From d2e08e85bc39aa4e088897c3bc6635f9bef040d9 Mon Sep 17 00:00:00 2001
From: riccardom <riccardomanfrin@gmail.com>
Date: Wed, 15 Jul 2026 14:37:23 +0200
Subject: [PATCH] Aligns netbird repo MDM templates

---
 docs/io.netbird.client.plist    |   3 +++
 docs/netbird-macos.mobileconfig |   2 ++
 docs/netbird-macos.sh           |   2 ++
 docs/netbird-policy.reg         | Bin 1490 -> 1558 bytes
 docs/netbird.adml               |   3 +++
 docs/netbird.admx               |  12 ++++++++++++
 6 files changed, 22 insertions(+)

diff --git a/docs/io.netbird.client.plist b/docs/io.netbird.client.plist
index 800ecead1..fe10b5b63 100644
--- a/docs/io.netbird.client.plist
+++ b/docs/io.netbird.client.plist
@@ -66,6 +66,9 @@
     <key>disableAutoConnect</key>
     <false/>
 
+    <key>disableAutostart</key>
+    <false/>
+
     <key>disableClientRoutes</key>
     <false/>
 
diff --git a/docs/netbird-macos.mobileconfig b/docs/netbird-macos.mobileconfig
index 9bf616094..8216dd55d 100644
--- a/docs/netbird-macos.mobileconfig
+++ b/docs/netbird-macos.mobileconfig
@@ -103,6 +103,8 @@
                                 <!--
                                 <key>disableAutoConnect</key>
                                 <false/>
+                                <key>disableAutostart</key>
+                                <false/>
                                 <key>disableClientRoutes</key>
                                 <false/>
                                 <key>disableServerRoutes</key>
diff --git a/docs/netbird-macos.sh b/docs/netbird-macos.sh
index 2777b407c..e40efd80d 100644
--- a/docs/netbird-macos.sh
+++ b/docs/netbird-macos.sh
@@ -58,6 +58,7 @@ preSharedKey="$NULL"                       # secret; redacted in log
 allowServerSSH='true'
 blockInbound="$NULL"
 disableAutoConnect="$NULL"
+disableAutostart="$NULL"
 disableClientRoutes="$NULL"
 disableServerRoutes="$NULL"
 disableMetricsCollection="$NULL"
@@ -155,6 +156,7 @@ main() {
   is_set "$allowServerSSH"            && emit_bool    allowServerSSH            "$allowServerSSH"
   is_set "$blockInbound"              && emit_bool    blockInbound              "$blockInbound"
   is_set "$disableAutoConnect"        && emit_bool    disableAutoConnect        "$disableAutoConnect"
+  is_set "$disableAutostart"          && emit_bool    disableAutostart          "$disableAutostart"
   is_set "$disableClientRoutes"       && emit_bool    disableClientRoutes       "$disableClientRoutes"
   is_set "$disableServerRoutes"       && emit_bool    disableServerRoutes       "$disableServerRoutes"
   is_set "$disableMetricsCollection"  && emit_bool    disableMetricsCollection  "$disableMetricsCollection"
diff --git a/docs/netbird-policy.reg b/docs/netbird-policy.reg
index 83d07c9b00404570e9aa8eac3b4ab71e4b149240..7c5090942ca129eaf04a2576746c84340c577e61 100644
GIT binary patch
delta 30
mcmcb_J&k9B7SrShj2xWB3?&SS3`GnjlO359H%l<>Vg>+@iwKYa

delta 12
TcmbQnbBTL{7SrZDrWMQp9dQII

diff --git a/docs/netbird.adml b/docs/netbird.adml
index 69bb86e4b..74312ebba 100644
--- a/docs/netbird.adml
+++ b/docs/netbird.adml
@@ -24,6 +24,9 @@
       <string id="DisableAutoConnect_Name">Disable auto-connect</string>
       <string id="DisableAutoConnect_Help">When enabled, the NetBird tunnel does not auto-connect at daemon startup. Equivalent to --disable-auto-connect.</string>
 
+      <string id="DisableAutostart_Name">Disable autostart</string>
+      <string id="DisableAutostart_Help">When enabled, the NetBird GUI is prevented from registering itself as an OS login-item on fresh installs, and any existing OS login-item registration is removed on the next GUI launch (Windows Registry Run key, macOS Login Item, Linux .desktop). Once the admin lifts the policy, the setting stays off until the user re-enables it in Settings.</string>
+
       <string id="DisableClientRoutes_Name">Disable client routes</string>
       <string id="DisableClientRoutes_Help">When enabled, this client will not consume routes advertised by routing peers. Equivalent to --disable-client-routes.</string>
 
diff --git a/docs/netbird.admx b/docs/netbird.admx
index 1a53a3b64..747447085 100644
--- a/docs/netbird.admx
+++ b/docs/netbird.admx
@@ -64,6 +64,18 @@
       <disabledValue><decimal value="0" /></disabledValue>
     </policy>
 
+    <policy name="DisableAutostart"
+            class="Machine"
+            displayName="$(string.DisableAutostart_Name)"
+            explainText="$(string.DisableAutostart_Help)"
+            key="Software\Policies\NetBird"
+            valueName="DisableAutostart">
+      <parentCategory ref="NetBird" />
+      <supportedOn ref="SUPPORTED_NetBird_All" />
+      <enabledValue><decimal value="1" /></enabledValue>
+      <disabledValue><decimal value="0" /></disabledValue>
+    </policy>
+
     <policy name="DisableClientRoutes"
             class="Machine"
             displayName="$(string.DisableClientRoutes_Name)"