Building RFF

Notes from building hosted Windows fleet management - the deployment internals, the security plumbing, and the Win32 rabbit holes we fell down so you don't have to.

Shipping notes and recent releases live on the changelog →

• Unlocking a Mac from a browser tab, then handing it a config profile (no MDM required) Oct 16, 2026

  How RFF unlocks a locked Mac from a browser tab, why the login window is still view only, and how it gets configuration profiles onto Macs without an MDM.

• Removing the Windows apps that won't uninstall: VPN drivers, Npcap, and the credential provider on every sign-in Oct 14, 2026

  Force uninstall a Windows app that won't die: VPN adapters that come back, kernel drivers, and SSO credential providers, removed in an order that locks nobody out.

• Making the Mac and Linux first-class platforms in RFF Oct 13, 2026

  RFF had Mac and Linux agents before it had real Mac and Linux support. What a pass through the product found on each, what works now, and where they work differently on purpose.

• How to audit the 2023 Secure Boot certs across a Windows fleet Sep 18, 2026

  The registry value everyone checks reports what Windows attempted, not what the firmware accepted. Scripts to read the UEFI db directly, on one machine or across a fleet.

• The setup.exe field manual: every switch, the exit codes, and the trick that decodes them Sep 4, 2026

  Microsoft's setup.exe reference moved and half the internet decided it was deleted. Here it is: the full switch table, how the result and extend codes are structured, the mosetup errors, /ReflectDrivers for third-party encryption, and the shortcut that turns a hex code into a plain English sentence.

• Matching installed software to CVEs (why 81% of our index couldn't match anything) Aug 31, 2026

  Turning an Add/Remove Programs list into a CVE list sounds like a join. NVD's version encoding, Java's two version schemes, and a bound that can never be satisfied say otherwise.

• Group Policy Preferences is the thing nobody replaced Aug 26, 2026

  Drive maps, printers, shortcuts, folders. GPP did all of it in the user's session with item-level targeting, and Intune's answer is a PowerShell script that runs as the wrong user. Building it properly turned up a bug where Windows quietly rewrites your shortcut so your cleanup code can never delete it.

• Three SCIM bugs a test suite can't find Aug 21, 2026

  Our SCIM 2.0 endpoint passed its tests and returned valid JSON. Then we pointed a real Entra ID tenant at it. All three bugs that surfaced were invisible to unit tests, and one of them was invisible to the human eye.

• Group Policy without a domain controller: parsing 4,641 settings out of your own ADMX Aug 16, 2026

  Every Windows box already ships the full Group Policy catalog as XML. We parse the customer's own ADMX instead of building a settings database, and it turned up a bug that made every Chrome list policy silently do nothing.

• From USB stick to enrolled machine, hands off - and the six bugs that only appeared when we booted it Aug 14, 2026

  Bare-metal Windows imaging that ends with the machine already in your console. Six bugs that didn't exist until a real machine booted, and what we changed so nobody finds them twice.

• Letting an AI live-fire test my RMM: 118 tests, 25 findings, and the guardrails that kept it sane Aug 9, 2026

  Two overnight runs of agentic AI against a staging clone of RFF: real bugs found (including one quietly destroying inventory), a 79% false-alarm rate, and the safeguards that made unattended testing survivable.

• 'Temporary' local admin usually isn't. Here's how we made it actually expire. Aug 7, 2026

  Adding someone to the Administrators group for 'ten minutes' leaves an admin token that lives until logoff and a process that outlives the window. RFF grants time-boxed admin with an S4U logon token instead - no group change, and revoke kills the whole tree. Plus the three bugs it took to get there.

• A green job and no software: what winget's exit 0 doesn't tell you Jul 30, 2026

  winget returned 0x00000000. The job went green. Postman was not installed. Here's the exit code that told us why, and the test harness we had to build to find it.

• RFF watches the machine now Jul 22, 2026

  RFF started as a really-fast Windows software deployment tool. Over the last stretch it grew the un-sexy RMM primitives - checks, alerts, remediation, remote everything - without the per-endpoint price and console sprawl the big RMMs charge for.

• ClickFix, after the paste: the persistence it leaves behind Jul 19, 2026

  Everyone talks about the fake CAPTCHA. Almost nobody talks about the Run key, the scheduled task, and the new local admin it writes ten seconds later - which is exactly the part fleet inventory can see.

• "Who installed that?" - building a fleet change feed where the hard part was the silence Jul 19, 2026

  Every incident starts with 'what changed?' and every fleet tool makes you answer it one device at a time. Diffing inventory took an afternoon. Making the diff quiet enough to trust took the rest of the week.

• The stubborn-installer field manual: silent switches, exit codes, lying logs, and detection Jul 13, 2026

  The full lifecycle of deploying software that fights back - fingerprint the engine to find undocumented switches, read exit codes right, catch installers lying about success, and write detection that doesn't flap.

• When /quiet lies: tearing down a WiX Burn installer that ignores its own silent flag Jul 11, 2026

  An installer that pops a full GUI no matter what silent flag you pass. We tear the WiX Burn bundle apart - stub, manifest, custom bootstrapper - and pull out the MSI that installs silently after all.

• The free tier with a trapdoor (and the one with a ramp) Jul 4, 2026

  Action1 gives you 200 free endpoints, RFF gives you 100. On the spec sheet I lose. So let's talk about what happens on endpoint 201 - and endpoint 101.

• The five registry values behind CIS Windows L1 credential-theft hardening Jul 1, 2026

  RunAsPPL, WDigest, SMB signing, NTLM/LM, anonymous enumeration - the exact CIS Windows L1 registry values that close credential theft, and how RFF tracks drift.

• Why our config baselines are editable and versioned - and why we didn't use Git Jun 30, 2026

  A captured baseline is a photograph. Here's how we built native, editable database versioning into RFF's baselines - and why 'just use Git' was the wrong reflex.

• Shipping a firmware change you can't roll back Jun 30, 2026

  Microsoft's KB5068202 Secure Boot cert update is a one-way firmware change that can brick a PC. Here's our opt-in, ring-staged rollout with a silent-machine canary.

• Finding shadow AI on a Windows fleet without reading a single prompt Jun 18, 2026

  Your AI inventory's blind spot is the models running locally on workstations. Not a data-leak story, an attestation one. Here's how RFF closes it, content-blind.

• Every feature in RFF is a grudge Jun 15, 2026

  Why I built RFF: an impatient hospital desktop engineer's grudge list against SCCM, PDQ, Tanium, and Intune - and the fast RMM that came out of it.

• The cursor that freezes on admin windows (UIPI, uiAccess, and the outage in between) Jun 12, 2026

  Streaming a desktop breaks the moment an elevated window takes focus and your input goes dead. The fix is a uiAccess UIPI bypass - and the token-class bug behind it.

• Enrolling a Windows agent with one PowerShell line (and sealing the credential with DPAPI) Jun 4, 2026

  Behind 'irm | iex' is a four-step credential lifecycle: mint a single-use token, redeem a per-device key, seal it with DPAPI, blank the cleartext. Here's the design.

• How we built fleet-wide software uninstall (registry vs winget, running uninstallers as SYSTEM) Jun 4, 2026

  Search your fleet's software, pick an app, uninstall it everywhere. The hard part: QuietUninstallString, the WaitForExit hang, and winget's DLL problem under SYSTEM.

• Shipping Postgres Row-Level Security in a multi-tenant .NET app (and the footguns we hit) Jun 4, 2026

  We flipped Postgres Row-Level Security live in a multi-tenant ASP.NET Core + EF Core app. Three footguns that would have been silent outages - and how we dodged them.

• Driving the Windows login screen from a browser tab (the secure-desktop rabbit hole) May 31, 2026

  Controlling the Windows logon screen when nobody is signed in means driving a desktop your code doesn't own, as SYSTEM, outbound-only. Here's the Win32 rabbit hole.

• A deploy silently broke everyone's MFA - encrypting the Data Protection key ring May 28, 2026

  A deploy wiped our ASP.NET Core Data Protection key ring and silently broke everyone's MFA. The fix: persist it, encrypt with a cert, fail closed, migrate live.

• How we cut agentless Windows deploys from 183s to 26s (by deleting sc.exe) May 28, 2026

  Six sc.exe shellouts cost ~22s each as SYSTEM. Holding one SMB session and calling the Service Control Manager API directly cut our agentless bootstrap 183s to 26s.