I got it working on a test VM (haven't tested the live systems again), but now the question is why it isn't showing up in controls. Is this because I'm on free and don't have teams? 🤔

Hi Matt,Thanks for your feedback, and I'm glad you managed to figure out what was going on.Providing an exact failure for a configuration profile is interesting, but could be tricky. The underlying MDM protocol doesn't always return a full reason for the failure. Often just an error code.As you were working with Windows MDM, I'll stick to that as an example. If a config profile has failed, you'll be able to see that from the Controls > OS Settings page. Clicking on the failed count will show you the hosts it's failed on, which you can select and go to.Once you're on a host details page, you'll see the status. Selecting that will give you the overview box, and any failures will have returned an error code. Only have a verified example for now, sorry! A common one for Windows is 400: (Bad request. The requested command couldn't be performed because of malformed syntax.) You can then look up the relevant failure code for the platform: https://learn.microsoft.com/en-us/windows/client-management/oma-dm-protocol-support#syncml-response-status-codesThe stuck verifying is an odd one. This means that Fleet has sent in the command, but is waiting for confirmation. If the host doesn't acknowledge, or the verification fails, it's possible it could remain in verifying. We are aware of some oddities for profiles that generally use the chr format: https://github.com/fleetdm/fleet/issues/33731 - Sometimes you have to adjust the formatting of the data to get it to behave. I hope that makes sense and clears up a way to see how and why a profile failed from the UI. If you'd like to see changes to the UI, we'd welcome a feature request: https://github.com/fleetdm/fleet/issuesPlease let me know if you have any more questions! Gray

Hey Grey, what you're saying makes sense thus far. This is my first dive into MDM so I can definitely understand limitations from the system. For the host status, are you implying that the "Status: Online" should be clickable? Since I'm stuck in verifying I may be missing a couple clickable items. Should clarify that I'm selfhosting and on the free version, would love to get the premium but just can't justify the cost for it as it's for a small business that just happens to need like 4 machines so minimum $28 is a bit steep for that at the moment haha. As for the verifying I'm also a bit confused on it, to test it I took a subset rule from https://fleetdm.com/example-windows-profile Which was:

<Replace>
  <!-- Enforce screenlock after 15 minutes -->
  <Item>
    <Meta>
      <Format xmlns="syncml:metinf">int</Format>
    </Meta>
    <Target>
      <LocURI>./Device/Vendor/MSFT/Policy/Config/DeviceLock/MaxInactivityTimeDeviceLock</LocURI>
    </Target>
    <Data>15</Data>
  </Item>
</Replace>

and even right now, they're all still verifying. I was using this as a test case so I could dive more into them.

Hey Matt, just in another call right now. I'll take a look at that profile on my test instance as soon as I'm done! 🙂

No rush at all! It's free support on a free user, any help at all if always appreciated. I'll be more than happy to provide anything you need. I'm semi-technical and have full access to the underlying instance (I was just attachedto the MySQL docker container querying the tables trying to see what was going on).

Sorry, should have been clearer about where to click! On the host details page, you'll see this part says Pending/Verifying/Verified/Failed. Click on that will give you a few more details if it's failed. Like the error code. Ah yes, many things to deploy config profiles require at least Pro. The cost really can add up with all the licensing! You can always grab yourself a Pro ISO from https://www.microsoft.com/en-gb/software-download/windows11 to actually test the profiles work 🙂

I'm coming back to this now, @Gray Williams would you care to share which version of FleetDM you're using? Mine does not look like that.

Thanks for doing that Matt. My test instance does indeed have premium enabled. I'll see if I can spin up another one and reproduce what you're seeing. I'll keep an eye on the issue, too.

Sounds good, thank you for all your help Gray! wouldn't have found the bug if it wasn't for you! Went ahead and added a PR too: https://github.com/fleetdm/fleet/pull/34808