mirror of https://github.com/fleetdm/fleet synced 2026-04-21 13:37:30 +00:00

Ian Littman ddd7891939

Clean up "click here" and "here" link anchors - part 1 (#29731 )

Fixes part of #29720.. Includes promoting some bolded to subheadings (in
wireframe docs).

---------

Co-authored-by: Sam Pfluger <108141731+Sampfluger88@users.noreply.github.com>

2025-06-04 13:54:34 -06:00

37 KiB

Raw Blame History

Windows MDM Server Demo

This project is a working and minimal implementation of the Windows device enrollment and management protocols. It was based on an initial implementation of the MS-MDE enrollment protocols from oscartbeaumont/windows_mdm.

This project uses the protocols:

The steps for MDE device enrollment correspond to five phases as shown in the following diagram:

License

This code is MIT licensed and it was forked from oscartbeaumont/windows_mdm. Initial implementation credit goes to Oscar Beaumont.

Usage

On the server side, you just need to run the project using the already provided cert and keys. The certificate is in .pfx file format, so you need to extract the certificate and key first, see https://stackoverflow.com/a/59120388/1094941. The "Import password" is "testpassword", and the names of the output files matter, on Linux something like this works (assuming you are in the certs/ directory):

# for the cert
$ openssl pkcs12 -in dev_cert_mdmwindows_com.pfx -clcerts -nokeys -out dev_cert_mdmwindows_com_cert.pem

# for the key
$ openssl pkcs12 -in dev_cert_mdmwindows_com.pfx -out dev_cert_mdmwindows_com.key -nocerts -nodes

Note that an asn1 error might occur when running the server, if that's the case you need to patch your local Go toolchain by running $ go run ./patch/patch.go (GOROOT env var must be set to point to your go env GOROOT directory). It may require sudo depending on where your go installation is (due to https://github.com/golang/go/issues/14017).

Next go to the project folder and run.

go run .

Note that the server binds to the standard and usually firewall-protected 443 port, so you may need to configure your firewall to allow connections to it for the duration of your test.

On the Windows client side, you need to import the custom CA certificate to the certificate store, and populate the hosts file before running the Windows Enrollment. The certificate to import is on the certs directory and it is called dev_cert_mdmwindows_com.pfx. You need to copy this certificate to the client machine and run the powershell command below (in the console, not in a powershell terminal). This is required because the project uses a local dev https endpoint.

1) Import certificate to Trusted CAs repository (be sure to update the path to the pfx certificate)

powershell -ep bypass "$mypwd = ConvertTo-SecureString -String 'testpassword' -Force -AsPlainText ; Import-PfxCertificate -FilePath c:\path\to\dev_cert_mdmwindows_com.pfx -CertStoreLocation Cert:\LocalMachine\Root -Password $mypwd"

2) Add mdmwindows.com to the list of static DNS

echo <server_ip> mdmwindows.com >> %SystemRoot%\System32\drivers\etc\hosts
echo <server_ip> autodiscovery.mdmwindows.com >> %SystemRoot%\System32\drivers\etc\hosts
echo <server_ip> enterpriseenrollment.mdmwindows.com >> %SystemRoot%\System32\drivers\etc\hosts

To enroll the device into this MDM server, go to Settings > Accounts > Access work or school and click the connect button, enter the email provided to the server when you ran go run . (default: demo@mdmwindows.com) and it should automatically detect the server and proceed with enrollment. This is why the server must run on port :443, because it uses automatic discovery and will not attempt a custom port.

Protocol Details

Below is the raw https exchange of the MS-MDE and MS-MDM protocols when run using the -verbose mode:

MDM Server HTTP Endpoints Auto Discovery Flow

============================= Input Request =============================
----------- Input Header -----------
 GET /EnrollmentServer/Discovery.svc HTTP/2.0
Host: enterpriseenrollment.mdmwindows.com
Cache-Control: no-cache
Pragma: no-cache
User-Agent: ENROLLClient


----------- Empty Input Body -----------
=========================================================================



============================= Output Response =============================
----------- Response Header -----------
 HTTP/1.1 200 OK
Connection: close


----------- Empty Response Body -----------
=========================================================================

============================= Input Request =============================
----------- Input Header -----------
 POST /EnrollmentServer/Discovery.svc HTTP/2.0
Host: enterpriseenrollment.mdmwindows.com
Content-Length: 1042
Content-Type: application/soap+xml; charset=utf-8
User-Agent: ENROLLClient


----------- Input Body -----------

        <s:Envelope xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:s="http://www.w3.org/2003/05/soap-envelope">
          <s:Header>
            <a:Action s:mustUnderstand="1">http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/Discover</a:Action>
            <a:MessageID>urn:uuid:748132ec-a575-4329-b01b-6171a9cf8478</a:MessageID>
            <a:ReplyTo>
              <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
            </a:ReplyTo>
            <a:To s:mustUnderstand="1">https://EnterpriseEnrollment.mdmwindows.com:443/EnrollmentServer/Discovery.svc</a:To>
          </s:Header>
          <s:Body>
            <Discover xmlns="http://schemas.microsoft.com/windows/management/2012/01/enrollment">
              <request xmlns:i="http://www.w3.org/2001/XMLSchema-instance">
                <EmailAddress>demo@mdmwindows.com</EmailAddress>
                <RequestVersion>4.0</RequestVersion>
                <DeviceType>CIMClient_Windows</DeviceType>
                <ApplicationVersion>10.0.19043.2364</ApplicationVersion>
                <OSEdition>72</OSEdition>
                <AuthPolicies>
                  <AuthPolicy>OnPremise</AuthPolicy>
                  <AuthPolicy>Federated</AuthPolicy>
                </AuthPolicies>
              </request>
            </Discover>
          </s:Body>
        </s:Envelope>
=========================================================================




============================= Output Response =============================
----------- Response Header -----------
 HTTP/1.1 200 OK
Content-Length: 1107
Content-Type: application/soap+xml; charset=utf-8


----------- Response Body -----------


        <s:Envelope
                        xmlns:s="http://www.w3.org/2003/05/soap-envelope"
                        xmlns:a="http://www.w3.org/2005/08/addressing">
          <s:Header>
            <a:Action s:mustUnderstand="1">http://schemas.microsoft.com/windows/management/2012/01/enrollment/IDiscoveryService/DiscoverResponse</a:Action>
            <ActivityId CorrelationId="8c6060c4-3d78-4d73-ae17-e8bce88426ee"
                                        xmlns="http://schemas.microsoft.com/2004/09/ServiceModel/Diagnostics">8c6060c4-3d78-4d73-ae17-e8bce88426ee
                                </ActivityId>
            <a:RelatesTo>urn:uuid:748132ec-a575-4329-b01b-6171a9cf8478</a:RelatesTo>
          </s:Header>
          <s:Body>
            <DiscoverResponse
                                        xmlns="http://schemas.microsoft.com/windows/management/2012/01/enrollment">
              <DiscoverResult>
                <AuthPolicy>OnPremise</AuthPolicy>
                <EnrollmentVersion>4.0</EnrollmentVersion>
                <EnrollmentPolicyServiceUrl>https://mdmwindows.com/EnrollmentServer/Policy.svc</EnrollmentPolicyServiceUrl>
                <EnrollmentServiceUrl>https://mdmwindows.com/EnrollmentServer/Enrollment.svc</EnrollmentServiceUrl>
              </DiscoverResult>
            </DiscoverResponse>
          </s:Body>
        </s:Envelope>
=========================================================================

MDM Certificate Enrollment Policy Flow (MS-XCEP)

============================= Input Request ============================= ----------- Input Header ----------- POST /EnrollmentServer/Policy.svc HTTP/2.0 Host: mdmwindows.com Content-Length: 1495 Content-Type: application/soap+xml; charset=utf-8 User-Agent: ENROLLClient

----------- Input Body -----------

    <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/200512" xmlns:ac="http://schemas.xmlsoap.org/ws/2006/12/authorization">
      <s:Header>
        <a:Action s:mustUnderstand="1">http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPolicies</a:Action>
        <a:MessageID>urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0</a:MessageID>
        <a:ReplyTo>
          <a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address>
        </a:ReplyTo>
        <a:To s:mustUnderstand="1">https://mdmwindows.com/EnrollmentServer/Policy.svc</a:To>
        <wsse:Security s:mustUnderstand="1">
          <wsse:UsernameToken u:Id="uuid-cc1ccc1f-2fba-4bcf-b063-ffc0cac77917-4">
            <wsse:Username>demo@mdmwindows.com</wsse:Username>
            <wsse:Password wsse:Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">demo</wsse:Password>
          </wsse:UsernameToken>
        </wsse:Security>
      </s:Header>
      <s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
        <GetPolicies xmlns="http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy">
          <client>
            <lastUpdate xsi:nil="true"/>
            <preferredLanguage xsi:nil="true"/>
          </client>
          <requestFilter xsi:nil="true"/>
        </GetPolicies>
      </s:Body>
    </s:Envelope>

=========================================================================

============================= Output Response ============================= ----------- Response Header ----------- HTTP/1.1 200 OK Content-Length: 1378 Content-Type: application/soap+xml; charset=utf-8

----------- Response Body -----------

    <s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
      <s:Header>
        <a:Action s:mustUnderstand="1">http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy/IPolicy/GetPoliciesResponse</a:Action>
        <a:RelatesTo>urn:uuid:72048B64-0F19-448F-8C2E-B4C661860AA0</a:RelatesTo>
      </s:Header>
      <s:Body
                            xmlns:xsd="http://www.w3.org/2001/XMLSchema"
                            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
        <GetPoliciesResponse
                                    xmlns="http://schemas.microsoft.com/windows/pki/2009/01/enrollmentpolicy">
          <response>
            <policies>
              <policy>
                <attributes>
                  <policySchema>3</policySchema>
                  <privateKeyAttributes>
                    <minimalKeyLength>2048</minimalKeyLength>
                    <algorithmOIDReferencexsi:nil="true"/>
                  </privateKeyAttributes>
                  <hashAlgorithmOIDReference xsi:nil="true"></hashAlgorithmOIDReference>
                </attributes>
              </policy>
            </policies>
          </response>
          <oIDs>
            <oID>
              <value>1.3.6.1.4.1.311.20.2</value>
              <group>1</group>
              <oIDReferenceID>5</oIDReferenceID>
              <defaultName>Certificate Template Name</defaultName>
            </oID>
          </oIDs>
        </GetPoliciesResponse>
      </s:Body>
    </s:Envelope>