from @pudquick

It would just have to do managed environment variables for Windows instead.

Add a new chef-managed directory, put your shims in there.

return {} unless node.profile_installed?('ProfileDisplayName', 'Device Manager')

The MDM profile is localized, so this fails.

We should change the use of blacklist to denylist in cpe_chefctl.

See: https://github.com/uber/cpe-chef-cookbooks/blob/876737a2ca5afd06516899d687091476bdc0fd0d/cpe_chefctl/files/default/chefctl.rb#L449

Recently, I challenged a support engineer to break our management tools on his Mac.

He succeeded - and the only tool that could not be easily repaired from a basis of MDM enrollment was, surprisingly, hubcli. Workspace One continues to function without it.

Since this cookbook already supports installing the agent, and is smart about the existence of hubcli, I think it would be neat if it provided something like this:

node['cpe_workspaceone']['remediate_missing_hubcli'] = true

If true, cpe_workspaceone would reinstall the package. This also leaves the door open for sophisticated health checks.

because of the use of standard launchd over cpe_launchd, when manage is flipped to false, the launchdaemon is not removed from the device.

this could cause artifacts to still be uploaded to a server.

I see that your repo required some facebook cookbooks to function, but one of them is missing (in FB's repo) : cpe_utils.

Update cpe_osquery to write osquery.conf files for scheduled queries, etc