Open to using the integrated MDM client on Windows?

[ringods]

Hello @doncicuto, I notice you default to using NATS between the different components, including the Agent. I would prefer to fall back to using the integrated MDM client available in Windows 10/11 (except Home edition) and macOS/iOS systems.

Using your own agent makes for another attack vector in the remote management of systems. Defaulting to the integrated MDM client lets you focus on the server side. Would you be open to evolve your architecture to support this?

[doncicuto]

Hello @ringods, I'm totally open and I'd like to thank you for opening this discussion.

When I started designing OpenUEM and its agent I wanted to offer the features that as a sysadmin found interesting (remote assistance, file browsing, package installation, inventory information) but my intention is always to try to use things that are already in the OS like WinGet for Windows, Flatpack/Snap for Linux, and so on...

My agent, right now, offers many features that require privileges so it was a concern to me from the beginning that some orgs would have a scenario where ops would feel less confortable so I had on my mind a lite version that would offer less features but that could be integrated with the architecture. Not every org need all the features that offer OpenUEM so a flexible solution is better.

Next week, I'm starting a new two-week sprint, so I'm ready to investigate more about the MDM client and how I can integrate it with OpenUEM. I'll use the discussion here to share my thoughts, and please do share with me any suggestions and ideas that you may have on this subject.

Again, thanks for taking the time to evaluate OpenUEM

[doncicuto]

I'd like to say, that I've been browsing Microsoft's documentation to support MDM. I've created a private repo to start building the APIs to integrate with Microsoft's MDM client. There are still some things that I cannot grasp but I'll update this discussion as new progress is made

[cyber-armor]

Ability to use native MDM capabilities would be great indeed for both Windows and MacOS. It may allow the project to extend to mobile devices as well, but we need to be careful with required microsoft licensing ...

[ringods]

@cyber-armor Required Microsoft licensing? Do drop any pointers here why you think that requires additional licensing.

Technically, except for Windows Home editions, all other Windows editions come with the MDM agent installed.

[doncicuto]

I think that the issue is not with the agents but if somehow OpenUEM requires to sign any kind of legal agreement so the Windows MDM agents would use OpenUEM. I started to review docs about how to implement the API for MDM (extremely heavy, but doable with time I hope) but I haven't found anything about legal/license information about it