Fixed a bug where fleetd could not start on-demand Windows MDM session by getvictor · Pull Request #48765 · fleetdm/fleet

getvictor · 2026-07-06T14:58:21Z

Related issue: Resolves #48760

Checklist for submitter

If some of the following don't apply, delete the relevant line.

Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
See Changes files for more information.

Testing

Added/updated automated tests
QA'd all new/changed functionality manually

fleetd/orbit/Fleet Desktop

Note: changes are Windows only; only verified/tested these items for Linux and Windows

Verified compatibility with the latest released version of Fleet (see Must rule)
If the change applies to only one platform, confirmed that runtime.GOOS is used as needed to isolate changes
Verified that fleetd runs on macOS, Linux and Windows
Verified auto-update works from the released version of component to the new version (see tools/tuf/test)

Summary by CodeRabbit

Bug Fixes
- Fixed an issue where some Windows MDM enrollment sessions could stay queued or fail to start on certain devices.
- Improved detection of active Windows MDM enrollment, helping commands run more reliably when enrollment is already present.
Tests
- Added coverage for Windows enrollment detection to prevent regressions.

getvictor · 2026-07-06T14:58:34Z

@coderabbitai full review

getvictor · 2026-07-06T14:58:39Z

/agentic_review

coderabbitai · 2026-07-06T14:58:39Z

✅ Action performed

Full review finished.

Copilot

Warning

Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

This PR fixes Windows on-demand MDM sync startup failures on newer Windows builds by broadening how orbit identifies Fleet’s MDM enrollment in the registry (accepting non-zero EnrollmentState values like 3, instead of only 1).

Changes:

Replace the hard-coded EnrollmentState == 1 check with a helper that treats any non-zero enrollment state as enrolled, while still scoping by ProviderID == Fleet and validating the subkey GUID format.
Centralize the enrollment GUID validation regex + matching logic in a shared helper (isActiveFleetEnrollment).
Add unit tests covering accepted/rejected enrollment states and malformed registry subkey names.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 2 comments.

File	Description
orbit/pkg/update/execwinapi.go	Adds shared helper (`isActiveFleetEnrollment`) and GUID validation used to identify Fleet’s Windows MDM enrollment.
orbit/pkg/update/execwinapi_windows.go	Updates registry scanning logic to use the new helper, allowing non-zero `EnrollmentState` values.
orbit/pkg/update/execwinapi_test.go	Adds unit tests validating the new enrollment-selection rules (including state `3`).
changes/48760-windows-mdm-enrollment-state	User-visible change entry (content excluded from review per policy).

Files excluded by content exclusion policy (1)

changes/48760-windows-mdm-enrollment-state

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

coderabbitai · 2026-07-06T15:04:06Z

Walkthrough

Changes

This change fixes Windows MDM on-demand enrollment detection in fleetd. A new isActiveFleetEnrollment helper and WindowsMDMEnrollmentArgs struct are added to orbit/pkg/update/execwinapi.go, checking that the SyncML provider ID equals Fleet's constant, the enrollment state is non-zero (not "unknown"), and the registry subkey name matches a GUID format. execwinapi_windows.go is updated to delegate its enrollment-matching logic in fleetMDMEnrollmentGUID to this helper, removing the previously hardcoded active-state check and inline GUID regex. A new unit test validates the helper across active, inactive, and malformed input cases. A changelog entry documents the fix.

Related issues: #48760 — Windows on-demand MDM sync fails when the Fleet enrollment EnrollmentState is 3

Suggested labels: bug, orbit, mdm, windows

Suggested reviewers: (based on ownership of orbit/pkg/update package; none specified in provided context)

🐰 A registry key with state of three,
once left commands stuck, pending endlessly,
now any nonzero state will do,
Fleet's GUID found, the sync goes through! 🔑

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes broaden Fleet enrollment detection for Windows MDM as requested in `#48760`, while keeping the Fleet provider filter.
Out of Scope Changes check	✅ Passed	The added helper, test, and changes file all support the Windows MDM enrollment-state fix and do not appear unrelated.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title matches the main change: fixing fleetd's on-demand Windows MDM session startup bug.
Description check	✅ Passed	The description includes the related issue, changes file, tests, and platform notes required by the template.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch victor/48760-windows-mdm-enrollment-state

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codecov · 2026-07-06T15:17:28Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.03%. Comparing base (9921d7d) to head (e40b1d8).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #48765      +/-   ##
==========================================
+ Coverage   68.02%   68.03%   +0.01%     
==========================================
  Files        3680     3681       +1     
  Lines      233959   233970      +11     
  Branches    12456    12456              
==========================================
+ Hits       159145   159178      +33     
+ Misses      60496    60481      -15     
+ Partials    14318    14311       -7

Flag	Coverage Δ
backend	`69.68% <100.00%> (+0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

claude

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

ksykulev

non-blocking comment.

ksykulev · 2026-07-06T20:29:46Z

+import (
+	"regexp"
+
+	"github.com/fleetdm/fleet/v4/server/mdm/microsoft/syncml"


This import used to be a dependency of windows only (//go:build windows). This makes syncml a dependency of the orbit update package on all platforms.

@ksykulev nice catch.

I checked the dependencies and we are already pulling it in via: server/fleet → server/mdm/microsoft/syncml
So, there is no new dependency or binary-size impact.

fleetdm#48765)  **Related issue:** Resolves fleetdm#48760 # Checklist for submitter If some of the following don't apply, delete the relevant line. - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## fleetd/orbit/Fleet Desktop Note: changes are Windows only; only verified/tested these items for Linux and Windows - [x] Verified compatibility with the latest released version of Fleet (see [Must rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md)) - [x] If the change applies to only one platform, confirmed that `runtime.GOOS` is used as needed to isolate changes - [x] Verified that fleetd runs on macOS, Linux and Windows - [x] Verified auto-update works from the released version of component to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))  ## Summary by CodeRabbit * **Bug Fixes** * Fixed an issue where some Windows MDM enrollment sessions could stay queued or fail to start on certain devices. * Improved detection of active Windows MDM enrollment, helping commands run more reliably when enrollment is already present. * **Tests** * Added coverage for Windows enrollment detection to prevent regressions.

Fixed a bug where fleetd could not start on-demand Windows MDM session

e40b1d8

getvictor requested a review from Copilot July 6, 2026 14:58

getvictor temporarily deployed to Docker Hub July 6, 2026 14:58 — with GitHub Actions Inactive

Copilot started reviewing on behalf of getvictor July 6, 2026 14:58 View session

Copilot AI reviewed Jul 6, 2026

View reviewed changes

Comment thread orbit/pkg/update/execwinapi.go

Comment thread orbit/pkg/update/execwinapi_windows.go

fleetdm deleted a comment from qodo-free-for-open-source-projects Bot Jul 6, 2026

getvictor marked this pull request as ready for review July 6, 2026 17:40

getvictor requested a review from a team as a code owner July 6, 2026 17:40

claude Bot reviewed Jul 6, 2026

View reviewed changes

getvictor assigned ksykulev Jul 6, 2026

ksykulev approved these changes Jul 6, 2026

View reviewed changes

getvictor merged commit 3aff550 into main Jul 7, 2026
60 checks passed

getvictor deleted the victor/48760-windows-mdm-enrollment-state branch July 7, 2026 07:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fixed a bug where fleetd could not start on-demand Windows MDM session#48765

Fixed a bug where fleetd could not start on-demand Windows MDM session#48765
getvictor merged 1 commit into
mainfrom
victor/48760-windows-mdm-enrollment-state

getvictor commented Jul 6, 2026 •

edited

Loading

Uh oh!

getvictor commented Jul 6, 2026

Uh oh!

getvictor commented Jul 6, 2026

Uh oh!

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 6, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

ksykulev left a comment

Uh oh!

ksykulev Jul 6, 2026

Uh oh!

getvictor Jul 7, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

getvictor commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist for submitter

Testing

fleetd/orbit/Fleet Desktop

Summary by CodeRabbit

Uh oh!

getvictor commented Jul 6, 2026

Uh oh!

getvictor commented Jul 6, 2026

Uh oh!

coderabbitai Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

codecov Bot commented Jul 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Claude Code Review

Uh oh!

ksykulev left a comment

Choose a reason for hiding this comment

Uh oh!

ksykulev Jul 6, 2026

Choose a reason for hiding this comment

Uh oh!

getvictor Jul 7, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

getvictor commented Jul 6, 2026 •

edited

Loading

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

coderabbitai Bot commented Jul 6, 2026 •

edited

Loading

codecov Bot commented Jul 6, 2026 •

edited

Loading