Hi all - I would like to see about rotating our FleetDM (community edition) enrollment key - what would be the best way to go about that?

Hi @Mike S.! You can add your new enrollment secret, then deploy a new version of fleetd (or update your osquery flags if using plain osquery) with the new secret. Once all hosts have the new secret in place, delete the existing one.

Hi @Kathy Satterlee! Just to make sure I've got the process right in my head here: 1. Add a new secret in the FleetDM web UI 2. Create new MSI/DEB/PKG installers using FleetCTL 3. Deploy the packages to the workstations using the method I've been using (script using Workspace One) 4. Once that's good, delete the old enroll secret. Would I need to uninstall the existing packages, or can I just install over them?

That looks spot on, @Mike S.. You should be fine to install over the existing package.

Awesome, thank you!

By default, the enroll secret is moved to keychain on Mac or the Credential store on Windows, which is not able to be queried. With Linux, it's written in

/opt/orbit/secret.txt

If you are using Fleet as an MDM for Apple devices, and you rotate the enrolment token how does it effect subsequent SCEP renewals, since it looks like the enrolment token is used as the challenge password?

I don't believe that's the case @f487hf, taking a look at that.