Test experimental fleetd package for Windows arm64

[lucasmrod]

Goal

User story
As a Fleet user,
I want Fleet to smoke test Fleet's agent (fleetd) on Windows Arm
so that I can be confident that I won't run into any bugs when I deploy fleetd to my Windows Arm hosts.

Key result

None. Prioritized customer request.

Original requests

• Native support (no emulation) for Windows Arm hosts #26060

Context

• Product Designer: @noahtalerman

In v4.67.0 we added the capability to build native Windows arm64 fleetd packages (fleetctl package --type=msi --arch=arm64 [...]).

We haven't run osquery natively on Windows arm64 and osquery doesn't document how to build for that platform and the osquery's download page lists the installer as "Alternative" and offers a link to Github to download.
We are documenting native Windows arm64 support as "experimental" until we can smoke test all fleetd functionality on such native package and platform.

Changes

Product

• UI changes: No changes
• CLI (fleetctl) usage changes: No changes
• YAML changes: No changes
• REST API changes: No changes
• Fleet's agent (fleetd) changes: No changes
• GitOps mode changes: No changes
• Activity changes: No changes
• Permissions changes: No changes
• Changes to paid features or tiers: No changes
• My device and fleetdm.com/better changes: No changes
• First draft of test plan added
• Other reference documentation changes: Pull the experimental callout out of the the "Enroll hosts" guide here: https://fleetdm.com/guides/enroll-hosts#advanced:~:text=Fleetd%20for%20Arm%20Windows%20is%20an%20experimental%20feature.%20This%20feature%20is%20undergoing%20rapid%20improvement%2C%20which%20may%20result%20in%20breaking%20changes%20to%20the%20API%20or%20configuration%20surface.%20It%20is%20not%20recommended%20for%20use%20in%20automated%20workflows
• Once shipped, requester has been notified
• Once shipped, dogfooding issue has been filed (N/A)

Engineering

• Test plan is finalized
• Contributor API changes: No changes
• Feature guide changes: No changes
• Database schema migrations: No changes
• Load testing: No changes

ℹ️  Please read this issue carefully and understand it. Pay special attention to UI wireframes, especially "dev notes".

QA

Risk assessment

• Requires load testing: No need
• Risk level: N/A this is a testing task
• Risk description: N/A

Test plan

Make sure to go through the list and consider all events that might be related to this story, so we catch edge cases earlier.

1. Build fleetd using fleetctl package --type=msi --arch=arm64 [...].
2. Install package on Windows 10/11 on a ARM64 machine/VM.
3. Smoke test all Windows osquery tables (by running live queries) and report if any of them causes a crash or other unexpected behavior. (It is a-ok if some columns or tables return empty or unexpected values.)
4. Smoke test policies, labels, and scheduled queries.
5. Smoke test fleetd management functionality like disk encryption, software ingestion and software installation, Windows configuration profiles, and scripts.

Testing notes

Confirmation

1. Engineer: Added comment to user story confirming successful completion of test plan.
2. QA: Added comment to user story confirming successful completion of test plan.

Windows ARM64 Test Checklist

Windows ARM64 Test Checklist

Queries

• Live queries
• Scheduled queries
• Policies

Scripts

• Manually run

MDM

• Enrollment
• Encrypt disk
• Lock/Unlock

Software

• FMA Google chrome

  Installed based on policy

  Installer ran and claimed to be a success, but could not find Chrome installed on device.

  Windows also reports that chrome is installed in the Installed Software section in the control panel, but Chrome doesn't appear in
  the start menu

  The output from the host_software_installs table:

  scription=Removing system registry values Key: [1], Name: [2],)
  MSI (s) (B0:60) [15:51:32:740]: Executing op: ProgressTotal(Total=2,Type=1,ByteEquivalent=13200)
  MSI (s) (B0:60) [15:51:32:740]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96},,BinaryType=0,,)
  MSI (s) (B0:60) [15:51:32:740]: Executing op: RegRemoveValue(Name=LastInstallerResultUIString,,)
  MSI (s) (B0:60) [15:51:32:749]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} 3: 2
  MSI (s) (B0:60) [15:51:32:749]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Google\Update,,BinaryType=0,,)
  MSI (s) (B0:60) [15:51:32:749]: Executing op: RegRemoveValue(Name=LastInstallerResultUIString,,)
  MSI (s) (B0:60) [15:51:32:749]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE32\SOFTWARE\Google\Update 3: 2
  MSI (s) (B0:60) [15:51:32:749]: Executing op: ActionStart(Name=ShowInstallerResultUIString,,)
  MSI (s) (B0:60) [15:51:32:749]: Executing op: CustomActionSchedule(Action=ShowInstallerResultUIString,ActionType=3329,Source=BinaryData,Target=ShowInstallerResultUIString,CustomActionData={8A69D345-D564-463c-AFF1-A69D9E530F96})
  MSI (s) (B0:60) [15:51:32:749]: Executing op: ActionStart(Name=DoInstall,,)
  MSI (s) (B0:60) [15:51:32:878]: Executing op: CustomActionSchedule(Action=DoInstall,ActionType=3074,Source=BinaryData,Target=--silent --install="appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&appname=Google Chrome&needsAdmin=True&brand=GCEA&ap=x64-stable" --installsource=enterprisemsi --appargs="appguid={8A69D345-D564-463c-AFF1-A69D9E530F96}&installerdata=%7B%22distribution%22%3A%7B%22msi%22%3Atrue%2C%22system_level%22%3Atrue%2C%22verbose_logging%22%3Atrue%2C%22msi_product_id%22%3A%2266793499-0B07-380D-8FDE-467BB6263225%22%2C%22allow_downgrade%22%3Afalse%7D%7D",)
  MSI (s) (B0:60) [15:51:41:351]: Executing op: ActionStart(Name=WriteRegistryValues,Description=Writing system registry values Key: [1], Name: [2], Value: [3],)
  MSI (s) (B0:60) [15:51:41:353]: Executing op: ProgressTotal(Total=1,Type=1,ByteEquivalent=13200)
  MSI (s) (B0:60) [15:51:41:353]: Executing op: RegOpenKey(Root=-2147483646,Key=SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96},,BinaryType=0,,)
  MSI (s) (B0:60) [15:51:41:353]: Executing op: RegAddValue(Name=EnterpriseProduct66793499-0B07-380D-8FDE-467BB6263225,Value=136.0.7103.93,)
  MSI (s) (B0:60) [15:51:41:353]: Executing op: ActionStart(Name=RegisterProduct,Description=Registering product [1],)
  MSI (s) (B0:60) [15:51:41:353]: Executing op: ChangeMedia(,MediaPrompt=Please insert the disk: ,,BytesPerTick=0,CopierType=0,,,,,,IsFirstPhysicalMedia=1)
  MSI (s) (B0:60) [15:51:41:353]: Executing op: DatabaseCopy(DatabasePath=C:\WINDOWS\Installer\4e05a.msi,ProductCode={66793499-0B07-380D-8FDE-467BB6263225},,,)
  MSI (s) (B0:60) [15:51:41:353]: Note: 1: 1402 2: UNKNOWN\Products\9943976670B0D083F8ED64B76B622352\InstallProperties 3: 2
  MSI (s) (B0:60) [15:51:41:353]: Note: 1: 2318 2: C:\WINDOWS\Installer\4e05d.msi
  MSI (s) (B0:60) [15:51:41:353]: File will have security applied from OpCode.
  MSI (s) (B0:60) [15:51:41:397]: Executing op: ProductRegister(UpgradeCode={C1DFDF69-5945-32F2-A35E-EE94C99C7CF4},VersionString=136.0.7103.93,,,,InstallSource=C:\WINDOWS\SystemTemp\3400072313\,Publisher=Google LLC,,,,NoModify=1,,,,,,,,EstimatedSize=130965,,,,)
  MSI (s) (B0:60) [15:51:41:399]: Executing op: ProductCPDisplayInfoRegister()
  MSI (s) (B0:60) [15:51:41:399]: Executing op: ActionStart(Name=PublishFeatures,Description=Publishing Product Features Feature: [1],)
  MSI (s) (B0:60) [15:51:41:399]: Executing op: FeaturePublish(Feature=Complete,,Absent=2,Component=&8OxH%99$6Xsk]O]o0z.)
  MSI (s) (B0:60) [15:51:41:399]: Executing op: ActionStart(Name=PublishProduct,Description=Publishing product information,)
  MSI (s) (B0:60) [15:51:41:399]: Executing op: IconCreate(Icon=icon.ico,Data=BinaryData)
  MSI (s) (B0:60) [15:51:41:399]: Executing op: CleanupConfigData()
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9943976670B0D083F8ED64B76B622352\Patches 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Executing op: RegisterPatchOrder(Continue=0,SequenceType=1,Remove=0)
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Products\9943976670B0D083F8ED64B76B622352\Patches 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Executing op: ProductPublish(PackageKey={C87AF0BB-697A-47B2-AF83-0FD58FB88A28})
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9943976670B0D083F8ED64B76B622352 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9943976670B0D083F8ED64B76B622352 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9943976670B0D083F8ED64B76B622352 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9943976670B0D083F8ED64B76B622352 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9943976670B0D083F8ED64B76B622352 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9943976670B0D083F8ED64B76B622352 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9943976670B0D083F8ED64B76B622352 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9943976670B0D083F8ED64B76B622352 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9943976670B0D083F8ED64B76B622352 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9943976670B0D083F8ED64B76B622352 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9943976670B0D083F8ED64B76B622352 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Executing op: UpgradeCodePublish(UpgradeCode={C1DFDF69-5945-32F2-A35E-EE94C99C7CF4})
  MSI (s) (B0:60) [15:51:41:399]: Executing op: SourceListPublish(,,,,NumberOfDisks=1)
  MSI (s) (B0:60) [15:51:41:399]: Note: 1: 1402 2: UNKNOWN\Installer\Products\9943976670B0D083F8ED64B76B622352\SourceList 3: 2
  MSI (s) (B0:60) [15:51:41:399]: Executing op: ProductPublishClient(,,)
  MSI (s) (B0:60) [15:51:41:399]: Executing op: SourceListRegisterLastUsed(SourceProduct={66793499-0B07-380D-8FDE-467BB6263225},LastUsedSource=C:\WINDOWS\SystemTemp\3400072313\)
  MSI (s) (B0:60) [15:51:41:399]: Entering CMsiConfigurationManager::SetLastUsedSource.
  MSI (s) (B0:60) [15:51:41:399]: Specifed source is already in a list.
  MSI (s) (B0:60) [15:51:41:399]: User policy value 'SearchOrder' is 'nmu'
  MSI (s) (B0:60) [15:51:41:399]: Adding new sources is allowed.
  MSI (s) (B0:60) [15:51:41:399]: Set LastUsedSource to: C:\WINDOWS\SystemTemp\3400072313\.
  MSI (s) (B0:60) [15:51:41:399]: Set LastUsedType to: n.
  MSI (s) (B0:60) [15:51:41:399]: Set LastUsedIndex to: 1.
  MSI (s) (B0:60) [15:51:41:399]: Executing op: End(Checksum=0,ProgressTotalHDWord=0,ProgressTotalLDWord=134170736)
  MSI (s) (B0:60) [15:51:41:413]: Note: 1: 2265 2:  3: -2147287035
  MSI (s) (B0:60) [15:51:41:413]: User policy value 'DisableRollback' is 0
  MSI (s) (B0:60) [15:51:41:413]: Machine policy value 'DisableRollback' is 0
  MSI (s) (B0:60) [15:51:41:415]: Note: 1: 2265 2:  3: -2147287035
  MSI (s) (B0:60) [15:51:41:419]: Note: 1: 2318 2:
  MSI (s) (B0:60) [15:51:41:419]: Note: 1: 2318 2:
  MSI (s) (B0:60) [15:51:41:419]: No System Restore sequence number for this installation.
  MSI (s) (B0:60) [15:51:41:419]: Unlocking Server
  MSI (s) (B0:60) [15:51:41:419]: PROPERTY CHANGE: Deleting UpdateStarted property. Its current value is '1'.
  Action ended 15:51:41: InstallFinalize. Return value 1.
  Action ended 15:51:41: INSTALL. Return value 1.
  MSI (s) (B0:60) [15:51:41:419]: Note: 1: 1707
  MSI (s) (B0:60) [15:51:41:419]: Note: 1: 2205 2:  3: Error
  MSI (s) (B0:60) [15:51:41:419]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1707
  MSI (s) (B0:60) [15:51:41:419]: Note: 1: 2205 2:  3: Error
  MSI (s) (B0:60) [15:51:41:419]: Note: 1: 2228 2:  3: Error 4: SELECT `Message` FROM `Error` WHERE `Error` = 1709
  MSI (s) (B0:60) [15:51:41:419]: Product: Google Chrome -- Installation completed successfully.
  
  MSI (s) (B0:60) [15:51:41:419]: Windows Installer installed the product. Product Name: Google Chrome. Product Version: 136.0.7103.93. Product Language: 1033. Manufacturer: Google LLC. Installation success or error status: 0.
  
  MSI (s) (B0:60) [15:51:41:438]: Deferring clean up of packages/files, if any exist
  MSI (s) (B0:60) [15:51:41:438]: MainEngineThread is returning 0
  MSI (s) (B0:44) [15:51:41:440]: RESTART MANAGER: Session closed.
  MSI (s) (B0:44) [15:51:41:440]: No System Restore sequence number for this installation.
  === Logging stopped: 5/8/2025  15:51:41 ===
  MSI (s) (B0:44) [15:51:41:442]: User policy value 'DisableRollback' is 0
  MSI (s) (B0:44) [15:51:41:442]: Machine policy value 'DisableRollback' is 0
  MSI (s) (B0:44) [15:51:41:442]: Incrementing counter to disable shutdown. Counter after increment: 0
  MSI (s) (B0:44) [15:51:41:442]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
  MSI (s) (B0:44) [15:51:41:442]: Note: 1: 2265 2:  3: -2147287035
  MSI (s) (B0:44) [15:51:41:442]: Note: 1: 1402 2: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts 3: 2
  MSI (s) (B0:44) [15:51:41:442]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
  MSI (s) (B0:44) [15:51:41:448]: Destroying RemoteAPI object.
  MSI (s) (B0:14) [15:51:41:448]: Custom Action Manager thread ending.
  MSI (c) (20:50) [15:51:41:448]: Decrementing counter to disable shutdown. If counter >= 0, shutdown will be denied.  Counter after decrement: -1
  MSI (c) (20:50) [15:51:41:448]: MainEngineThread is returning 0
  === Verbose logging stopped: 5/8/2025  15:51:41 ===
  
  

• FMA VS Code

  Installed via self-service

  Installs correctly, no issues

My Device page

• Processor Type missing (arm64)
• Everything else including MDM settings working correctly

Tables

• appcompat_shims no results, no error
• arp_cache
• authenticode
• autoexec
• azure_instance_metadata no results, no error
• azure_instance_tags no results, no error
• background_activities_moderator
• battery
• bitlocker_info
• carves no results, no error
• certificates
• chassis_info
• chocolatey_packages Installed packages not listed
• chrome_extension_content_scripts no results, but chrome extensions installed
• chrome_extensions no results, but chrome extensions installed
• connectivity
• cpu_info
• cpuid no such table: cpuid
• cryptoinfo no rows, no errors
• curl
• curl_certificate
• default_environment
• disk_info
• dns_cache
• drivers
• etc_hosts
• etc_protocols
• etc_services
• file
• file_lines
• firefox_addons no results, but addons installed
• firefox_preferences no results, but firefox installed
• fleetd_logs
• google_chrome_profiles
• groups
• hash
• hvci_status
• ie_extensions
• intel_me_info no intel ME on arm mahines, empty result
• interface_addresses
• interface_details
• kernel_info
• kva_speculative_info
• listening_ports
• logged_in_users
• logical_drives
• logon_sessions
• mdm_bridge
• memory_devices
• npm_packages
• ntdomains
• ntfs_acl_permissions
• ntfs_journal_events evented table
• office_mru empty results, no error
• orbit_info
• os_version
• osquery_events
• osquery_extensions
• osquery_flags
• osquery_info
• osquery_packs
• osquery_registry
• osquery_schedule
• parse_ini
• parse_json
• parse_jsonl
• parse_xml
• patches
• physical_disk_performance
• pipes
• platform_info
• powershell_events evented table
• prefetch
• process_etw_events evented table
• process_memory_map
• process_open_sockets
• processes
• programs
• python_packages
• registry
• routes
• scheduled_tasks
• secureboot
• security_profile_info
• services
• shared_resources
• shellbags
• shimcache
• sntp_request
• ssh_configs
• startup_items
• system_info
• time
• tpm_info
• uptime
• user_groups
• user_ssh_keys
• userassist
• users
• video_info
• vscode_extensions no resutls returned, vscode and extensions installed
• winbaseobj
• windows_crashes
• windows_eventlog
• windows_events evented table
• windows_firewall_rules
• windows_optional_features
• windows_search
• windows_security_center
• windows_security_products
• windows_update_history
• windows_updates - "error": "Extension call failed: TPipe: GetOverlappedResult failed"
• wmi_bios_info
• wmi_cli_event_consumers
• wmi_event_filters
• wmi_filter_consumer_binding
• wmi_script_event_consumers
• yara

[noahtalerman]

Hey @sharon-fdm I just moved this testing user story to Ready to spec. Can we please estimate it ahead of pre-sprint planning on Friday?

More context in the customer request here: #26060 (comment)

[sharon-fdm]

Hey team! Please add your planning poker estimate with Zenhub @dantecatalfamo @jacobshandling @juan-fdz-hawa @lucasmrod @sgress454