https://github.com/osquery/osquery logo
Join Slack
Powered by
Hi all! Is there a way to leverage osquery to see ...
# fleet
b
Hi all! Is there a way to leverage osquery to see when/why a MacOS device had it's MDM profiles removed? I had a device this morning un-enroll itself from the Fleet MDM profile it had configured and I can't find out why. There is no log in Fleet of MDM being disabled that I can tell
r
@Billy H Was the device offline for a long span of time?
b
Maybe 48 hours from the weekend but otherwise nope! User was online and working just fine last week
The only reason we noticed was because his EDR solution showed a bunch of alerts that it didn't have proper permissions when he booted up this morning. (not alerts of intrusion or anything like that)
And users are not admins so I don't think the user removed it themself
r
@Billy H Is there anything in the global Activity Feed that relates to this enrollment removal?
b
Nope! I can see where we added it back in
r
@Billy H Do you have anything set in your Agent Options that would adjust the host_expiry_settings, specifically the 
host_expiry_window
?
b
Lemme check
I do not!
r
@Billy H What version of Fleet are you running? What version of OS did the device update to?
b
Device updated to 15.3 but I'm not 100% sure that happened over the weekend. I'm on version 4.62.2
r
@Billy H Can you share the fleetd logs and see if there are any relevant errors?
b
Unfortunately, it seems that the fleetd logs for the machine only catch the re-enrollment. Nothing before the re-enrollment
Wait I'm sorry I was reading the log incorrectly
Sorry for the delay, this error showed up a lot over the weekend that the MDM was removed 
The application cannot be opened for an unexpected reason, error=*Error* Domain=RBSRequestErrorDomain Code=5 "Launch failed." UserInfo={NSLocalizedFailureReason=Launch failed., NSUnderlyingError=0x60000175cbd0 {*Error* Domain=OSLaunchdErrorDomain Code=112 "Could not find specified domain" UserInfo={NSLocalizedFailureReason=Could not find specified domain}}}
Otherwise I don't see anything else in the log that would be related to this
r
@Billy H Have you rebooted Fleet since this error first started? What OS version are you on?
2 Views
Open in Slack
PreviousNext
Powered by