Frontend: Windows managed local account - #50241
Merged
Merged
Conversation
…managed-local-account
Adds the server half of the Windows managed local admin account device flow: the orbit notification that tells fleetd to create the account, the orbit escrow endpoint that stores the device-generated password, and the host-facing endpoint changes that let admins retrieve a Windows password. - Migration: make host_managed_local_account_passwords.command_uuid nullable (Windows rows have no MDM command). - Capability windows_managed_local_account, advertised by Windows fleetd. - Notification create_windows_managed_local_account, gated on ESP phase, the team/No-team setting, the capability, and premium license. - Escrow endpoint POST /api/fleet/orbit/managed_local_account: verifies the host's Windows MDM enrollment, stores the password (verified, NULL command_uuid), and logs the created activity. Per OpenSpec it does not reject when the setting/license changed after the notification, to avoid orphaning the on-device account. - Host endpoints: retrieval and detail response support Windows without arming the auto-rotate timer; rotation stays macOS-only.
…8721-windows-mla-server # Conflicts: # server/datastore/mysql/schema.sql
juan-fdz-hawa
left a comment
juan-fdz-hawa
left a comment
Contributor
There was a problem hiding this comment.
Done with the first pass
Member
Author
|
@juan-fdz-hawa Thank you for the detailed review. I made changes for all of your comments. And also added error reporting to the tooltip so errors are visible to admin. |
juan-fdz-hawa
approved these changes
Aug 6, 2026
2 tasks
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue: Resolves #48722
Demo: https://www.youtube.com/watch?v=zm5WmJY-o4Y
Checklist for submitter
If some of the following don't apply, delete the relevant line.
changes/,orbit/changes/oree/fleetd-chrome/changes.Testing
Summary by CodeRabbit
New Features
fleetd1.60.0 or later.Improvements