mirror of
https://github.com/netbirdio/docs.git
synced 2026-09-26 16:59:04 +02:00
riccardom
ecd28745e9
The downloadable MDM templates referenced sibling files with a `docs/` prefix that does not exist from the reader's point of view: the files are served flat under /docs-static/files/, and admins download them individually. Reference them by plain filename instead, and point the plist at the public docs URL rather than the .mdx source path. Also drop two internal-only details that leaked into public templates (the "Phase 2"/"Phase 5" roadmap markers) and fix netbird-macos.mobileconfig, which was not well-formed XML: the header comment contained `--` (`productsign --sign`), which XML 1.0 forbids inside a comment.
99 lines
3.6 KiB
PowerShell
99 lines
3.6 KiB
PowerShell
#requires -Version 5.1
|
|
<#
|
|
.SYNOPSIS
|
|
Push the NetBird MDM policy to a Windows device via JumpCloud Commands
|
|
by importing a sidecar netbird-policy.reg file.
|
|
|
|
.DESCRIPTION
|
|
Windows counterpart of netbird-macos.sh. Outcome:
|
|
HKLM\Software\Policies\NetBird populated from the attached
|
|
netbird-policy.reg file, daemon picks up the change via the
|
|
1-minute MDM reload ticker.
|
|
|
|
Deployment:
|
|
1. Admin Console -> Device Management -> Commands -> +.
|
|
2. Type: Windows PowerShell. Run as: SYSTEM.
|
|
3. Paste this file verbatim into the command body.
|
|
4. In the same command, attach `netbird-policy.reg` as a file.
|
|
JumpCloud copies attached files into the command's working
|
|
directory before invoking the script, so `$PSScriptRoot` or
|
|
Get-Location resolves to where the .reg lives.
|
|
5. Bind to the target system group, save, run.
|
|
|
|
Producing the .reg file:
|
|
On a reference machine, after configuring the policy values either
|
|
via gpedit (GPO) or manual `reg add`, export with:
|
|
|
|
reg export "HKLM\Software\Policies\NetBird" netbird-policy.reg /y
|
|
|
|
Then attach the resulting file to the JumpCloud command.
|
|
|
|
Semantics:
|
|
- The script nukes the existing HKLM\Software\Policies\NetBird key
|
|
before importing the .reg, so the .reg is the SINGLE SOURCE OF
|
|
TRUTH. Any value present in the registry but absent from the .reg
|
|
is removed. This is what an MDM admin almost always wants.
|
|
- Setting the .reg to an empty (header-only) file effectively unsets
|
|
the policy.
|
|
|
|
Idempotency: re-running the script with the same .reg is a no-op from
|
|
the daemon's perspective (values identical → 1-min ticker sees no
|
|
diff → engine not restarted).
|
|
|
|
Exit codes: 0 = success; 1 = .reg missing or reg.exe error.
|
|
#>
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
$RegFileName = "netbird-policy.reg"
|
|
$RegKey = "HKLM\Software\Policies\NetBird"
|
|
|
|
# Resolve the attached .reg file: JumpCloud copies command attachments
|
|
# into C:\Windows\Temp\ before invoking the script. Cwd / $PSScriptRoot
|
|
# fallbacks cover the local-dev case where you might dot-source this
|
|
# from elsewhere.
|
|
$candidates = @(
|
|
(Join-Path "$env:WINDIR\Temp" $RegFileName)
|
|
(Join-Path (Get-Location) $RegFileName)
|
|
(Join-Path $PSScriptRoot $RegFileName)
|
|
) | Where-Object { Test-Path $_ }
|
|
|
|
if ($candidates.Count -eq 0) {
|
|
Write-Error "[netbird-mdm] $RegFileName not found in working directory or `$PSScriptRoot. Attach the file to the JumpCloud command."
|
|
exit 1
|
|
}
|
|
$regFile = $candidates[0]
|
|
Write-Host "[netbird-mdm] using $regFile"
|
|
|
|
# Wipe the existing policy key so the .reg is authoritative.
|
|
$existed = Test-Path "Registry::HKEY_LOCAL_MACHINE\Software\Policies\NetBird"
|
|
if ($existed) {
|
|
& reg.exe delete $RegKey /f | Out-Null
|
|
if ($LASTEXITCODE -ne 0) {
|
|
Write-Error "[netbird-mdm] failed to clear $RegKey before import (exit $LASTEXITCODE)"
|
|
exit 1
|
|
}
|
|
Write-Host "[netbird-mdm] cleared previous values under $RegKey"
|
|
}
|
|
|
|
# Import. reg.exe writes both data and (re-)creates the key if needed.
|
|
& reg.exe import $regFile
|
|
if ($LASTEXITCODE -ne 0) {
|
|
Write-Error "[netbird-mdm] reg import failed (exit $LASTEXITCODE)"
|
|
exit 1
|
|
}
|
|
|
|
# Audit dump so the JumpCloud per-execution log captures the applied state.
|
|
Write-Host "[netbird-mdm] final policy state under $RegKey :"
|
|
if (Test-Path "Registry::$RegKey") {
|
|
& reg.exe query $RegKey /s
|
|
} else {
|
|
Write-Host "[netbird-mdm] no policy values present under $RegKey"
|
|
}
|
|
|
|
# Daemon's 1-min reload ticker picks up the change automatically.
|
|
# Uncomment to force immediate convergence (skips the ticker wait):
|
|
# Restart-Service netbird -Force -ErrorAction SilentlyContinue
|
|
|
|
exit 0
|