George KarrandCopilot Autofix powered by AI
e0edd46448
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** Resolves #49329 ## What & why Fresh **Windows 11 25H2** (build 10.0.26200) devices failed Microsoft Entra / Autopilot MDM auto-enrollment during OOBE with error **80180006**. The device advertises an MS-MDE2 discovery `RequestVersion` of `"9.0"`, and Fleet's `IsValidDiscoveryMsg()` rejected it via an exact-match allow-list (`{"4.0","5.0","6.0","7.0"}`) that could only be changed by rebuilding the server. The discovery **response** already pins the protocol to `EnrollmentVersionV4` (`"4.0"`) and the client negotiates down, so the exact-match check was the only blocker. This PR implements the issue's preferred fix: **accept any `RequestVersion >= 4.0`**, which is forward-compatible with future Windows version bumps. - `server/mdm/microsoft/syncml/syncml.go`: replaced the `SupportedEnrollmentVersions` allow-list var with a `MinSupportedEnrollmentVersion` constant. - `server/fleet/microsoft_mdm.go`: added `enrollmentVersionAtLeast` (numeric component-wise compare, so `"10.0" > "9.0"`) and changed discovery validation to accept any version at or above the minimum. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [ ] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Fixed MDM enrollment failures on fresh Windows 11 25H2 and other recent builds. * Discovery requests now accept supported MDE2 `RequestVersion` values at or above the minimum supported version (instead of requiring an exact match). * Invalid or outdated discovery versions now return more specific validation errors. * **Tests** * Added unit test coverage for minimum, equal, newer, and invalid enrollment version comparisons. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
5 lines
328 B
Plaintext
5 lines
328 B
Plaintext
- Fixed a bug where fresh Windows 11 25H2 (and other recent builds) failed MDM enrollment with error
|
|
80180006 because the device's discovery `RequestVersion` (e.g. "9.0") was rejected by an exact-match
|
|
allow-list. Fleet now accepts any MS-MDE2 discovery `RequestVersion` at or above the minimum supported
|
|
version ("4.0").
|