Quick question, finally got MDM set up on Fleet, a...
# fleetm
Matt Davidson
03/14/2024, 3:47 AMQuick question, finally got MDM set up on Fleet, and was wondering if being Hybrid joined with Entra will cause issues? We don't have an Intune subscription yet, and I notice that when you see MDM status it says (automatic) for me but shows my fleet URL.
r
Rachel Perkins
03/14/2024, 2:05 PMThanks for reaching out, let me find someone from the MDM team to clarify.
b
Brock Walters
03/14/2024, 2:10 PMHello. We are working on improving the validation that governs how Windows MDM enrollments are displayed.
If what you are seeing seems incorrect it's most likely because Windows computers can be enrolled in multipile MDM servers simultaneously (unlike Apple computers which can only be associated to one MDM server.)
So, all that to say I doubt this will cause a problem with hybrid-join. But, keep us posted please!
m
Matt Davidson
03/14/2024, 2:41 PMI put a simple ScreenLock.xml to test the MDM, and of my 40-ish hosts so far, the first 6 have failed. How can I start troubleshooting and tracking down what the issue might be? Is there an FAQ with 'Common Issues' or 'Troubleshooting steps'?
b
Brock Walters
03/14/2024, 3:00 PMCan you share the device profile you're using?
m
Matt Davidson
03/14/2024, 4:20 PM2024-03-14_ScreenLock.xml
Matt Davidson
03/14/2024, 4:21 PMOh, I already see the issue. The LocURI. I assume that would be the cause.
b
Brock Walters
03/14/2024, 4:40 PMNot sure but I can test it as well.
m
Matt Davidson
03/14/2024, 4:40 PM@Brock Walters is there documentation that says the requirements for a machine to be MDM enrolled? I see a host is currently online, but MDM status says 'Off' while others do say they are 'On' and point at my Fleet instance. Is there also a command I can run (even if its on host) to determine if the xml can apply, and if MDM took?
b
Brock Walters
03/14/2024, 9:50 PMhttps://fleetdm.com/guides/windows-mdm-setup#microsoft-azure-active-directory-ad
Hard to say about the different status results. Woudl have to to look at logs because there are possible explanations for all of it.
There isn't anything I know of for Windows that validates the device profile (it totally may exist.) For Mac I might suggest Low Profile for that.
I am going to test your profile & see if I can talk to someone in engineering about it if it's not working.
m
Matt Davidson
03/14/2024, 10:10 PMI just did a test with a known good one, and it seemed to have finally picked up on some devices. Its probably the failed config that did that. It would be nice if there was something that was more transparent that said 'config is not valid'. I didn't see any clear spots that listed out the errors either. I clicked on the failed hosts entry and I saw nothing.
Matt Davidson
03/14/2024, 10:10 PMI appreciate all your help, you got me to the point that I realized it was my fault haha.
b
Brock Walters
03/14/2024, 10:11 PMAgree. There are status types for the profiles & I think we can do better at surfacing those
Brock Walters
03/14/2024, 10:13 PMm
Matt Davidson
03/14/2024, 10:14 PMI saw that, but it called out specifically InTune licensing which we don't have or (ideally) want to use. We hope to leverage a combination of Fleet, GPOs and Chef to get machines to do what we want.
b
Brock Walters
03/14/2024, 10:15 PMThe codes are the same values regardless.
Brock Walters
03/14/2024, 11:15 PMWould you mind posting the one that worked?
m
Matt Davidson
03/15/2024, 4:07 AM2024-03-13_ScreenLock.xml
Matt Davidson
03/19/2024, 5:18 PMComing back to this, it seems that all my hosts have decided they don't want to be MDM enrolled anymore. I only see 3 hosts, when before I had over 50 enrolled and validated. Under the Fleet MDM provider on Windows, I am able to sync, but from the UI, it says no MDM. Is there any other trick I can do? I do have Chef if I need to push out a new MSI, but aside from the MDM, the hosts are doing just fine in Fleet.
Matt Davidson
03/19/2024, 6:17 PMTo add to the above, I just added a new host to Fleet via the same installer, and it enrolled in MDM perfectly fine. Shows in Web UI and everything. Any insight would be most appreciated.
8 Views