mirror of
https://github.com/fleetdm/fleet
synced 2026-05-24 09:28:54 +00:00
f2f1f66d11
Closes #38916 Related: #34993, #33985, fleetdm/confidential#13228 ## Changes **Article update** (`articles/windows-mdm-setup.md`) - Adds "Migrating from another MDM solution" subsection under **Manual enrollment** with overview of common migration issues and links to remediation scripts **New scripts** (`docs/solutions/windows/scripts/`) - `reset-mdm-enrollment-flag.ps1` — Resets MmpcEnrollmentFlag blocking MDM status after migration - `remove-stale-mdm-enrollment-records.ps1` — Clears orphaned enrollment GUIDs, AAD discovery cache, and MS DM Server cache - `fix-workplace-join-configuration.ps1` — Re-enables Automatic-Device-Join task and configures Workplace Join policies - `remove-unreachable-wsus-configuration.ps1` — Removes unreachable WSUS server config that breaks Windows Update ## Context Customers migrating Windows hosts from Intune to Fleet have been hitting recurring enrollment issues, MDM status stuck on "Off," enrollment errors (`0x80190190`, `0x8018000a`), and Windows Update breakage from leftover RMM agents. These scripts consolidate the workarounds from multiple customer engagements into self-serve remediation that can be deployed via **Controls > Scripts**. --------- Co-authored-by: Marko Lisica <83164494+marko-lisica@users.noreply.github.com> |
||
|---|---|---|
| .. | ||
| all | ||
| android/configuration-profiles | ||
| api-scripts | ||
| docker-compose | ||
| ios-ipados | ||
| linux | ||
| macos | ||
| tines | ||
| windows | ||
| README.md | ||
Solutions
Best Practices
General
- Name the file what the profile does.
- For example, instead of
googlePlayProtectVerifyApps.json(the name of the Android policy for this control), describe what it does:enforce-google-play-protect.json.
- For example, instead of
- Use kebab case in file names, with all letters in lowercase.
- Instead of
passwordPolicy.json, usepassword-policy.json.
- Instead of
- Be sure to end files with an empty newline.
symlinks
If a solution is applicable to multiple platforms, keep the original in the main platform directory and symlink it to the other platforms. For example, if an Apple configuration profile can be used on both macOS and iOS, use macOS as the source, and create a symlink in the iOS directory.
cd docs/solutions/ios-ipados/configuration-profiles/- Note that this is the destination that we want the symlink to be in.
ln -s ../../macos/configuration-profiles/my-profile.mobileconfig .- The
.here at the end means the current directory, and will use the same file name as the original (which is what we want).
- The
git add profile.mobileconfiggit commit