CSP setting continuously reapplying

[mason-buettner]

customer-redqueen GONG snippet: https://us-65885.app.gong.io/call?id=4695135856071655463&highlights=%5B%7B%22type%22%3A%22SHARE%22%2C%22from%22%3A1637%2C%22to%22%3A1763%7D%5D

Fleet version: 4.78.3

Web browser and operating system: Windows 11 Education/Windows 11

---

💥  Actual behavior

When enrolled in Fleet for MDM, Windows custom settings are generating a high volume of 4719 event logs that indicate frequent changes. These logs trigger SIEM alerts and are flagged as IoCs.

customer-redqueen sees roughly 80 4719 events per minute/host with the changes Failure added and Failure removed.

I have previously observed similar behavior on https://dogfood.fleetdm.com/hosts/1489/

🛠️ To fix

Timeboxed to investigate what if anything differently we can do or document possible side effects of this CSP.

🧑‍💻  Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. Enroll the Windows host to Fleet.
2. Add custom setting (Audit policy CSP).
3. Profile is stuck in "Verifying".
4. In the Windows events, audit policy is constantly switching states. (see gong snippet on the top of the issue).

🕯️ More info (optional)

Slack thread with redqueen: https://fleetdm.slack.com/archives/C08UZKFR7LM/p1767897717326719

[marko-lisica]

Hey @mason-buettner, can you provide the logs and CSP (profile) that is uploaded to Fleet?

[mason-buettner]

Hi @marko-lisica, here's the main CSP that's causing these issues and logs from a host: https://drive.google.com/drive/folders/19MIFIkxDctJHdipR_b4kTaXpLP5_tfHU?usp=sharing

[marko-lisica]

When enrolled in Fleet for MDM, Windows custom settings are generating a high volume of 4719 event logs that indicate frequent changes. These logs trigger SIEM alerts and are flagged as IoCs.

@mason-buettner Are you referring to Fleet server logs here?

What happens when the customer uploads this configuration profile? Does it fail to apply to all hosts? What's the error message they see on host details > OS settings modal?

Looking at the Audit Policy CSP docs, it seems that this specific setting is applicable to the listed Windows versions:

[mason-buettner]

@marko-lisica the 4719 event logs refer to Windows events on the hosts, which are then detected by the customer's SIEM platform. The CSP in Fleet is stuck on "Verifying".

[marko-lisica]

Hey @JordanMontgomery, I updated repro steps, based on my understanding. I think we should probably assign this to QA to try to reproduce and understand what is happening. Wdyt?

[JordanMontgomery]

@marko-lisica I think the repro steps sound good and we can assign to QA to reproduce and we will investigate