Commit Graph
2533 Commits
Author SHA1 Message Date
Steven PalmesanoandDale Ribeiro e15d4afcb6 Add CSP to disable lock screen slide show (#34551)
Using a workaround described
[here](https://github.com/fleetdm/fleet/issues/33731#issuecomment-3423354681)
to get the verification to succeed.

---------

Co-authored-by: Dale Ribeiro <dale@fleetdm.com>
2025-10-23 16:15:57 -04:00
Jake Stenger c9e589f142 two more (#34678) 2025-10-23 15:47:22 -04:00
Graham Williams 92bf89f235 Create enable built-in Admin Approval Mode - [UseAdminApprovalMode].xml (#34680)
- Enables the
[UserAccountControl_UseAdminApprovalMode](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#useraccountcontrol_useadminapprovalmode)
setting
- MDMPolicyManager Merge successful
- Policy verifies in FleetUI

<img width="1143" height="377" alt="image"
src="https://github.com/user-attachments/assets/53bb96ab-b657-463b-ab89-0c3f2bc8584d"
/>
2025-10-23 13:49:03 +01:00
Graham Williams c78a047dff Create disable diagnostic data - [CommercialId].xml (#34679)
- Disables the
[CommercialId](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-admx-datacollection#commercialidpolicy)
setting
- MDMPolicyManager Merge successful
- Policy verifies in FleetUI

<img width="1112" height="362" alt="image"
src="https://github.com/user-attachments/assets/e31a9e0c-89f7-4f0b-84e4-fa35e6e19bea"
/>
2025-10-23 13:48:51 +01:00
Jake Stenger d8865f369a Doc/solutions/windows cleanup (#34676)
Consolidates all the CSPs from the spreadsheet into one location.
Removes CmdID keys from all CSPs.
2025-10-22 19:59:12 -07:00
Harrison Ravazzolo 346da470b8 Refactor SCEP configuration for Okta certificate (#34674)
Updated SCEP configuration for Okta attestation certificate
installation, including placeholders for various parameters.
2025-10-22 18:30:54 -07:00
Jake Stenger 81faf4e9cb organize files into platform, function folders. Standardize filenames… (#34659)
… for easier readibility. Standardize on 2-space indentation.
2025-10-22 17:07:33 -04:00
Noah Talerman 7849306684 [API reference] Fix broken "filters" anchor link (#34608) 2025-10-22 14:55:47 -05:00
Matt Rebelo a029dcfa3e Update single-sign-on-sso.md (#34651)
adding end user authentication dialog to Google Workspace configuration
section as well

<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes

## Testing

- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)

- [ ] QA'd all new/changed functionality manually

For unreleased bug fixes in a release candidate, one of:

- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed

## Database migrations

- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).

## New Fleet configuration settings

- [ ] Setting(s) is/are explicitly excluded from GitOps

If you didn't check the box above, follow this checklist for
GitOps-enabled settings:

- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled

## fleetd/orbit/Fleet Desktop

- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
2025-10-22 14:54:51 -05:00
Mason BuettnerandDale Ribeiro b3fa01a144 Add disable-insider-ui-page.ps1 (#34499)
This script disables the UI page where users can opt into the Windows
insider program.


# Checklist for submitter

If some of the following don't apply, delete the relevant line.

## Testing

- [x] QA'd all new/changed functionality manually

---------

Co-authored-by: Dale Ribeiro <dale@fleetdm.com>
2025-10-22 13:57:12 -04:00
Graham WilliamsandDale Ribeiro 4dc76ec838 Create windows-device-privacy-speechrecognition-disabled.xml (#34505)
- Uses randomly generated UUID for the CmdID as required by [CmdID
Specs](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mdm/d7321df8-ecb2-4c81-8a24-54630bc7456f)
- Created **Device** profile to disable the setting as required based on
[Microsoft
Docs](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#bootstartdriverinitialization)
- Profiles return as **Verified** in FleetUI
- Event Viewer shows no errors
- Ability to enable service disabled

<img width="1025" height="406" alt="image"
src="https://github.com/user-attachments/assets/13efdd05-7248-4dc5-b41f-0d550b3c3f0e"
/>

---------

Co-authored-by: Dale Ribeiro <dale@fleetdm.com>
2025-10-22 13:02:55 -04:00
Brock Walters d4dabf4783 Add configuration to block user account details on sign-in (#34622) 2025-10-22 12:59:12 -04:00
Harrison Ravazzolo bb4717da1f Enable SmartScreen, Prompt for user elevation CSP (#34445) 2025-10-22 12:51:25 -04:00
Graham Williams 27bbebc122 Create windows-device-systemservices-simptcp-disabled.xml (#34502)
- Uses randomly generated UUID for the CmdID as required by [CmdID
Specs](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mdm/d7321df8-ecb2-4c81-8a24-54630bc7456f)
- Created **Device** profile to disable the setting as required based on
[Microsoft
Docs](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#bootstartdriverinitialization)
- Profiles return as **Verified** in FleetUI (Requires device restart)
- Event Viewer shows no errors
- Service shows as disabled
2025-10-22 10:09:59 +01:00
Graham WilliamsandDale Ribeiro e08b34c8e2 Create windows-device-remoteassistance-disabled.xml (#34503)
- Uses randomly generated UUID for the CmdID as required by [CmdID
Specs](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mdm/d7321df8-ecb2-4c81-8a24-54630bc7456f)
- Created **Device** profile to disable the setting as required based on
[Microsoft
Docs](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-system#bootstartdriverinitialization)
- Profiles return as **Verified** in FleetUI (Requires device restart)
- Event Viewer shows no errors
- Requesting Remote Assist fails

<img width="1461" height="1034" alt="image"
src="https://github.com/user-attachments/assets/3eb29616-0dbc-495a-bf35-51b60d49bd11"
/>

Co-authored-by: Dale Ribeiro <dale@fleetdm.com>
2025-10-22 10:09:36 +01:00
Graham WilliamsandDale Ribeiro 3144b1eacc Create windows-device-networkaccess-everyonepermissions.xml (#34508)
- Uses randomly generated UUID for the CmdID as required by [CmdID
Specs](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-mdm/d7321df8-ecb2-4c81-8a24-54630bc7456f)
- Created **Device** profile to disable the setting as required based on
[Microsoft
Docs](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions#networkaccess_leteveryonepermissionsapplytoanonymoususers)
- Profiles return as **Verified** in FleetUI
- Event Viewer shows no errors

<img width="1468" height="296" alt="image"
src="https://github.com/user-attachments/assets/cfd23f13-c47a-4aa7-a7b3-604ec7421a15"
/>

Co-authored-by: Dale Ribeiro <dale@fleetdm.com>
2025-10-22 10:09:21 +01:00
Dale Ribeiro b0895b9e23 Added acccount-lock-out.xml (#34619) 2025-10-21 18:02:44 -04:00
Noah Talerman 3b2717f4fd YAML reference (#34604)
Use serial numbers for labels example. Serial numbers is best practice.
2025-10-21 14:15:57 -05:00
Harrison Ravazzolo fdc184fe58 Windows CSP - Spotlight config + Okta scep (#34589) 2025-10-21 08:47:50 -07:00
George Karr 33650644c8 Update sprint retrospective guidelines with tool recommendations (#34543) 2025-10-20 15:22:43 -05:00
+3 7ed4aac2b8 Docs v4.75.0 (#34443)
Documentation changes for the 4.75 release

---------

Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Co-authored-by: Ian Littman <iansltx@gmail.com>
Co-authored-by: Noah Talerman <noahtal@umich.edu>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Co-authored-by: Tim Lee <timlee@fleetdm.com>
Co-authored-by: Janis Watts <184028114+jmwatts@users.noreply.github.com>
Co-authored-by: Sarah Gillespie <73313222+gillespi314@users.noreply.github.com>
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
2025-10-17 17:45:52 -05:00
jacobshandlingandJacob Shandling 5f626e2a8c Add gigs_all_disk_space vital collection, storage, service, and UI rendering for Linux hosts (#34077)
## Addresses #31671 

- [x] Changes file added for user-visible changes in `changes/`
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)

## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually

## Database migrations

- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **New Features**
* Added total disk space metrics for all partitions on Linux hosts. The
disk space indicator now displays comprehensive storage information
including root partition and all other partitions, improving visibility
into host storage capacity.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
2025-10-17 08:24:23 -07:00
RachelElysiaandCarlo DiCelico 1ef91fe4e3 Feature: Script only package e2e followup (#34271)
Co-authored-by: Carlo DiCelico <carlo@fleetdm.com>
2025-10-17 10:54:00 -04:00
Allen Houchins 6a04a40c9a Refine JIT user provisioning description in SSO docs (#34434)
Clarified explanation of JIT user provisioning and account creation
process.
2025-10-17 09:08:33 -05:00
Zach Wasserman 004e473887 Add query for MCP configurations (#34404)
**Related issue:** Part of #29969
2025-10-16 17:55:55 -05:00
Brock Walters 92a58851fa Added new Set_ScreenSaverGracePeriod.ps1 script (#34340)
This script is part of the CSA project to create Windows controls for
customer-rembrandt.
2025-10-16 11:08:36 -05:00
Graham Williams 2f6cacb09d Create Profile: Disable Local Administrator (#34344)
- Administrator account starts as enabled: True
- Profile verifies: True
- Administrator account disabled after apply: True

<img width="1654" height="1113" alt="image"
src="https://github.com/user-attachments/assets/9551d87a-341a-49e3-8d0b-15c86ea1b81c"
/>

<img width="2043" height="424" alt="image"
src="https://github.com/user-attachments/assets/acbfa66d-2684-43b8-a964-f7679fd861e8"
/>
2025-10-16 11:08:04 -05:00
Ian Littman e48d8033a9 Map manjaro-arm platform (#34357)
Resolves #34318. Thx @jmwatts for the QA on this!

- [x] QA'd all new/changed functionality manually
2025-10-16 11:00:05 -05:00
Noah Talerman 0e9bba4774 YAML reference: Typo: "self_service" (#34202) 2025-10-14 17:06:25 -05:00
jacobshandling 05b8ba4a32 Update gitops labels docs (#34207)
Small docs fixes
2025-10-14 17:06:01 -05:00
Tim Lee 2b18caaee1 Add Jetbrains plugins (#34024) 2025-10-14 09:01:45 -06:00
Ian Littman bbc36bbc83 Fall back to app filename when ingesting macOS apps that have no display name/bundle name and run.sh as the bundle executable (#34176)
Fixes #34157. Seen on Steam games, which also don't have a bundle ID.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)

## Testing

- [x] QA'd all new/changed functionality manually
2025-10-13 17:33:20 -05:00
Mason Buettner e78ad1b9ca Fix typo in REST API "Request certificate" (#34092)
Changes:
 - Changed "isseud" to "issued" in `idp_client_id`.
2025-10-10 12:06:02 -05:00
Noah Talerman 9034d13b65 API reference: Clarify 'pending' (#33960) 2025-10-08 16:47:31 -04:00
Victor Lyuboslavsky e274738b9d Instructions to create a public mTLS reverse proxy (#33906)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #33165

Doc updates only.
2025-10-08 14:46:33 -05:00
Zach WassermanandJacob Shandling 41c53860e3 Add support for VSCode fork extensions in software inventory (#33595)
**Related issue:** Resolves #31397

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)

## Testing

- [x] Added/updated automated tests

- [x] QA'd all new/changed functionality manually

---------

Co-authored-by: Jacob Shandling <jacob@fleetdm.com>
2025-10-07 14:05:22 -07:00
Harrison RavazzoloandBrock Walters 9e3cab666e Update doc assets (#33740)
After talking with eng team and @nonpunctual, the /assets folder is
reserved for things inside the fleet app, so creating a new folder in
`/docs/solutions`

@AdamBaali - I updated your article paths and moved the assets to the
new folder, do you mind taking a peek and making sure it looks good?

Note: brock, we should also update handbook for new ritual to add
articles with assets like this.

---------

Co-authored-by: Brock Walters <153771548+nonpunctual@users.noreply.github.com>
2025-10-07 13:02:36 -06:00
Rachael Shaw 75104bfbcb Rename "Single sign-on options" settings page to "Single sign-on (SSO)" (#33946)
As part of https://github.com/fleetdm/fleet/issues/25798, we planned to
rename "Single sign-on options" to "Single sign-on (SSO)". However, we
missed adding a check for the copy change in the test plan, so we didn't
catch that the change didn't make it in.

The documentation/guide changes referencing the new page name were
already merged as part of 4.71.
2025-10-07 13:38:37 -05:00
Rachael Shaw b94aba24aa Remove duplicate certificate authorities example from YAML docs (#33931)
There was an extra one left over from merging in doc updates.
2025-10-07 08:59:30 -05:00
Gabriel Hernandez 95c559fbab Add host platform to mdm enrolled and mdm unenrolled activity details (#33858)
**Related issue:** Fixes #33807

Adds missing host platform key to mdm enrolled and mdm unenrolled
activity details api response data. This allows the UI to display the
activities properly

- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
2025-10-07 14:22:37 +01:00
+1 48cb0908cd Docs v4.74.0 (#33879)
Documentation changes for 4.74

---------

Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com>
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Co-authored-by: Ian Littman <iansltx@gmail.com>
Co-authored-by: Noah Talerman <noahtal@umich.edu>
Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
Co-authored-by: Jordan Montgomery <elijah.jordan.montgomery@gmail.com>
Co-authored-by: Janis Watts <184028114+jmwatts@users.noreply.github.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
2025-10-06 17:03:10 -05:00
Noah Talerman 46df8f8274 API reference: Remove errant key (#33898) 2025-10-06 17:01:11 -05:00
Noah Talerman e1ca48f549 Supported host operating systems (#33861)
- openSUSE 15.6+
- Lowercase "openSUSE"

Supported added in the following user story:
- #32778
2025-10-06 11:59:35 -05:00
Lucas Manuel Rodriguez 527c2230e9 Add support for legacy Company portal SSO extension (#33796)
Resolves #33319

- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.

## Testing

- [X] QA'd all new/changed functionality manually
2025-10-03 17:56:38 -03:00
Victor Lyuboslavsky 5ff5332026 Added SSF to Okta research doc. (#33720)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #32766
2025-10-03 08:16:41 -05:00
Noah Talerman 279cc8d0d4 YAML reference: Only one package, App Store app, or Fleet-maintained app per software (#33707)
Docs to address the following bug:
- #32607
2025-10-02 19:06:02 -05:00
Noah Talerman 5ee9fa774c API reference: OTA profiles don't work if end user auth is enabled (#33705)
- @noahtalerman: We shipped a breaking change in Fleet 4.73 that
resulted in this bug: https://github.com/fleetdm/fleet/issues/33447
 - To fix this bug we decided to...
- Accept this breaking change, document it (this PR), and add an
improved error message. See
[bug](https://github.com/fleetdm/fleet/issues/33447).
- Improve the manual enrollment flow for macOS hosts. User story is
[here](https://github.com/fleetdm/fleet/issues/33640).
   - Both changes are targeted for 4.77
2025-10-02 19:05:09 -05:00
Allen HouchinsandRachael Shaw df0d60a8f4 Update rest-api.md (#33702)
- Added additional platform information to address confusion encountered
during a recent prospect call.

---------

Co-authored-by: Rachael Shaw <r@rachael.wtf>
2025-10-02 18:48:16 -05:00
Eric 9e520f22dd Docs: Update anchor link in Upgrading-Fleet.md (#33784)
Changes:
- Fixed an anchor link in the Upgrading Fleet documentation
2025-10-02 15:44:28 -05:00
Victor Lyuboslavsky 0498b2f200 Added research doc for osquery ebpfpub replacement (#33722)
<!-- Add the related story/sub-task/bug number, like Resolves #123, or
remove if NA -->
**Related issue:** Resolves #30639
2025-10-02 11:33:09 -05:00