Fix out-of-order Windows MDM fleetd install commands (#47683)

[getvictor]

The fleetd install Add and Exec were enqueued as two separate Windows MDM commands ordered only by created_at (1-second granularity), so they could be delivered Exec-before-Add. The device then ran DownloadInstall on a not-yet-created node, returned 404, and fleetd never installed, which could hang the Windows Autopilot Enrollment Status Page. Enqueue them as a single command so Add always precedes Exec.

Related issue: Resolves #47683

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

Testing

• QA'd all new/changed functionality manually

Summary by CodeRabbit

• Bug Fixes

  • Fixed intermittent fleetd installation failures during Windows MDM enrollment that could cause the Windows Autopilot Enrollment Status Page to hang.

• Documentation

  • Updated Windows MDM fleetd installation documentation to reflect the fix.

[getvictor]

@coderabbitai full review

[getvictor]

/agentic_review

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

This PR fixes an intermittent Windows MDM enrollment failure where fleetd install commands (Add to create the MSI node and Exec to run DownloadInstall) could be delivered out of order due to nondeterministic ordering of rows sharing the same created_at timestamp. The fix makes ordering deterministic by enqueueing both operations as a single queued command (one raw_command) so the Add appears before Exec in the same SyncML body.

Changes:

• Combine fleetd MSI Add + Exec into one queued Windows MDM command to guarantee delivery order.
• Adjust enqueue logic to insert a single command UUID/result-tracking row (using the Exec UUID).
• Add a user-visible changes entry (file content excluded from this review by policy).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 2 comments.

File	Description
server/service/microsoft_mdm.go	Enqueues the fleetd install as a single Windows MDM command by concatenating Add and Exec into one raw_command.
changes/47683-windows-mdm-fleetd-install-ordering	Release note / changes entry (excluded from diff by content policy; not reviewed).

Files excluded by content exclusion policy (1)

• changes/47683-windows-mdm-fleetd-install-ordering

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

[claude]

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

[getvictor]

@coderabbitai review

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.20%. Comparing base (b3e81f3) to head (f9b258b).
⚠️ Report is 13 commits behind head on main.

Files with missing lines	Patch %	Lines
server/service/microsoft_mdm.go	66.66%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #47736      +/-   ##
==========================================
+ Coverage   67.18%   67.20%   +0.02%     
==========================================
  Files        3629     3631       +2     
  Lines      229302   229480     +178     
  Branches    11948    11948              
==========================================
+ Hits       154060   154228     +168     
- Misses      61387    61390       +3     
- Partials    13855    13862       +7     

Flag	Coverage Δ
backend	68.85% <66.66%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4bd8c407-322e-446e-a221-61927441fcb7

📥 Commits

Reviewing files that changed from the base of the PR and between dcf5203 and f9b258b.

📒 Files selected for processing (2)

• changes/47683-windows-mdm-fleetd-install-ordering
• server/service/microsoft_mdm.go

---

Walkthrough

enqueueInstallFleetdCommand in server/service/microsoft_mdm.go is updated to combine the fleetd <Add> and <Exec> SyncML payloads into a single RawCommand stored as one MDMWindowsCommand record, keyed by the Exec command UUID. Previously, these were two separate records ordered only by a one-second created_at timestamp, allowing MySQL to return them in nondeterministic order and causing intermittent 404 failures when <Exec> preceded <Add>. The <Add> CmdID is also changed from a generated UUID to a stable Fleet-internal prefix value. A changelog entry documents the fix.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main fix: resolving out-of-order Windows MDM fleetd installation commands.
Description check	✅ Passed	The description explains the root cause, the solution, and includes a reference to the related issue (#47683) with testing confirmation and changes file notation.
Linked Issues check	✅ Passed	The PR implementation directly addresses the core objective of issue #47683: consolidating Add and Exec commands into a single enqueued command to ensure deterministic ordering and reliable fleetd installation.
Out of Scope Changes check	✅ Passed	All changes are scoped to addressing the ordering issue: documentation update in changes/ and code modification in microsoft_mdm.go to consolidate the fleetd install commands.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch victor/47683-windows-mdm-fleetd-install-ordering

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[ksykulev]

Not a whole lot of tests for this given this fixes are hard to reproduce issue. But not blocking 👍 code looks good.