[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P9CBJDCPQZPYQZZSN0TDRG":3,"skill-same:01M6P9CBJDCPQZPYQZZSN0TDRG":77},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":29,"commitSha":52,"skillDirectory":53,"forksCount":13,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":56,"install":57,"resources":70},"01M6P9CBJDCPQZPYQZZSN0TDRG","mdm-device-management",null,"Manage and secure company devices with MDM solutions","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fmdm-device-management\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"mdm device management","device management","management","device","company","security","relevant","scripts","critical","os","platform","main","community","manage","only","access","devops-security","devices","license","secure","2026-11-10 10:12:30",false,"---\nname: mdm-device-management\ndescription: Manage and secure company devices with MDM solutions\ncategory: devops\nrisk: critical\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Requires the relevant OS\u002Fplatform tooling and privileged access where\n  noted. Docs-only; helper scripts and templates not bundled.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n## When to Use\n\n- Provisioning, hardening, or operating the infrastructure described in this skill within an authorized environment.\n\n\n# Mobile Device Management (MDM) for Startups & Small Teams\n\nA practical guide to enrolling, securing, and managing company devices across\nmacOS, Windows, iOS, and Android — from zero-touch onboarding to remote wipe.\n\n---\n\n## 1. When to Use MDM\n\nMDM becomes essential when any of the following apply:\n\n- **Team size crosses ~10 people** — manual laptop setup no longer scales.\n- **Compliance requirements** — SOC 2, HIPAA, ISO 27001, or customer security\n  questionnaires demand proof that endpoints are encrypted and patched.\n- **Remote \u002F hybrid workforce** — you cannot walk over to someone's desk to\n  fix a configuration or verify disk encryption.\n- **Contractor or BYOD devices** — you need a way to separate corporate data\n  from personal data and revoke access on offboarding.\n- **Insurance or investor due diligence** — cyber-insurance carriers and VCs\n  increasingly ask for evidence of endpoint management.\n\nIf you are still under 10 people and everyone is in-office, a simple checklist\nplus a configuration management tool (Ansible) may suffice — but plan for MDM\nearly so enrollment is painless when you scale.\n\n---\n\n## 2. MDM Platform Comparison\n\n| Platform | Best For | Pricing Model | Open Source | Key Strength |\n|----------|----------|---------------|-------------|--------------|\n| **Jamf Pro** | macOS \u002F iOS fleets | Per-device\u002Fyr | No | Deepest Apple integration, DEP\u002FADE native |\n| **Microsoft Intune** | Windows + M365 shops | Bundled w\u002F M365 E3\u002FE5 | No | Seamless Azure AD + Autopilot |\n| **Kandji** | macOS-first startups | Per-device\u002Fyr | No | Pre-built compliance templates, fast setup |\n| **Mosyle** | Education & SMB Apple | Per-device\u002Fyr | No | Apple School\u002FBusiness Manager integration |\n| **Fleet** | Cross-platform, eng-led | Free (OSS) \u002F paid cloud | Yes | osquery-powered, GitOps-friendly, API-first |\n| **SimpleMDM** | Small Apple-only teams | Per-device\u002Fmo | No | Simple UI, quick onboarding |\n\n### Decision heuristic\n\n```text\nif (team \u003C 50 AND engineering-led AND multi-OS):\n    consider Fleet (open-source, osquery-native)\nelif (team is macOS-dominant AND compliance-heavy):\n    consider Kandji or Jamf\nelif (team is Windows-dominant AND already on M365):\n    consider Intune (likely already licensed)\nelse:\n    evaluate Fleet or Kandji based on OS mix\n```\n\n---\n\n## 3. Fleet (Open Source MDM) — Self-Hosted Deployment\n\nFleet is the leading open-source MDM. It uses osquery under the hood and\nsupports macOS, Windows, Linux, iOS, and Android.\n\n### 3.1 Docker Compose deployment\n\n```yaml\n# docker-compose.yml\nversion: \"3.8\"\n\nservices:\n  mysql:\n    image: mysql:8.0\n    environment:\n      MYSQL_ROOT_PASSWORD: \"${FLEET_MYSQL_ROOT_PASSWORD}\"\n      MYSQL_DATABASE: fleet\n      MYSQL_USER: fleet\n      MYSQL_PASSWORD: \"${FLEET_MYSQL_PASSWORD}\"\n    volumes:\n      - mysql-data:\u002Fvar\u002Flib\u002Fmysql\n    ports:\n      - \"3306:3306\"\n    healthcheck:\n      test: [\"CMD\", \"mysqladmin\", \"ping\", \"-h\", \"localhost\"]\n      interval: 10s\n      retries: 5\n\n  redis:\n    image: redis:7-alpine\n    ports:\n      - \"6379:6379\"\n\n  fleet:\n    image: fleetdm\u002Ffleet:v4.47.0\n    depends_on:\n      mysql:\n        condition: service_healthy\n      redis:\n        condition: service_started\n    environment:\n      FLEET_MYSQL_ADDRESS: mysql:3306\n      FLEET_MYSQL_DATABASE: fleet\n      FLEET_MYSQL_USERNAME: fleet\n      FLEET_MYSQL_PASSWORD: \"${FLEET_MYSQL_PASSWORD}\"\n      FLEET_REDIS_ADDRESS: redis:6379\n      FLEET_SERVER_TLS: \"true\"\n      FLEET_SERVER_TLS_COMPATIBILITY: modern\n      FLEET_SERVER_CERT: \u002Ftls\u002Ffleet.crt\n      FLEET_SERVER_KEY: \u002Ftls\u002Ffleet.key\n      FLEET_LOGGING_JSON: \"true\"\n    volumes:\n      - .\u002Ftls:\u002Ftls:ro\n    ports:\n      - \"8080:8080\"\n\nvolumes:\n  mysql-data:\n```\n\n### 3.2 Initial setup\n\n```bash\n# Generate TLS certs (use real certs in production)\nmkdir -p tls\nopenssl req -x509 -newkey rsa:4096 -sha256 -days 365 \\\n  -nodes -keyout tls\u002Ffleet.key -out tls\u002Ffleet.crt \\\n  -subj \"\u002FCN=fleet.yourcompany.com\"\n\n# Start services\ndocker compose up -d\n\n# Create admin account\ndocker compose exec fleet fleet prepare db\ndocker compose exec fleet fleet setup \\\n  --email admin@yourcompany.com \\\n  --name \"IT Admin\" \\\n  --password \"${FLEET_ADMIN_PASSWORD}\" \\\n  --org-name \"YourCompany\"\n```\n\n### 3.3 Enroll a macOS host with fleetctl\n\n```bash\n# Install fleetctl\nbrew install fleetdm\u002Ftap\u002Ffleetctl\n\n# Authenticate\nfleetctl config set --address https:\u002F\u002Ffleet.yourcompany.com:8080\nfleetctl login --email admin@yourcompany.com\n\n# Generate an installer package for macOS\nfleetctl package --type pkg \\\n  --fleet-url https:\u002F\u002Ffleet.yourcompany.com:8080 \\\n  --enroll-secret \"$(fleetctl get enroll-secret)\" \\\n  --fleet-certificate tls\u002Ffleet.crt\n\n# The .pkg file can be distributed via Apple Business Manager or manually\n```\n\n### 3.4 Enroll a Windows host\n\n```powershell\n# Download the Fleet osquery MSI installer\nfleetctl package --type msi `\n  --fleet-url https:\u002F\u002Ffleet.yourcompany.com:8080 `\n  --enroll-secret \"$(fleetctl get enroll-secret)\" `\n  --fleet-certificate tls\u002Ffleet.crt\n\n# Install silently\nmsiexec \u002Fi fleet-osquery.msi \u002Fquiet \u002Fnorestart\n```\n\n### 3.5 osquery policy examples in Fleet\n\n```yaml\n# fleet-policies.yml — apply with: fleetctl apply -f fleet-policies.yml\napiVersion: v1\nkind: policy\nspec:\n  name: FileVault enabled (macOS)\n  query: >\n    SELECT 1 FROM disk_encryption\n    WHERE user_uuid IS NOT '' AND encrypted = 1;\n  description: Ensures FileVault disk encryption is enabled.\n  resolution: \"Enable FileVault: System Settings > Privacy & Security > FileVault.\"\n  platform: darwin\n\n---\napiVersion: v1\nkind: policy\nspec:\n  name: BitLocker enabled (Windows)\n  query: >\n    SELECT 1 FROM bitlocker_info\n    WHERE protection_status = 1;\n  description: Ensures BitLocker drive encryption is active.\n  resolution: \"Enable BitLocker via Settings > Privacy & Security > Device Encryption.\"\n  platform: windows\n\n---\napiVersion: v1\nkind: policy\nspec:\n  name: Firewall enabled (macOS)\n  query: >\n    SELECT 1 FROM alf WHERE global_state >= 1;\n  description: macOS Application Layer Firewall must be on.\n  resolution: \"Enable firewall: System Settings > Network > Firewall.\"\n  platform: darwin\n\n---\napiVersion: v1\nkind: policy\nspec:\n  name: OS up to date (macOS)\n  query: >\n    SELECT 1 FROM os_version\n    WHERE platform = 'darwin' AND major >= 14;\n  description: Requires macOS 14 (Sonoma) or later.\n  resolution: \"Update macOS via System Settings > General > Software Update.\"\n  platform: darwin\n```\n\n---\n\n## 4. macOS Enrollment\n\n### 4.1 Apple Business Manager (ABM) \u002F Automated Device Enrollment\n\n```bash\n# In ABM (business.apple.com):\n# 1. Settings > MDM Servers > Add MDM Server\n# 2. Upload the public key from your MDM (Fleet, Jamf, Kandji)\n# 3. Download the ABM token and upload it to your MDM\n# 4. Assign devices to the MDM server by serial number\n\n# Verify DEP assignment with fleetctl (Fleet)\nfleetctl get mdm-apple\n```\n\n### 4.2 Manual MDM profile enrollment (non-DEP devices)\n\n```bash\n# Generate enrollment profile URL (Fleet example)\nfleetctl get enrollment-profile > enrollment.mobileconfig\n\n# Distribute to user — they open the .mobileconfig file\n# Then approve in System Settings > Profiles\n```\n\n### 4.3 Enforce FileVault via MDM configuration profile\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE plist PUBLIC \"-\u002F\u002FApple\u002F\u002FDTD PLIST 1.0\u002F\u002FEN\"\n  \"http:\u002F\u002Fwww.apple.com\u002FDTDs\u002FPropertyList-1.0.dtd\">\n\u003Cplist version=\"1.0\">\n\u003Cdict>\n    \u003Ckey>PayloadContent\u003C\u002Fkey>\n    \u003Carray>\n        \u003Cdict>\n            \u003Ckey>PayloadType\u003C\u002Fkey>\n            \u003Cstring>com.apple.MCX.FileVault2\u003C\u002Fstring>\n            \u003Ckey>PayloadIdentifier\u003C\u002Fkey>\n            \u003Cstring>com.yourcompany.filevault\u003C\u002Fstring>\n            \u003Ckey>PayloadUUID\u003C\u002Fkey>\n            \u003Cstring>A1B2C3D4-E5F6-7890-ABCD-EF1234567890\u003C\u002Fstring>\n            \u003Ckey>PayloadVersion\u003C\u002Fkey>\n            \u003Cinteger>1\u003C\u002Finteger>\n            \u003Ckey>Enable\u003C\u002Fkey>\n            \u003Cstring>On\u003C\u002Fstring>\n            \u003Ckey>Defer\u003C\u002Fkey>\n            \u003Ctrue\u002F>\n            \u003Ckey>DeferForceAtUserLoginMaxBypassAttempts\u003C\u002Fkey>\n            \u003Cinteger>0\u003C\u002Finteger>\n            \u003Ckey>ShowRecoveryKey\u003C\u002Fkey>\n            \u003Cfalse\u002F>\n            \u003Ckey>UseRecoveryKey\u003C\u002Fkey>\n            \u003Ctrue\u002F>\n        \u003C\u002Fdict>\n    \u003C\u002Farray>\n    \u003Ckey>PayloadDisplayName\u003C\u002Fkey>\n    \u003Cstring>FileVault Enforcement\u003C\u002Fstring>\n    \u003Ckey>PayloadIdentifier\u003C\u002Fkey>\n    \u003Cstring>com.yourcompany.filevault.profile\u003C\u002Fstring>\n    \u003Ckey>PayloadType\u003C\u002Fkey>\n    \u003Cstring>Configuration\u003C\u002Fstring>\n    \u003Ckey>PayloadUUID\u003C\u002Fkey>\n    \u003Cstring>F1E2D3C4-B5A6-7890-FEDC-BA0987654321\u003C\u002Fstring>\n    \u003Ckey>PayloadVersion\u003C\u002Fkey>\n    \u003Cinteger>1\u003C\u002Finteger>\n\u003C\u002Fdict>\n\u003C\u002Fplist>\n```\n\n### 4.4 macOS firewall enforcement\n\n```bash\n# Enable firewall via MDM command or script\nsudo \u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --setglobalstate on\nsudo \u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --setstealthmode on\nsudo \u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --setallowsigned enable\n```\n\n---\n\n## 5. Windows Enrollment\n\n### 5.1 Azure AD Join + Intune auto-enrollment\n\n```powershell\n# Check current join status\ndsregcmd \u002Fstatus\n\n# Join Azure AD (user will be prompted for credentials)\nStart-Process \"ms-settings:workplace\"\n\n# Verify Intune enrollment\nGet-WmiObject -Namespace \"root\\cimv2\\mdm\\dmmap\" `\n  -Class \"MDM_DevDetail_Ext01\" | Select DeviceID\n```\n\n### 5.2 Windows Autopilot hardware hash collection\n\n```powershell\n# Collect hardware hash for Autopilot registration\nInstall-Script -Name Get-WindowsAutoPilotInfo -Force\nGet-WindowsAutoPilotInfo -OutputFile C:\\temp\\autopilot.csv\n\n# Upload autopilot.csv to Intune > Devices > Windows Enrollment > Devices\n```\n\n### 5.3 BitLocker enforcement via Group Policy or Intune\n\n```powershell\n# Enable BitLocker on the OS drive with TPM\nEnable-BitLocker -MountPoint \"C:\" `\n  -EncryptionMethod XtsAes256 `\n  -TpmProtector\n\n# Add a recovery password and back it up to Azure AD\nAdd-BitLockerKeyProtector -MountPoint \"C:\" -RecoveryPasswordProtector\nBackupToAAD-BitLockerKeyProtector -MountPoint \"C:\" `\n  -KeyProtectorId (Get-BitLockerVolume -MountPoint \"C:\").KeyProtector[1].KeyProtectorId\n\n# Verify encryption status\nGet-BitLockerVolume | Select-Object MountPoint, VolumeStatus, EncryptionPercentage\n```\n\n### 5.4 Windows Firewall baseline\n\n```powershell\n# Ensure all profiles are enabled\nSet-NetFirewallProfile -Profile Domain,Public,Private -Enabled True\n\n# Block all inbound by default, allow outbound\nSet-NetFirewallProfile -Profile Domain,Public,Private `\n  -DefaultInboundAction Block `\n  -DefaultOutboundAction Allow\n\n# Allow specific inbound rules (example: RDP only from VPN subnet)\nNew-NetFirewallRule -DisplayName \"Allow RDP from VPN\" `\n  -Direction Inbound -Protocol TCP -LocalPort 3389 `\n  -RemoteAddress 10.0.0.0\u002F8 -Action Allow\n```\n\n---\n\n\n## Contents\n\n- [6. Security Policies — Cross-Platform](references\u002Fdetails.md)\n- [7. Software Deployment](references\u002Fdetails.md)\n- [8. Compliance Checks with osquery](references\u002Fdetails.md)\n- [9. Remote Wipe & Lock](references\u002Fdetails.md)\n- [10. Onboarding Automation — Zero-Touch Enrollment](references\u002Fdetails.md)\n- [Quick Reference](references\u002Fdetails.md)\n\n## When to Use\n\n- You are provisioning, configuring, or troubleshooting the infrastructure component covered by this skill (servers, storage, databases, networking, cloud, local AI).\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n","## When to Use\n\n- Provisioning, hardening, or operating the infrastructure described in this skill within an authorized environment.\n\n\n# Mobile Device Management (MDM) for Startups & Small Teams\n\nA practical guide to enrolling, securing, and managing company devices across\nmacOS, Windows, iOS, and Android — from zero-touch onboarding to remote wipe.\n\n---\n\n## 1. When to Use MDM\n\nMDM becomes essential when any of the following apply:\n\n- **Team size crosses ~10 people** — manual laptop setup no longer scales.\n- **Compliance requirements** — SOC 2, HIPAA, ISO 27001, or customer security\n  questionnaires demand proof that endpoints are encrypted and patched.\n- **Remote \u002F hybrid workforce** — you cannot walk over to someone's desk to\n  fix a configuration or verify disk encryption.\n- **Contractor or BYOD devices** — you need a way to separate corporate data\n  from personal data and revoke access on offboarding.\n- **Insurance or investor due diligence** — cyber-insurance carriers and VCs\n  increasingly ask for evidence of endpoint management.\n\nIf you are still under 10 people and everyone is in-office, a simple checklist\nplus a configuration management tool (Ansible) may suffice — but plan for MDM\nearly so enrollment is painless when you scale.\n\n---\n\n## 2. MDM Platform Comparison\n\n| Platform | Best For | Pricing Model | Open Source | Key Strength |\n|----------|----------|---------------|-------------|--------------|\n| **Jamf Pro** | macOS \u002F iOS fleets | Per-device\u002Fyr | No | Deepest Apple integration, DEP\u002FADE native |\n| **Microsoft Intune** | Windows + M365 shops | Bundled w\u002F M365 E3\u002FE5 | No | Seamless Azure AD + Autopilot |\n| **Kandji** | macOS-first startups | Per-device\u002Fyr | No | Pre-built compliance templates, fast setup |\n| **Mosyle** | Education & SMB Apple | Per-device\u002Fyr | No | Apple School\u002FBusiness Manager integration |\n| **Fleet** | Cross-platform, eng-led | Free (OSS) \u002F paid cloud | Yes | osquery-powered, GitOps-friendly, API-first |\n| **SimpleMDM** | Small Apple-only teams | Per-device\u002Fmo | No | Simple UI, quick onboarding |\n\n### Decision heuristic\n\n```text\nif (team \u003C 50 AND engineering-led AND multi-OS):\n    consider Fleet (open-source, osquery-native)\nelif (team is macOS-dominant AND compliance-heavy):\n    consider Kandji or Jamf\nelif (team is Windows-dominant AND already on M365):\n    consider Intune (likely already licensed)\nelse:\n    evaluate Fleet or Kandji based on OS mix\n```\n\n---\n\n## 3. Fleet (Open Source MDM) — Self-Hosted Deployment\n\nFleet is the leading open-source MDM. It uses osquery under the hood and\nsupports macOS, Windows, Linux, iOS, and Android.\n\n### 3.1 Docker Compose deployment\n\n```yaml\n# docker-compose.yml\nversion: \"3.8\"\n\nservices:\n  mysql:\n    image: mysql:8.0\n    environment:\n      MYSQL_ROOT_PASSWORD: \"${FLEET_MYSQL_ROOT_PASSWORD}\"\n      MYSQL_DATABASE: fleet\n      MYSQL_USER: fleet\n      MYSQL_PASSWORD: \"${FLEET_MYSQL_PASSWORD}\"\n    volumes:\n      - mysql-data:\u002Fvar\u002Flib\u002Fmysql\n    ports:\n      - \"3306:3306\"\n    healthcheck:\n      test: [\"CMD\", \"mysqladmin\", \"ping\", \"-h\", \"localhost\"]\n      interval: 10s\n      retries: 5\n\n  redis:\n    image: redis:7-alpine\n    ports:\n      - \"6379:6379\"\n\n  fleet:\n    image: fleetdm\u002Ffleet:v4.47.0\n    depends_on:\n      mysql:\n        condition: service_healthy\n      redis:\n        condition: service_started\n    environment:\n      FLEET_MYSQL_ADDRESS: mysql:3306\n      FLEET_MYSQL_DATABASE: fleet\n      FLEET_MYSQL_USERNAME: fleet\n      FLEET_MYSQL_PASSWORD: \"${FLEET_MYSQL_PASSWORD}\"\n      FLEET_REDIS_ADDRESS: redis:6379\n      FLEET_SERVER_TLS: \"true\"\n      FLEET_SERVER_TLS_COMPATIBILITY: modern\n      FLEET_SERVER_CERT: \u002Ftls\u002Ffleet.crt\n      FLEET_SERVER_KEY: \u002Ftls\u002Ffleet.key\n      FLEET_LOGGING_JSON: \"true\"\n    volumes:\n      - .\u002Ftls:\u002Ftls:ro\n    ports:\n      - \"8080:8080\"\n\nvolumes:\n  mysql-data:\n```\n\n### 3.2 Initial setup\n\n```bash\n# Generate TLS certs (use real certs in production)\nmkdir -p tls\nopenssl req -x509 -newkey rsa:4096 -sha256 -days 365 \\\n  -nodes -keyout tls\u002Ffleet.key -out tls\u002Ffleet.crt \\\n  -subj \"\u002FCN=fleet.yourcompany.com\"\n\n# Start services\ndocker compose up -d\n\n# Create admin account\ndocker compose exec fleet fleet prepare db\ndocker compose exec fleet fleet setup \\\n  --email admin@yourcompany.com \\\n  --name \"IT Admin\" \\\n  --password \"${FLEET_ADMIN_PASSWORD}\" \\\n  --org-name \"YourCompany\"\n```\n\n### 3.3 Enroll a macOS host with fleetctl\n\n```bash\n# Install fleetctl\nbrew install fleetdm\u002Ftap\u002Ffleetctl\n\n# Authenticate\nfleetctl config set --address https:\u002F\u002Ffleet.yourcompany.com:8080\nfleetctl login --email admin@yourcompany.com\n\n# Generate an installer package for macOS\nfleetctl package --type pkg \\\n  --fleet-url https:\u002F\u002Ffleet.yourcompany.com:8080 \\\n  --enroll-secret \"$(fleetctl get enroll-secret)\" \\\n  --fleet-certificate tls\u002Ffleet.crt\n\n# The .pkg file can be distributed via Apple Business Manager or manually\n```\n\n### 3.4 Enroll a Windows host\n\n```powershell\n# Download the Fleet osquery MSI installer\nfleetctl package --type msi `\n  --fleet-url https:\u002F\u002Ffleet.yourcompany.com:8080 `\n  --enroll-secret \"$(fleetctl get enroll-secret)\" `\n  --fleet-certificate tls\u002Ffleet.crt\n\n# Install silently\nmsiexec \u002Fi fleet-osquery.msi \u002Fquiet \u002Fnorestart\n```\n\n### 3.5 osquery policy examples in Fleet\n\n```yaml\n# fleet-policies.yml — apply with: fleetctl apply -f fleet-policies.yml\napiVersion: v1\nkind: policy\nspec:\n  name: FileVault enabled (macOS)\n  query: >\n    SELECT 1 FROM disk_encryption\n    WHERE user_uuid IS NOT '' AND encrypted = 1;\n  description: Ensures FileVault disk encryption is enabled.\n  resolution: \"Enable FileVault: System Settings > Privacy & Security > FileVault.\"\n  platform: darwin\n\n---\napiVersion: v1\nkind: policy\nspec:\n  name: BitLocker enabled (Windows)\n  query: >\n    SELECT 1 FROM bitlocker_info\n    WHERE protection_status = 1;\n  description: Ensures BitLocker drive encryption is active.\n  resolution: \"Enable BitLocker via Settings > Privacy & Security > Device Encryption.\"\n  platform: windows\n\n---\napiVersion: v1\nkind: policy\nspec:\n  name: Firewall enabled (macOS)\n  query: >\n    SELECT 1 FROM alf WHERE global_state >= 1;\n  description: macOS Application Layer Firewall must be on.\n  resolution: \"Enable firewall: System Settings > Network > Firewall.\"\n  platform: darwin\n\n---\napiVersion: v1\nkind: policy\nspec:\n  name: OS up to date (macOS)\n  query: >\n    SELECT 1 FROM os_version\n    WHERE platform = 'darwin' AND major >= 14;\n  description: Requires macOS 14 (Sonoma) or later.\n  resolution: \"Update macOS via System Settings > General > Software Update.\"\n  platform: darwin\n```\n\n---\n\n## 4. macOS Enrollment\n\n### 4.1 Apple Business Manager (ABM) \u002F Automated Device Enrollment\n\n```bash\n# In ABM (business.apple.com):\n# 1. Settings > MDM Servers > Add MDM Server\n# 2. Upload the public key from your MDM (Fleet, Jamf, Kandji)\n# 3. Download the ABM token and upload it to your MDM\n# 4. Assign devices to the MDM server by serial number\n\n# Verify DEP assignment with fleetctl (Fleet)\nfleetctl get mdm-apple\n```\n\n### 4.2 Manual MDM profile enrollment (non-DEP devices)\n\n```bash\n# Generate enrollment profile URL (Fleet example)\nfleetctl get enrollment-profile > enrollment.mobileconfig\n\n# Distribute to user — they open the .mobileconfig file\n# Then approve in System Settings > Profiles\n```\n\n### 4.3 Enforce FileVault via MDM configuration profile\n\n```xml\n\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE plist PUBLIC \"-\u002F\u002FApple\u002F\u002FDTD PLIST 1.0\u002F\u002FEN\"\n  \"http:\u002F\u002Fwww.apple.com\u002FDTDs\u002FPropertyList-1.0.dtd\">\n\u003Cplist version=\"1.0\">\n\u003Cdict>\n    \u003Ckey>PayloadContent\u003C\u002Fkey>\n    \u003Carray>\n        \u003Cdict>\n            \u003Ckey>PayloadType\u003C\u002Fkey>\n            \u003Cstring>com.apple.MCX.FileVault2\u003C\u002Fstring>\n            \u003Ckey>PayloadIdentifier\u003C\u002Fkey>\n            \u003Cstring>com.yourcompany.filevault\u003C\u002Fstring>\n            \u003Ckey>PayloadUUID\u003C\u002Fkey>\n            \u003Cstring>A1B2C3D4-E5F6-7890-ABCD-EF1234567890\u003C\u002Fstring>\n            \u003Ckey>PayloadVersion\u003C\u002Fkey>\n            \u003Cinteger>1\u003C\u002Finteger>\n            \u003Ckey>Enable\u003C\u002Fkey>\n            \u003Cstring>On\u003C\u002Fstring>\n            \u003Ckey>Defer\u003C\u002Fkey>\n            \u003Ctrue\u002F>\n            \u003Ckey>DeferForceAtUserLoginMaxBypassAttempts\u003C\u002Fkey>\n            \u003Cinteger>0\u003C\u002Finteger>\n            \u003Ckey>ShowRecoveryKey\u003C\u002Fkey>\n            \u003Cfalse\u002F>\n            \u003Ckey>UseRecoveryKey\u003C\u002Fkey>\n            \u003Ctrue\u002F>\n        \u003C\u002Fdict>\n    \u003C\u002Farray>\n    \u003Ckey>PayloadDisplayName\u003C\u002Fkey>\n    \u003Cstring>FileVault Enforcement\u003C\u002Fstring>\n    \u003Ckey>PayloadIdentifier\u003C\u002Fkey>\n    \u003Cstring>com.yourcompany.filevault.profile\u003C\u002Fstring>\n    \u003Ckey>PayloadType\u003C\u002Fkey>\n    \u003Cstring>Configuration\u003C\u002Fstring>\n    \u003Ckey>PayloadUUID\u003C\u002Fkey>\n    \u003Cstring>F1E2D3C4-B5A6-7890-FEDC-BA0987654321\u003C\u002Fstring>\n    \u003Ckey>PayloadVersion\u003C\u002Fkey>\n    \u003Cinteger>1\u003C\u002Finteger>\n\u003C\u002Fdict>\n\u003C\u002Fplist>\n```\n\n### 4.4 macOS firewall enforcement\n\n```bash\n# Enable firewall via MDM command or script\nsudo \u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --setglobalstate on\nsudo \u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --setstealthmode on\nsudo \u002Fusr\u002Flibexec\u002FApplicationFirewall\u002Fsocketfilterfw --setallowsigned enable\n```\n\n---\n\n## 5. Windows Enrollment\n\n### 5.1 Azure AD Join + Intune auto-enrollment\n\n```powershell\n# Check current join status\ndsregcmd \u002Fstatus\n\n# Join Azure AD (user will be prompted for credentials)\nStart-Process \"ms-settings:workplace\"\n\n# Verify Intune enrollment\nGet-WmiObject -Namespace \"root\\cimv2\\mdm\\dmmap\" `\n  -Class \"MDM_DevDetail_Ext01\" | Select DeviceID\n```\n\n### 5.2 Windows Autopilot hardware hash collection\n\n```powershell\n# Collect hardware hash for Autopilot registration\nInstall-Script -Name Get-WindowsAutoPilotInfo -Force\nGet-WindowsAutoPilotInfo -OutputFile C:\\temp\\autopilot.csv\n\n# Upload autopilot.csv to Intune > Devices > Windows Enrollment > Devices\n```\n\n### 5.3 BitLocker enforcement via Group Policy or Intune\n\n```powershell\n# Enable BitLocker on the OS drive with TPM\nEnable-BitLocker -MountPoint \"C:\" `\n  -EncryptionMethod XtsAes256 `\n  -TpmProtector\n\n# Add a recovery password and back it up to Azure AD\nAdd-BitLockerKeyProtector -MountPoint \"C:\" -RecoveryPasswordProtector\nBackupToAAD-BitLockerKeyProtector -MountPoint \"C:\" `\n  -KeyProtectorId (Get-BitLockerVolume -MountPoint \"C:\").KeyProtector[1].KeyProtectorId\n\n# Verify encryption status\nGet-BitLockerVolume | Select-Object MountPoint, VolumeStatus, EncryptionPercentage\n```\n\n### 5.4 Windows Firewall baseline\n\n```powershell\n# Ensure all profiles are enabled\nSet-NetFirewallProfile -Profile Domain,Public,Private -Enabled True\n\n# Block all inbound by default, allow outbound\nSet-NetFirewallProfile -Profile Domain,Public,Private `\n  -DefaultInboundAction Block `\n  -DefaultOutboundAction Allow\n\n# Allow specific inbound rules (example: RDP only from VPN subnet)\nNew-NetFirewallRule -DisplayName \"Allow RDP from VPN\" `\n  -Direction Inbound -Protocol TCP -LocalPort 3389 `\n  -RemoteAddress 10.0.0.0\u002F8 -Action Allow\n```\n\n---\n\n\n## Contents\n\n- [6. Security Policies — Cross-Platform](references\u002Fdetails.md)\n- [7. Software Deployment](references\u002Fdetails.md)\n- [8. Compliance Checks with osquery](references\u002Fdetails.md)\n- [9. Remote Wipe & Lock](references\u002Fdetails.md)\n- [10. Onboarding Automation — Zero-Touch Enrollment](references\u002Fdetails.md)\n- [Quick Reference](references\u002Fdetails.md)\n\n## When to Use\n\n- You are provisioning, configuring, or troubleshooting the infrastructure component covered by this skill (servers, storage, databases, networking, cloud, local AI).\n\n## Limitations\n\n- Infrastructure commands can disrupt services: confirm target host\u002Fscope and have backups\u002Fsnapshots before mutating state.\n- Docs-only import: upstream scripts and templates not bundled.\n\n",{"name":5,"risk":26,"source":43,"license":14,"category":44,"metadata":45,"date_added":48,"description":7,"source_repo":49,"source_type":30,"compatibility":50,"license_source":51},"https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","devops",{"author":46,"version":47},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Requires the relevant OS\u002Fplatform tooling and privileged access where noted. Docs-only; helper scripts and templates not bundled.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fmdm-device-management","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill mdm-device-management",{"tool":63,"command":64},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill mdm-device-management",{"tool":66,"command":67},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill mdm-device-management","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fmdm-device-management\u002FSKILL.md",true,[71],{"path":72,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":75,"sourceHtmlUrl":76},"references\u002Fdetails.md","REFERENCE","参考文档",12075,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fmdm-device-management\u002Freferences\u002Fdetails.md",[78,101,125,149,177,201],{"skillNo":79,"name":80,"nameZh":6,"description":81,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":82,"categories":83,"keywords":89,"publishedAt":38},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[84],{"categoryNo":85,"categoryName":86,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[90,91,92,93,94,95,80,96,34,33,97,32,30,29,98,26,99,25,24,100],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","configure","active","scope","implementing",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":38},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[108,109,110,111,112,113,114,115,116,117,118,119,120,32,121,30,122,123,26,124],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":38},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[132,133,134,135,136,137,138,36,139,140,141,142,143,30,29,144,145,146,147,148],"transcript","youtube transcript","youtube","safe","github","codex","research","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":166,"publishedAt":38},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[155,158,161],{"categoryNo":156,"categoryName":157,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":159,"categoryName":160,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":162,"categoryName":163,"taxonomyType":164,"taxonomyTypeDesc":165},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[132,133,134,167,135,168,136,137,36,169,170,171,172,141,173,30,29,174,175,176],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":187,"publishedAt":38},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[183,186],{"categoryNo":184,"categoryName":185,"taxonomyType":87,"taxonomyTypeDesc":88},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":159,"categoryName":160,"taxonomyType":87,"taxonomyTypeDesc":88},[134,188,189,112,135,190,191,192,193,36,171,194,195,196,197,29,198,144,199,200],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":38},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[207],{"categoryNo":156,"categoryName":157,"taxonomyType":87,"taxonomyTypeDesc":88},[209,134,210,211,135,168,169,212,213,170,171,172,141,214,173,30,29,174,215,147],"youtube full","full","google","server","dlp","credits","automatic"]