Open source device management (MDM): how to manage Windows, Mac and Linux laptops with Fleet

While a company’s computers fit on one hand, everyone knows which is which and what is on it. Once there are fifteen laptops coming and going from the office, running Windows, the odd Mac and the odd Linux machine, nobody can say without checking them one by one which have an encrypted disk, which are behind on updates or who has installed what. That is what device management tools, known as MDM, are for. In this article we explain what they solve, how Fleet, an open source option, works, and when it is not worth it.

What an MDM solves

In a professional practice or a small business, the questions are simple and nearly always come too late: which laptop did the person who left have? Was the one that got lost encrypted? How many computers still lack the latest Windows update? With an MDM, the answers are on a dashboard rather than in someone’s memory.

In a software company, the reason is usually different: customers and audits (ISO 27001, the Spanish ENS or security questionnaires) ask about the development team’s laptops. You have to show that they have an encrypted disk, screen lock turned on and an up-to-date system, and that you know what software is installed and whether it has known vulnerabilities.

In both cases, an MDM covers the same ground:

• Inventory: which computers there are, with what hardware, which operating system and which programs.
• Updates: which computers are behind and, depending on the tool, enforcing them.
• Disk encryption: checking that it is on and keeping the recovery keys.
• Configuration: screen lock, firewall and other rules applied the same way everywhere.
• Vulnerabilities: which installed programs have known security flaws.

How Fleet works

Fleet has two parts. Each computer runs its agent, fleetd, which includes osquery: a tool that lets you query the state of the operating system as if it were a database, using SQL. A server runs Fleet, which receives the data from all the agents, stores it in MySQL, uses Redis for queues and provides the dashboard, an API and the fleetctl command-line tool.

On top of that, the most useful feature is policies: yes-or-no questions asked of every computer. For example, this one checks that drive C: on a Windows computer is protected with BitLocker:

SELECT 1 FROM bitlocker_info WHERE drive_letter = 'C:' AND protection_status = 1;

If the query returns a row, the computer passes; if not, it appears on the list of those that fail. Policies like this check encryption, the firewall, the OS version or whether a given program is installed. When a computer fails, you can run a script on it to fix it, by hand or automatically the first time it fails the policy; re-running it on every check while it keeps failing is Fleet Premium.

Fleet also matches the software installed on each computer against databases of known vulnerabilities (CVEs) and shows which programs need updating and where. And the whole configuration, policies, queries, scripts and profiles, can live in a repository with GitOps, so every change is reviewed and can be rolled back.

For Macs, iPhones and iPads, Fleet also works as an Apple MDM, which requires connecting it to the Apple push notification service with a certificate that is renewed every year. On Windows it can enrol computers in its MDM with its own agent, without needing Intune.

What is free and what is paid

Fleet has a free version under the MIT licence and paid features, Fleet Premium, under a commercial licence. According to the vendor’s own feature table, the line falls roughly here:

For many companies, the free version is enough: what matters is knowing which computers fail, and fixing them with a script or by hand. If you need encryption or updates to be enforced automatically, or to be able to wipe a stolen laptop, you need Premium, which is licensed per number of computers.

On your own server or in the vendor’s cloud

Fleet can be installed on any server: it needs MySQL, Redis and a TLS certificate. The vendor also hosts it as a service, but according to its documentation only for deployments of more than 700 computers, so for a small business or a mid-sized software company the realistic option is to run it on your own server or in your cloud account.

One important detail: laptops must be able to reach the server from anywhere, not just from the office. If the server is only reachable inside the office network, computers stop reporting as soon as people take them home.

Limits worth knowing

• It is not an antivirus or a threat detection system. Fleet tells you the state of each computer; detecting attacks needs another tool, such as a SIEM.
• Someone has to look at the results. A dashboard full of failing policies that nobody reviews protects nothing.
• The Apple certificate expires every year. If it is renewed late, or with a different Apple account, Macs stop receiving commands.
• Enforcement costs money. The free version checks and fixes; enforcing is Premium.
• It is one more server to maintain. Database, backups, updates and certificate.

When it does not pay off

With three or four computers, an inventory spreadsheet and a regular check are usually enough. If you already pay for Microsoft 365 with Intune and every computer runs Windows, it is worth using that before adding another tool. Fleet makes more sense when you have computers on several operating systems, when you are asked for evidence that laptops meet certain rules, or when you want computer data to stay on your own server.

On the managed Fleet page we explain how we set it up and maintain it. In an office, it is part of our IT support for small businesses; in a software company, the laptop inventory complements vulnerability management. If you want to know whether it pays off for you, send us an email.

Frequently asked questions

Does Fleet see what each person does?

No. It collects computer data: hardware, operating system, programs, configuration and policy results. Fleet states that it does not collect keystrokes, emails or webcam footage. Even so, it is worth telling your team what is collected and why.

Does it work for servers too?

Yes. The agent works the same way on Linux and Windows servers, and the same policies can check their configuration. On servers, though, MDM matters less than inventory and policies.

Do you need Intune to manage Windows computers?

No. Fleet can enrol Windows computers with its own agent. Only if you want automatic enrolment with Entra or Autopilot do you need Fleet Premium and a Microsoft Entra ID P1 licence per user.

References

• Fleet on GitHub: code, licence and supported platforms.
• Fleet: free version and Fleet Premium features.
• Fleet documentation: Reference architectures, server requirements (MySQL, Redis and TLS).
• Fleet: Apple MDM setup and Windows MDM setup.