## Summary
- Adds Okta Verify as a custom package for x86 Windows workstations in
the Fleet GitOps configuration
- Creates `it-and-security/lib/windows/software/okta-verify.yml` using
the `$DOGFOOD_OKTA_VERIFY_WINDOWS_URL` secret for the download URL
- Configures the app in `workstations.yml` with `self_service: true`,
`setup_experience: true`, the "Security" category, and scoped to
`x86-based Windows hosts` label
## Changes
1. **New file**: `it-and-security/lib/windows/software/okta-verify.yml`
— Software definition with the secret-referenced URL
2. **Modified**: `it-and-security/teams/workstations.yml` — Added Okta
Verify package reference under `software.packages` in the Windows apps
section
Built for [Allen
Houchins](https://fleetdm.slack.com/archives/D0AFASNBZMW/p1772924912095649)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
---------
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38252
This pull request improves the Windows MDM unregistration PowerShell
script by adding extra checks and cleanup steps to ensure devices are
properly unenrolled and that the state is clearly reported. The script
now checks for relevant registry values before and after unregistration,
and explicitly clears any remaining values to guarantee correct
detection by Fleet.
Enhancements to device unregistration and registry cleanup:
* Added a pre-check for `DiscoveryServiceFullURL` registry values before
attempting to unregister the device, to provide clearer output about the
device's enrollment state.
* After calling the `UnregisterDeviceWithManagement` API, the script now
explicitly removes any remaining `DiscoveryServiceFullURL` values from
enrollment keys that have a `UPN`, ensuring Fleet properly detects the
device as unenrolled.
* Improved output messages to clearly indicate the actions taken and the
resulting device state, including whether registry values were found,
cleared, or already absent.
* Added error handling to exit with a non-zero code if an error occurs
during unregistration.
This fixes an issue where the background process invocation fails if the
script is located in a path containing white spaces, due to improper
path escaping, which can occur when the uninstall script is executed via
Microsoft Intune.
Changes:
- Windows MDM setup guide update: include instructions how to turn off
MDM
- Redirect: new link `learn-more-about/windows-mdm` that will be used in
the error message.
