Windows MDM Fix Manual Detection #17721
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Replace the use of the isFederated registry key with a keys that check for AAD (Azure Active Directory, now Entra ID) Federated enrollment (isFederated) seems to be when windows uses a Discovery MDM endpoint to get its policy and management endpoint configuration. This is always the case when a client is enrolled with fleet, so installations always show up as automatic. It's being replaced by a different key, `AADResourceID`, which appears to identify the resource that controls the automated deployment. In my tests it only appears to be populated when the computer is enrolled through automated deployments. This key appears on both Windows 10 and 11. There is a similar key, `AADTenantID`, which appears to identify the client (tenant) to the Azure cloud. I haven't seen this ID in our systems, so it is likely exclusively used in Azure. Both this key and `AADResourceID` seem to always be set at the same time, so we only check for the `AADResourceID`. I've also added documentation on the registry keys I've analyzed in the previous commit for future reference.
dantecatalfamo
temporarily deployed
to
Docker Hub
GitHub Actions
Inactive
roperzh
reviewed
Mar 19, 2024
dantecatalfamo
temporarily deployed
to
Docker Hub
GitHub Actions
Inactive
roperzh
previously approved these changes
Mar 19, 2024
| -- in order to account for hosts that might not have this | ||
| -- key, and servers | ||
| WHERE COALESCE(e.state, '0') IN ('0', '1', '2') | ||
| LIMIT 1; |
There was a problem hiding this comment.
sanity-checking: have you generated this using make generate-docs?
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #17721 +/- ##
==========================================
- Coverage 65.68% 65.61% -0.07%
==========================================
Files 1193 1193
Lines 108031 108031
Branches 2574 2574
==========================================
- Hits 70955 70885 -70
- Misses 31707 31764 +57
- Partials 5369 5382 +13
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. |
dantecatalfamo
had a problem deploying
to
Docker Hub
GitHub Actions
Error
dantecatalfamo
changed the title
dantecatalfamo
temporarily deployed
to
Docker Hub
GitHub Actions
Inactive
roperzh
previously approved these changes
Mar 19, 2024
dantecatalfamo
had a problem deploying
to
Docker Hub
GitHub Actions
Error
Oh no so I can bring them back? 😭 |
roperzh
previously approved these changes
Mar 20, 2024
sounds good, sorry about that! I'll be on the watch and approve again after you do that. |
dantecatalfamo
had a problem deploying
to
Docker Hub
GitHub Actions
Error
dantecatalfamo
had a problem deploying
to
Docker Hub
GitHub Actions
Error
roperzh
previously approved these changes
Mar 20, 2024
dantecatalfamo
temporarily deployed
to
Docker Hub
GitHub Actions
Inactive
dantecatalfamo
temporarily deployed
to
Docker Hub
GitHub Actions
Inactive
rachaelshaw
approved these changes
Mar 21, 2024
roperzh
approved these changes
Mar 21, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
#15565
Checklist for submitter
changes/ororbit/changes/.See Changes files for more information.
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements)cmd/osquery-perffor new osquery data ingestion features.