https://github.com/osquery/osquery logo
Join Slack
Powered by
I've placed the cert and key on the server and upd...
# fleet
b
I've placed the cert and key on the server and updated the configuration file. I've successfully turned on the MDM. However, my one and only client says that MDM Status is "off" and the "MDM Server URL" is blank on the client. What am I missing? On another note, I was able to successfully turn on the Apple MDM, so I'm not certain what the issue is. Thanks for any guidance.
d
Hey @Brad Johnson, so the host is otherwise communicating with the Fleet server? Updating vitals and all that?
b
Yes, that's correct. The host is listed as online, I can see that it was last "fetched" one hour ago, etc.
d
On the host itself, if you navigate to Settings > Accounts > Access work or school do you see if it says Connected to Fleet MDM?
b
It does not. I'm only connected to Active Directory locally, and I've also got an Azure account listed on that screen, however I/we do not use Azure as an MDM.
I have tried creating the key and crt on Windows using openssl, and I've also created them on Ubuntu, and neither seems to have made a difference. In my Ubuntu fleet.config file, located at /etc/fleet/ I added a section for mdm as follows:
mdm:
windows_wstep_identity_cert: /etc/fleet/NameOfCert.crt
windows_wstep_identity_key: /etc/fleet/NameOfKey.key
d
What version of Windows is this host running?
b
I actually have two hosts with the agent installed; one is Windows 10, the other is Windows 11. Neither one of them are show up as MDM-enabled.
d
Hmm... let's take a step back. Have you tried to pass the bytes of the certificate and key directly into your configuration by adding _bytes to the end of the key in your configuration?
b
I've not. I'm not sure how to do that necessarily. I created my config file by hand in Ubuntu. My file is fleet.config and here are the contents: mysql: address: 127.0.0.1:3306 database: fleet username: ******* password: ******* redis: address127.0.0.16379 server: address: 0.0.0.0:4443 cert: /etc/letsencrypt/live/NameOfMyServer/fullchain.pem key: /etc/letsencrypt/live/NameOfMyServer/privkey.pem websockets_allow_unsafe_origin: true private_key: ************** mdm: windows_wstep_identity_cert: /etc/fleet/fleet-mdm-win-wstep.crt windows_wstep_identity_key: /etc/fleet/fleet-mdm-win-wstep.key
When I tried with the _bytes added to the end, and pasted my key into the file, my nginx and/or fleet would not start.
d
Ok, and before you made that change you were able to turn on Windows MDM in the UI and not get an error message?
In Settings > Integrations > Mobile device management > Turn on Windows MDM
b
Hi Dale, yes. Prior to that change I was able to turn on MDM and not get an error message.
k
What version of Fleet are you running?
When I tried with the _bytes added to the end, and pasted my key into the file, my nginx and/or fleet would not start.
What errors did you see when Fleet would not start?
b
No errors from the Ubuntu command prompt environment; the web interface (MyServer:9443) shows 502 Bad Gateway, nginx/1.24.0 (Ubuntu) . I am running fleet 4.53.1
@Dale Ribeiro @Kathy Satterlee Ok, I generated new certificates, I updated the fleet.config file and appear to have successfully passed in the _bytes for both the crt and the key. I generated a new agent, which included fleet desktop, enable-scripts, and included the fleet.pem certificate using the --fleet-certificate argument. I installed the agent on my test machine, and Fleet states that I still have no MDM agent. Any thoughts on what to try next?
Ok, I made some progress. I attempted to install the agent on a non-domain joined computer. This computer also had my "work account" Office 365 account logged in (I only use office, we don't have any MDM features available/enabled.) I removed this account from the computer and I was then able to install the fleet agent and it does show up in my fleetdm server instance with the MDM status "On" as well as shows the URL for my MDM server. So it appears that my issue is either related to being domain-joined, and/or the work account Office 365 login.
15 Views
Open in Slack
PreviousNext
Powered by