Fresh Fleet install does not apply default enable_host_users: true

[Brajim20]

Fleet versions

• Discovered: v4.85.0-rc.2605012055
• Reproduced: v4.85.0-rc.2605012055, v4.84.0

Web browser and operating system: N/A — server-side bug, confirmed via DB and API

---

💥 Actual behavior

After a fresh Fleet install (clean DB → fleet prepare db → fleetctl setup), features.enable_host_users persists as false in the database, despite both the documentation and source code defining the default as true. enable_software_inventory (also a default in the same code path) correctly persists as true — only enable_host_users is affected.

DB state immediately after a fresh install with no further config changes:

SELECT JSON_EXTRACT(json_value, '$.features') FROM app_config_json LIMIT 1;
-- Returns: {"enable_host_users": false, "enable_software_inventory": true}

The host details page consequently displays "User collection has been disabled" with a docs link to enable the feature, despite the admin having taken no action to disable it.

🛠️ Expected behavior

A fresh Fleet install should persist enable_host_users: true per both the documentation and the source code default in server/fleet/app.go:

func (f *Features) ApplyDefaults() {
    f.EnableHostUsers = true
}

Documentation (https://fleetdm.com/docs/configuration/yaml-files#features) explicitly states:

enable_host_users specifies whether or not Fleet collects user data from hosts (default: true).

Both enable_host_users and enable_software_inventory should be true after a fresh install with no admin intervention.

🧑‍💻 Steps to reproduce

These steps:

• Have been confirmed to consistently lead to reproduction in multiple Fleet instances.
• Describe the workflow that led to the error, but have not yet been reproduced in multiple Fleet instances.

1. From a fresh instance.
2. Run fleet prepare db against the clean DB.
3. Start Fleet: ./build/fleet serve --dev --config fleet.yml
4. Run fleetctl setup to create an admin user.
5. Query the DB: docker exec -it fleet-mysql-1 mysql -uroot -ptoor fleet -e "SELECT JSON_EXTRACT(json_value, '\$.features') FROM app_config_json LIMIT 1;"
6. Observe: enable_host_users is false, enable_software_inventory is true.
7. Enroll a host. Open the host's page and observe the "User collection has been disabled" message under Local user accounts.

🕯️ More info (optional)

[ddribeiro]

@Brajim20 did some testing on this last night and discovered this is all present on 4.84.0

@sharon-fdm I think this might meet the criteria for a P2 bug. My understanding is that all new Fleet instances from 4.84.0 (or possibly earlier) will not collect host users by default.

[sharon-fdm]

@ddribeiro , P2 approved. I would even say it is bordering P1, but we'll pick it up as P2.
@rachaelshaw , can I move to ready for estimation or you want to add anything?

FYI @lucasmrod