diff --git a/articles/enroll-hosts.md b/articles/enroll-hosts.md index 3a34126547..b4b7d15a07 100644 --- a/articles/enroll-hosts.md +++ b/articles/enroll-hosts.md @@ -1,12 +1,30 @@ # Enroll hosts -Fleet gathers information from an [osquery](https://github.com/osquery/osquery) agent installed on each of your hosts. The recommended way to install osquery is using fleetd. +You can enroll macOS, Windows, Linux, iOS, iPadOS, Android, and ChromeOS hosts to Fleet. -You can enroll macOS, Windows or Linux hosts via the [CLI](#cli) or [UI](#ui). To learn how to enroll Chromebooks, see [Enroll Chromebooks](#enroll-chromebooks). +To manually enroll macOS, Windows, and Linux hosts, install Fleet’s agent (fleetd). You can generate fleetd via the [UI](#ui) or [CLI](#cli). -### Supported osquery versions +For iOS, iPadOS, and Android hosts, share the enrollment link from the [Fleet UI](#ui) with your end users. -Fleet supports the [latest version of osquery](https://github.com/osquery/osquery/tags). +You can also automatically enroll macOS, Windows, iOS, and iPadOS hosts. To automatically enroll Apple (macOS, iOS, and iPadOS) hosts, [connect Fleet to Apple Business Manager (ABM)](https://fleetdm.com/guides/macos-mdm-setup#apple-business-manager-abm). To automatically enroll Windows hosts, [connect Fleet to Microsoft Entra](https://fleetdm.com/guides/windows-mdm-setup#automatic-enrollment). + +To learn how to enroll Chromebooks, see the [Enroll Chromebooks guide](#enroll-chromebooks). + +## UI + +To manually enroll macOS, Windows, or Linux hosts, generate Fleet's agent (fleetd) through Fleet UI: + +1. Go to the **Hosts** page, select the team you want your host(s) to enroll to, and select **Add hosts**. +2. Select the tab for your desired platform (e.g. **macOS**). +3. Copy the command to generate fleetd and run the command with [fleetctl](https://fleetdm.com/docs/using-fleet/fleetctl-cli) installed. +4. Install fleetd on your host(s) to enroll it to Fleet. + +To manually enroll iOS, iPadOS, or Android hosts, follow the steps below: + +1. Go to the **Hosts** page, select the team you want your host(s) to enroll to, and select **Add hosts**. +2. Select the tab for your desired platform (e.g. **iOS**). +3. Copy the enrollment link from the UI and share it with your end users. +4. When your end users visit the link and follow the steps provided on the enrollment page, their host will be enrolled. ## CLI @@ -25,7 +43,7 @@ The `--type` flag is used to specify the fleetd installer type. > `fleetctl` on Windows can only generate MSI packages. -A `--fleet-url` (Fleet instance URL) and `--enroll-secret` (Fleet enrollment secret) must be specified in order to communicate with Fleet instance. +A `--fleet-url` (Fleet instance URL) and `--enroll-secret` (Fleet enroll secret) must be specified in order to communicate with Fleet instance. To generate fleetd for an Arm Linux or Windows host, use the `--arch=arm64` flag. @@ -39,23 +57,15 @@ fleetctl package --type pkg --fleet-url=example.fleetinstance.com --enroll-secre Tip: To see all options for `fleetctl package` command, run `fleetctl package -h` in your Terminal. -## UI - -To generate Fleet's agent (fleetd) in Fleet UI: - -1. Go to the **Hosts** page, and select **Add hosts**. -2. Select the tab for your desired platform (e.g. macOS). -3. A CLI command with all necessary flags to generate an install package will be generated. Copy and run the command with [fleetctl](https://fleetdm.com/docs/using-fleet/fleetctl-cli) installed. - ### Install fleetd -You can use your tool of choice, like [Munki](https://www.munki.org/munki/) on macOS or a package manager ([APT](https://en.wikipedia.org/wiki/APT_(software)) or [DNF](https://en.wikipedia.org/wiki/DNF_(software))) on Linux, to install fleetd. +You can use your tool of choice, like [Munki](https://www.munki.org/munki/) on macOS or a package manager ([APT](https://en.wikipedia.org/wiki/APT_(software)) or [DNF](https://en.wikipedia.org/wiki/DNF_(software))) on Linux, to install fleetd. ### Enroll hosts to a team With hosts segmented into teams, you can apply unique queries and give users access to only the hosts in specific teams. [Learn more about teams](https://fleetdm.com/docs/using-fleet/segment-hosts). -To enroll to a specific team: from the **Hosts** page, select the desired team from the menu at the top of the screen, then follow the instructions above for generating Fleet's agent (fleetd). The team's enroll secret will be included in the generated command. +To enroll to a specific team: from the **Hosts** page, select the desired team from the menu at the top of the screen, then follow the instructions above for generating Fleet's agent (fleetd). The team's enroll secret will be included in the generated command or on the enrollment page for iOS, iPadOS, and Android hosts. ### Fleet Desktop @@ -125,20 +135,21 @@ In the Google Admin console: ### Unenroll -How to unenroll a host from Fleet: +You can unenroll a macOS, Windows, or Linux host from Fleet (iOS, iPadOS, and Android hosts coming soon). 1. Determine if your host has MDM features turned on by looking at the **MDM status** on the host's **Host details** page. -2. For macOS hosts with MDM turned on, select **Actions > Turn off MDM** to turn MDM off. Instructions for turning off MDM on Windows hosts coming soon. +2. For macOS hosts with MDM turned on, select **Actions > Turn off MDM** to turn MDM off. For Windows hosts with MDM turned on, follow the [instructions for turning off MDM](https://fleetdm.com/guides/windows-mdm-setup#turn-off-windows-mdm). For iOS, iPadOS hosts with MDM turned on, select **Actions > Turn off MDM**. -3. Determine the platform of the host you're trying to unenroll, then follow the [uninstall instructions](https://fleetdm.com/guides/how-to-uninstall-fleetd) for that platform. +4. For macOS, Windows, and Linux hosts [uninstall fleetd](https://fleetdm.com/guides/how-to-uninstall-fleetd). -4. Select **Actions > Delete** to delete the host from Fleet. +5. Select **Actions > Delete** to delete the host from Fleet. > If an end user wants to switch their workstation's operating system (e.g. Windows to Linux), before they switch, delete the host from Fleet. Then, re-enroll the host. ## Advanced +- [Supported osquery versions](#supported-osquery-versions) - [Best practice for dual-boot workstations](#best-partice-for-dual-boot-workstations) - [Fleet agent (fleetd) components](#fleetd-components) - [Signing fleetd](#signing-fleetd) @@ -153,6 +164,10 @@ How to unenroll a host from Fleet: - [Config-less fleetd agent deployment](#config-less-fleetd-agent-deployment) - [Experimental features](#experimental-features) +### Supported osquery versions + +Fleet supports the [latest version of osquery](https://github.com/osquery/osquery/tags). + ### Best practice for dual-boot workstations When end users want to have a dual-boot environment (e.g. Windows and Linux on one computer), the best practice is to install fleetd, that uses `--host-identifier=instance`, on both operating systems. This enrolls two hosts, one per operating system, in Fleet. @@ -186,7 +201,7 @@ The `fleetctl package` command supports signing and notarizing macOS fleetd via Check out the example below: ```sh - AC_USERNAME=appleid@example.com AC_PASSWORD=app-specific-password fleetctl package --type pkg --sign-identity=[PATH TO SIGN IDENTITY] --notarize --fleet-url=[YOUR FLEET URL] --enroll-secret=[YOUR ENROLLMENT SECRET] + AC_USERNAME=appleid@example.com AC_PASSWORD=app-specific-password fleetctl package --type pkg --sign-identity=[PATH TO SIGN IDENTITY] --notarize --fleet-url=[YOUR FLEET URL] --enroll-secret=[YOUR ENROLL SECRET] ``` The above command must be run on a macOS device, as the notarizing and signing of macOS fleetd can only be done on macOS devices. @@ -407,7 +422,7 @@ so: 3. Run `fleetctl package`, and pass the absolute path above as the string argument to the `--local-wix-dir` flag. For example: ``` - fleetctl package --type msi --fleet-url=[YOUR FLEET URL] --enroll-secret=[YOUR ENROLLMENT SECRET] --local-wix-dir "\Users\me\AppData\Local\Temp\wix311-binaries" + fleetctl package --type msi --fleet-url=[YOUR FLEET URL] --enroll-secret=[YOUR ENROLL SECRET] --local-wix-dir "\Users\me\AppData\Local\Temp\wix311-binaries" ``` If the provided path doesn't contain all 3 binaries, the command will fail. @@ -415,7 +430,7 @@ so: ### Config-less fleetd agent deployment -Config-less deployment allows for Fleet's agent (fleetd) to be installed without embedding configuration settings directly into the package. This approach is ideal for environments requiring flexibility in managing enrollment secrets and server URLs. For detailed instructions, visit the [Config-less fleetd agent deployment guide](https://fleetdm.com/guides/config-less-fleetd-agent-deployment). +Config-less deployment allows for Fleet's agent (fleetd) to be installed without embedding configuration settings directly into the package. This approach is ideal for environments requiring flexibility in managing enroll secrets and server URLs. For detailed instructions, visit the [Config-less fleetd agent deployment guide](https://fleetdm.com/guides/config-less-fleetd-agent-deployment). >**Warning:** If you remove the configuration profile with the settings from macOS, `fleetd` won't work anymore until a similar profile is installed again. If the profile is delivered via MDM, and MDM is turned off, you might face this scenario.