Fixed a bug where fleetd could not start on-demand Windows MDM session

[getvictor]

Related issue: Resolves #48760

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

Testing

• Added/updated automated tests
• QA'd all new/changed functionality manually

fleetd/orbit/Fleet Desktop

Note: changes are Windows only; only verified/tested these items for Linux and Windows

• Verified compatibility with the latest released version of Fleet (see Must rule)
• If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes
• Verified that fleetd runs on macOS, Linux and Windows
• Verified auto-update works from the released version of component to the new version (see tools/tuf/test)

Summary by CodeRabbit

• Bug Fixes
  • Fixed an issue where some Windows MDM enrollment sessions could stay queued or fail to start on certain devices.
  • Improved detection of active Windows MDM enrollment, helping commands run more reliably when enrollment is already present.
• Tests
  • Added coverage for Windows enrollment detection to prevent regressions.

[getvictor]

@coderabbitai full review

[getvictor]

/agentic_review

[coderabbitai]

✅ Action performed

Full review finished.

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

This PR fixes Windows on-demand MDM sync startup failures on newer Windows builds by broadening how orbit identifies Fleet’s MDM enrollment in the registry (accepting non-zero EnrollmentState values like 3, instead of only 1).

Changes:

• Replace the hard-coded EnrollmentState == 1 check with a helper that treats any non-zero enrollment state as enrolled, while still scoping by ProviderID == Fleet and validating the subkey GUID format.
• Centralize the enrollment GUID validation regex + matching logic in a shared helper (isActiveFleetEnrollment).
• Add unit tests covering accepted/rejected enrollment states and malformed registry subkey names.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
orbit/pkg/update/execwinapi.go	Adds shared helper (isActiveFleetEnrollment) and GUID validation used to identify Fleet’s Windows MDM enrollment.
orbit/pkg/update/execwinapi_windows.go	Updates registry scanning logic to use the new helper, allowing non-zero EnrollmentState values.
orbit/pkg/update/execwinapi_test.go	Adds unit tests validating the new enrollment-selection rules (including state 3).
changes/48760-windows-mdm-enrollment-state	User-visible change entry (content excluded from review per policy).

Files excluded by content exclusion policy (1)

• changes/48760-windows-mdm-enrollment-state

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Walkthrough

Changes

This change fixes Windows MDM on-demand enrollment detection in fleetd. A new isActiveFleetEnrollment helper and WindowsMDMEnrollmentArgs struct are added to orbit/pkg/update/execwinapi.go, checking that the SyncML provider ID equals Fleet's constant, the enrollment state is non-zero (not "unknown"), and the registry subkey name matches a GUID format. execwinapi_windows.go is updated to delegate its enrollment-matching logic in fleetMDMEnrollmentGUID to this helper, removing the previously hardcoded active-state check and inline GUID regex. A new unit test validates the helper across active, inactive, and malformed input cases. A changelog entry documents the fix.

Related issues: #48760 — Windows on-demand MDM sync fails when the Fleet enrollment EnrollmentState is 3

Suggested labels: bug, orbit, mdm, windows

Suggested reviewers: (based on ownership of orbit/pkg/update package; none specified in provided context)

🐰 A registry key with state of three,
once left commands stuck, pending endlessly,
now any nonzero state will do,
Fleet's GUID found, the sync goes through! 🔑

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes broaden Fleet enrollment detection for Windows MDM as requested in #48760, while keeping the Fleet provider filter.
Out of Scope Changes check	✅ Passed	The added helper, test, and changes file all support the Windows MDM enrollment-state fix and do not appear unrelated.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title matches the main change: fixing fleetd's on-demand Windows MDM session startup bug.
Description check	✅ Passed	The description includes the related issue, changes file, tests, and platform notes required by the template.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch victor/48760-windows-mdm-enrollment-state

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.03%. Comparing base (9921d7d) to head (e40b1d8).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #48765      +/-   ##
==========================================
+ Coverage   68.02%   68.03%   +0.01%     
==========================================
  Files        3680     3681       +1     
  Lines      233959   233970      +11     
  Branches    12456    12456              
==========================================
+ Hits       159145   159178      +33     
+ Misses      60496    60481      -15     
+ Partials    14318    14311       -7     

Flag	Coverage Δ
backend	69.68% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[ksykulev]

non-blocking comment.

[ksykulev]

This import used to be a dependency of windows only (//go:build windows). This makes syncml a dependency of the orbit update package on all platforms.

[getvictor]

@ksykulev nice catch.

I checked the dependencies and we are already pulling it in via: server/fleet → server/mdm/microsoft/syncml
So, there is no new dependency or binary-size impact.