From accc461a7ec724b5817ae9318e44c1c998f522ac Mon Sep 17 00:00:00 2001
From: Riccardo Manfrin <3090891+riccardomanfrin@users.noreply.github.com>
Date: Wed, 22 Jul 2026 11:53:01 +0200
Subject: [PATCH] Add Mdm auto start flag doc (#855)

* MDM disableAutoStart flag

* Added note on desktop only mode
---
 .../docs-static/files/io.netbird.client.plist |   3 +++
 .../files/netbird-macos.mobileconfig          |   2 ++
 public/docs-static/files/netbird-macos.sh     |   2 ++
 public/docs-static/files/netbird-policy.reg   | Bin 1418 -> 1486 bytes
 public/docs-static/files/netbird.adml         |   3 +++
 public/docs-static/files/netbird.admx         |  12 ++++++++++++
 src/pages/client/mdm-integration.mdx          |   6 ++++++
 7 files changed, 28 insertions(+)

diff --git a/public/docs-static/files/io.netbird.client.plist b/public/docs-static/files/io.netbird.client.plist
index f42b6b3d..ed87c71d 100644
--- a/public/docs-static/files/io.netbird.client.plist
+++ b/public/docs-static/files/io.netbird.client.plist
@@ -66,6 +66,9 @@
     <key>disableAutoConnect</key>
     <false/>
 
+    <key>disableAutostart</key>
+    <false/>
+
     <key>disableClientRoutes</key>
     <false/>
 
diff --git a/public/docs-static/files/netbird-macos.mobileconfig b/public/docs-static/files/netbird-macos.mobileconfig
index 53453db5..d5b54e73 100644
--- a/public/docs-static/files/netbird-macos.mobileconfig
+++ b/public/docs-static/files/netbird-macos.mobileconfig
@@ -103,6 +103,8 @@
                                 <!--
                                 <key>disableAutoConnect</key>
                                 <false/>
+                                <key>disableAutostart</key>
+                                <false/>
                                 <key>disableClientRoutes</key>
                                 <false/>
                                 <key>disableServerRoutes</key>
diff --git a/public/docs-static/files/netbird-macos.sh b/public/docs-static/files/netbird-macos.sh
index c36c409e..d22ea45f 100644
--- a/public/docs-static/files/netbird-macos.sh
+++ b/public/docs-static/files/netbird-macos.sh
@@ -58,6 +58,7 @@ preSharedKey="$NULL"                       # secret; redacted in log
 allowServerSSH='true'
 blockInbound="$NULL"
 disableAutoConnect="$NULL"
+disableAutostart="$NULL"
 disableClientRoutes="$NULL"
 disableServerRoutes="$NULL"
 disableMetricsCollection="$NULL"
@@ -167,6 +168,7 @@ main() {
   is_set "$allowServerSSH"            && emit_bool    allowServerSSH            "$allowServerSSH"
   is_set "$blockInbound"              && emit_bool    blockInbound              "$blockInbound"
   is_set "$disableAutoConnect"        && emit_bool    disableAutoConnect        "$disableAutoConnect"
+  is_set "$disableAutostart"          && emit_bool    disableAutostart          "$disableAutostart"
   is_set "$disableClientRoutes"       && emit_bool    disableClientRoutes       "$disableClientRoutes"
   is_set "$disableServerRoutes"       && emit_bool    disableServerRoutes       "$disableServerRoutes"
   is_set "$disableMetricsCollection"  && emit_bool    disableMetricsCollection  "$disableMetricsCollection"
diff --git a/public/docs-static/files/netbird-policy.reg b/public/docs-static/files/netbird-policy.reg
index ba4402e50f956facd45f368b214ee6fbfc6dcf39..074e42d485cb3d87a8bb019042652f3838144e93 100644
GIT binary patch
delta 34
qcmeC;KF7U5i)r!$Mh?zmh7yKEh9ZWN$&O5llbx7_Hfu2@FarRvL<u1P

delta 12
TcmX@d-Nn5@i)nKnQvx#p9Hs-&

diff --git a/public/docs-static/files/netbird.adml b/public/docs-static/files/netbird.adml
index d49b0502..8a62ff04 100644
--- a/public/docs-static/files/netbird.adml
+++ b/public/docs-static/files/netbird.adml
@@ -24,6 +24,9 @@
       <string id="DisableAutoConnect_Name">Disable auto-connect</string>
       <string id="DisableAutoConnect_Help">When enabled, the NetBird tunnel does not auto-connect at daemon startup. Equivalent to --disable-auto-connect.</string>
 
+      <string id="DisableAutostart_Name">Disable autostart</string>
+      <string id="DisableAutostart_Help">When enabled, the NetBird GUI is prevented from registering itself as an OS autostart entry on fresh installs, and any existing OS autostart entry registration is removed on the next GUI launch (Windows Registry Run key, macOS Login Item, Linux .desktop). Once the admin lifts the policy, the setting stays off until the user re-enables it in Settings.</string>
+
       <string id="DisableClientRoutes_Name">Disable client routes</string>
       <string id="DisableClientRoutes_Help">When enabled, this client will not consume routes advertised by routing peers. Equivalent to --disable-client-routes.</string>
 
diff --git a/public/docs-static/files/netbird.admx b/public/docs-static/files/netbird.admx
index 2f7645d6..ddeacc17 100644
--- a/public/docs-static/files/netbird.admx
+++ b/public/docs-static/files/netbird.admx
@@ -64,6 +64,18 @@
       <disabledValue><decimal value="0" /></disabledValue>
     </policy>
 
+    <policy name="DisableAutostart"
+            class="Machine"
+            displayName="$(string.DisableAutostart_Name)"
+            explainText="$(string.DisableAutostart_Help)"
+            key="Software\Policies\NetBird"
+            valueName="DisableAutostart">
+      <parentCategory ref="NetBird" />
+      <supportedOn ref="SUPPORTED_NetBird_All" />
+      <enabledValue><decimal value="1" /></enabledValue>
+      <disabledValue><decimal value="0" /></disabledValue>
+    </policy>
+
     <policy name="DisableClientRoutes"
             class="Machine"
             displayName="$(string.DisableClientRoutes_Name)"
diff --git a/src/pages/client/mdm-integration.mdx b/src/pages/client/mdm-integration.mdx
index 7d1976c4..2173fc4b 100644
--- a/src/pages/client/mdm-integration.mdx
+++ b/src/pages/client/mdm-integration.mdx
@@ -71,6 +71,7 @@ PascalCase variant in the Group Policy Editor — both are recognized.
 | `wireguardPort` | integer | UDP port the local WireGuard interface binds to. Range `1–65535`. |
 | `allowServerSSH` | boolean | Allow the embedded NetBird SSH server on this peer. |
 | `disableAutoConnect` | boolean | Skip auto-connecting on startup; require an explicit `netbird up`. |
+| `disableAutostart` | boolean | Prevent the GUI from registering itself as an OS autostart entry on fresh installs, and — when enabled at any later point — remove an existing registration on the next GUI launch (Windows Registry `Run` key, macOS Login Item, Linux `.desktop`). Desktop GUIs only; no-op on iOS/Android. Once the admin lifts the policy, the setting stays off until the user re-enables it in Settings. |
 | `rosenpassEnabled` | boolean | Turn on the post-quantum Rosenpass key exchange. |
 | `rosenpassPermissive` | boolean | Permissive mode for Rosenpass (interop with non-Rosenpass peers). |
 | `blockInbound` | boolean | Drop all inbound traffic except established/related — kill-switch style. |
@@ -96,6 +97,11 @@ PascalCase variant in the Group Policy Editor — both are recognized.
   `VpnService.Builder.addAllowedApplication()` flow; on Windows and
   macOS the daemon parses the keys but ignores them. They are safe to
   ship in a cross-platform payload.
+- `disableAutostart` only affects the desktop GUI's OS autostart entry
+  (Windows Registry `Run` key, macOS Login Item, Linux `.desktop`).
+  iOS and Android have no equivalent user-space autostart mechanism —
+  the daemon runs as a system service — so the key is parsed and
+  ignored there. Safe to ship in cross-platform payloads.
 - The `disableMetricsCollection` key is reserved for an upcoming
   metrics integration; the client recognizes it today but no metrics
   pipeline is shipped yet.