstations
(`firefox/windows`) for self-service installation/update
- Registers both the policy and maintained app in `workstations.yml`
## CVE-2025-2857: Firefox Sandbox Escape on Windows
[CVE-2025-2857](https://nvd.nist.gov/vuln/detail/CVE-2025-2857) is a
**critical** sandbox escape vulnerability in Mozilla Firefox on Windows.
Following the Chrome sandbox escape (CVE-2025-2783), Firefox developers
identified a similar pattern in Firefox's IPC code where a compromised
child process could cause the parent process to return an
unintentionally powerful handle, leading to a sandbox escape.
**Affected versions:**
- Firefox < 136.0.4
- Firefox ESR < 128.8.1
- Firefox ESR < 115.21.1
**Only affects Firefox on Windows.** Other operating systems are
unaffected.
## What was changed and why
The Fleet-maintained Firefox app is already at version 148.0.2 (well
beyond the fix), and macOS workstations already had both an update
policy and software package configured. However, **Windows workstations
had no Firefox update policy or maintained app** — meaning there was no
mechanism to:
1. **Detect** Windows hosts running vulnerable Firefox versions
2. **Remediate** by offering an updated Firefox via self-service
This PR closes that gap by:
1. **`it-and-security/lib/windows/policies/update-firefox.yml`** — New
policy that queries the Windows `programs` table to flag any host with
Firefox < 148.0.2 (uses `LIKE 'Mozilla Firefox%'` and `NOT LIKE '%ESR%'`
to match standard Firefox installations, matching the pattern used in
other Windows update policies)
2. **`it-and-security/fleets/workstations.yml`** — Adds the policy
reference under Windows policies, and adds `firefox/windows` to
`fleet_maintained_apps` for self-service browser installation on x86
Windows hosts
---
Built for
[mikermcneil](https://fleetdm.slack.com/archives/D0AFASLRHNU/p1773774729891479)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: Kilo Code <kilo-bot@kilo.ai>
## Summary
- Adds new Fleet policies (`update-slack.yml`) for macOS and Windows
that **fail** if a device has an outdated version of Slack installed
(below `4.48.100`).
- Follows the existing `update-*` policy pattern used by 1Password,
Claude, and Firefox.
- Registers both policies in `workstations.yml` under the appropriate OS
sections.
## Changes
| File | Description |
|---|---|
| `it-and-security/lib/macos/policies/update-slack.yml` | New macOS
policy: checks `apps` table for `Slack.app` version via
`version_compare` |
| `it-and-security/lib/windows/policies/update-slack.yml` | New Windows
policy: checks `programs` table for `Slack` version via
`version_compare` |
| `it-and-security/fleets/workstations.yml` | Adds both policy paths to
the workstations fleet |
## Policy behavior
The policy **passes** if Slack is not installed OR if the installed
version is >= `4.48.100`. The policy **fails** if Slack is installed but
at a version older than `4.48.100`.
---
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1773436302175049)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- **Reverts PR #41257**: Claude Desktop should NOT have
`setup_experience: true` — it should not be automatically installed
during device setup. PR #41257 (which added `setup_experience: true` to
both macOS and Windows Claude Desktop entries) has been closed.
- **Updates Claude Desktop "up to date" policy version strings** to
match the latest fleet-maintained app catalog versions:
- macOS: `1.1.4328` → `1.1.5749` (from
`ee/maintained-apps/outputs/claude/darwin.json`)
- Windows: `1.1.4088` → `1.1.5368` (from
`ee/maintained-apps/outputs/claude/windows.json`)
## Changes
| File | Change |
|------|--------|
| `it-and-security/lib/macos/policies/update-claude.yml` | Version
`1.1.4328` → `1.1.5749` |
| `it-and-security/lib/windows/policies/update-claude.yml` | Version
`1.1.4088` → `1.1.5368` |
Closes#41257
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1773070240095919?thread_ts=1773069775.458399&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
## Summary
- Adds Okta Verify as a custom package for x86 Windows workstations in
the Fleet GitOps configuration
- Creates `it-and-security/lib/windows/software/okta-verify.yml` using
the `$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` secret for the download URL
- Configures the app in `workstations.yml` with `self_service: true`,
`setup_experience: true`, the "Security" category, and scoped to
`x86-based Windows hosts` label
## Changes
1. **New file**: `it-and-security/lib/windows/software/okta-verify.yml`
— Software definition with the secret-referenced URL
2. **Modified**: `it-and-security/teams/workstations.yml` — Added Okta
Verify package reference under `software.packages` in the Windows apps
section
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772924912095649)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
## Summary
- Add Claude Desktop as a Fleet-maintained app for macOS and Windows on
the Workstations team
- Both platforms have self-service and setup experience enabled
- Windows app scoped to x86 hosts via `x86-based Windows hosts` label
- Add version update policies for both platforms (macOS v1.1.4328,
Windows v1.1.4088)
## Test plan
- [ ] Verify `fleetctl gitops --dry-run` passes with workstations.yml
- [ ] Confirm Claude Desktop appears in self-service for macOS and
Windows hosts
- [ ] Confirm Claude Desktop is part of the macOS and Windows setup
experience
- [ ] Verify update policies flag hosts running older versions
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
## Summary
- Adds cross-platform disk space check policies (macOS, Windows, Linux)
scoped to the workstations team
- Each policy calculates the percentage of available disk space relative
to total disk space and **fails when available disk space is 10% or
less**
- macOS/Linux policies query the `mounts` table for the root partition
(`/`); Windows policy queries the `logical_drives` table for NTFS drives
- Resolution contact channel is `#help-it`
### New files
- `it-and-security/lib/macos/policies/disk-space-check.yml`
- `it-and-security/lib/windows/policies/disk-space-check.yml`
- `it-and-security/lib/linux/policies/disk-space-check.yml`
### Modified files
- `it-and-security/teams/workstations.yml` — registers the three new
policies
### How it works
| Platform | Query logic |
|---|---|
| macOS | `SELECT 1 FROM mounts WHERE path = '/' AND
CAST(blocks_available AS REAL) / blocks > 0.10` |
| Linux | `SELECT 1 FROM mounts WHERE path = '/' AND
CAST(blocks_available AS REAL) / blocks > 0.10` |
| Windows | `SELECT 1 WHERE (SELECT CAST(SUM(free_space) AS REAL) /
SUM(size) FROM logical_drives WHERE file_system = 'NTFS') > 0.10` |
- **Pass (returns rows):** available disk space is more than 10%
- **Fail (returns no rows):** available disk space is 10% or less
### Why >10% free disk space matters
Each policy description now includes context on why maintaining
sufficient free disk space is important:
- **System stability:** Low disk space can cause system instability,
slowdowns, and crashes
- **OS requirements:** Operating systems need free space for virtual
memory/swap, temporary files, and system updates
- **Application reliability:** Applications may fail to save data or
function properly when disk space is critically low
- **Data protection:** Keeping sufficient free space ensures reliable
performance and prevents data loss
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772934328893319?thread_ts=1772933835.386689&cid=D0AFASNBZMW)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
This pull request updates the Windows Defender compliance check policy
to improve detection accuracy and coverage. The main changes include
more robust checks for Defender features, support for policy-based
registry keys, and updates to documentation to reflect the expanded
feature set.
**Expanded compliance checks:**
* The query now checks both standard and policy registry keys for all
Defender features, ensuring that settings managed by group policy are
detected. (`windows-defender-compliance-check.yml`,
[it-and-security/lib/windows/policies/windows-defender-compliance-check.ymlL6-R70](diffhunk://#diff-ea811153c9930b3eb086d3238ec03b3abadd46142e2679bd0fecf94580dd4662L6-R70))
* Added a new check for anti-spyware protection (`antispyware_enabled`),
making sure this critical feature is enabled.
(`windows-defender-compliance-check.yml`,
[it-and-security/lib/windows/policies/windows-defender-compliance-check.ymlL6-R70](diffhunk://#diff-ea811153c9930b3eb086d3238ec03b3abadd46142e2679bd0fecf94580dd4662L6-R70))
**Improved accuracy:**
* All registry value comparisons now explicitly cast data to integers,
reducing false negatives due to type mismatches.
(`windows-defender-compliance-check.yml`,
[it-and-security/lib/windows/policies/windows-defender-compliance-check.ymlL6-R70](diffhunk://#diff-ea811153c9930b3eb086d3238ec03b3abadd46142e2679bd0fecf94580dd4662L6-R70))
* The Defender service running check now directly verifies the service
status instead of relying on registry values.
(`windows-defender-compliance-check.yml`,
[it-and-security/lib/windows/policies/windows-defender-compliance-check.ymlL6-R70](diffhunk://#diff-ea811153c9930b3eb086d3238ec03b3abadd46142e2679bd0fecf94580dd4662L6-R70))
**Documentation updates:**
* The policy description and resolution steps have been updated to
include anti-spyware protection and clarify the list of features
checked. (`windows-defender-compliance-check.yml`,
[it-and-security/lib/windows/policies/windows-defender-compliance-check.ymlL64-R81](diffhunk://#diff-ea811153c9930b3eb086d3238ec03b3abadd46142e2679bd0fecf94580dd4662L64-R81))
This pull request makes minor improvements to the software metadata for
Linux and Windows installers, and updates messaging in a MacOS
configuration profile. The main changes are the addition of display
names for several software packages and a small wording update in the
MacOS profile.
Software metadata improvements:
* Added the `display_name` field for 1Password, Slack, and Zoom
installers in both `.deb` and `.rpm` formats for Linux, improving
clarity in software listings.
[[1]](diffhunk://#diff-74a6b317e1363bc4c856fc04b9532876ec6fbdaec1ae7745bc7ec00c164b5ee8R2)
[[2]](diffhunk://#diff-a09b19aa20a36257dba104b182ec182a175198bf2b83b4c27bbe5b34e3f86a9cR2)
[[3]](diffhunk://#diff-63cf9bff568593d4d6681597dc69b3c3741cbd53197cfa8056e66a8ce6aa65a3R2)
[[4]](diffhunk://#diff-1c76fa28d50f586e4d7090a954db56d9235cdea759e8a613d2c5fb0ccdf28fdfR2)
[[5]](diffhunk://#diff-d3b614ed0d7209d14d8f70170e4326d56e660fdb87ed585674be14c344a59d7fR2)
[[6]](diffhunk://#diff-c5be3430c846b9b69a3d47f0157b0d1707a61dac731d823e38adbf78de4f5ebeR2)
* Added the `display_name` field for Zoom installers for Windows
(`zoom-arm.yml` and `zoom.yml`), making software identification easier.
[[1]](diffhunk://#diff-3f6d972edfe5bd7590c0cd9ffc76a416401410a4b6143e4d6b2d6a0f8efa83b5R2)
[[2]](diffhunk://#diff-2ea34a1db8efdb13d238a064e9bd2e0ba1e4565aba849549e6182fcbe38cd388R2)
MacOS configuration profile update:
* Updated the `subHeader` in the `nudge-configuration.mobileconfig` file
to reference the "IT team" instead of "IT & Enablement team," clarifying
the responsible group in user notifications.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38252
This pull request improves the Windows MDM unregistration PowerShell
script by adding extra checks and cleanup steps to ensure devices are
properly unenrolled and that the state is clearly reported. The script
now checks for relevant registry values before and after unregistration,
and explicitly clears any remaining values to guarantee correct
detection by Fleet.
Enhancements to device unregistration and registry cleanup:
* Added a pre-check for `DiscoveryServiceFullURL` registry values before
attempting to unregister the device, to provide clearer output about the
device's enrollment state.
* After calling the `UnregisterDeviceWithManagement` API, the script now
explicitly removes any remaining `DiscoveryServiceFullURL` values from
enrollment keys that have a `UPN`, ensuring Fleet properly detects the
device as unenrolled.
* Improved output messages to clearly indicate the actions taken and the
resulting device state, including whether registry values were found,
cleared, or already absent.
* Added error handling to exit with a non-zero code if an error occurs
during unregistration.
This fixes an issue where the background process invocation fails if the
script is located in a path containing white spaces, due to improper
path escaping, which can occur when the uninstall script is executed via
Microsoft Intune.
- Added new Windows Defender policy that checks to make sure Windows Defender is running, antivirus is enabled, real-time protect is enabled, and data protection access is enabled.
- Added additional formatting to policies section
- Updated Windows policies with human readable names so they appear cleaner in Fleet UI, rather than by their file names. Ex: `Disable OneDrive` vs `disable-onedrive`
Allen Houchins