Repository: fleetdm/fleet
Pull request #27307: Cleanup scripts
Author: login: noahtalerman
Created: 2025-03-19T19:26:04Z | Merged: 2025-03-27T21:43:53Z

- Move duplicate scripts out of `scripts/mdm/` and into `it-and-security/` so we have one version that we can continue to iterate and improve.
- Remove no longer used scripts out of `scripts/mdm/`



Diff:
diff --git a/.github/workflows/fleet-and-orbit.yml b/.github/workflows/fleet-and-orbit.yml
index 887ac1dbced..e1573239c10 100644
--- a/.github/workflows/fleet-and-orbit.yml
+++ b/.github/workflows/fleet-and-orbit.yml
@@ -373,7 +373,7 @@ jobs:
 
       - name: Uninstall pkg
         run: |
-          sudo ./orbit/tools/cleanup/cleanup_macos.sh
+          sudo ./it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
 
   orbit-ubuntu:
     timeout-minutes: 60
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index bdde3fc2753..afa34630e60 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -238,7 +238,7 @@ jobs:
 
     - name: Uninstall Orbit
       run: |
-        sudo ./orbit/tools/cleanup/cleanup_macos.sh
+        sudo ./it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
 
   orbit-ubuntu:
     timeout-minutes: 10
diff --git a/articles/lock-wipe-hosts.md b/articles/lock-wipe-hosts.md
index fe5f3143ab5..5616e35c3a0 100644
--- a/articles/lock-wipe-hosts.md
+++ b/articles/lock-wipe-hosts.md
@@ -58,7 +58,7 @@ Add the `--help` flag to any command to learn more about how to use it.
 
 For macOS hosts, the `mdm unlock` command will return the six-digit PIN, which must be typed into the device in order to finish unlocking it. 
 
-*For Windows and Linux hosts, a script will run as part of the lock and unlock actions. Details for each script can be found in GitHub for [Windows](https://github.com/fleetdm/fleet/tree/main/scripts/mdm/windows) and [Linux](https://github.com/fleetdm/fleet/tree/main/scripts/mdm/linux) hosts.
+*For Windows and Linux hosts, a script will run as part of the lock and unlock actions. Details for each script can be found in GitHub for [Windows](https://github.com/fleetdm/fleet/tree/main/ee/server/service/embedded_scripts/windows_lock.ps1) and [Linux](https://github.com/fleetdm/fleet/tree/main/ee/server/service/embedded_scripts/linux_lock.sh) hosts.
 
 <meta name="articleTitle" value="Lock and wipe hosts">
 <meta name="authorFullName" value="JD Strong">
diff --git a/scripts/mdm/linux/linux-change-password.sh b/it-and-security/lib/linux/scripts/change-password-linux.sh
similarity index 100%
rename from scripts/mdm/linux/linux-change-password.sh
rename to it-and-security/lib/linux/scripts/change-password-linux.sh
diff --git a/it-and-security/lib/linux/scripts/uninstall-fleetd-linux.sh b/it-and-security/lib/linux/scripts/uninstall-fleetd-linux.sh
index f4990e376ee..501d5feb0dc 100644
--- a/it-and-security/lib/linux/scripts/uninstall-fleetd-linux.sh
+++ b/it-and-security/lib/linux/scripts/uninstall-fleetd-linux.sh
@@ -1,5 +1,5 @@
 #!/bin/bash
-# Please don't delete. This script is referenced in the guide here: https://fleetdm.com/guides/how-to-uninstall-fleetd
+# Please don't delete. This script is used in tests (tools/tuf/test/migration/migration_test.sh), workflors (.github/workflows/), and in the guide here: https://fleetdm.com/guides/how-to-uninstall-fleetd
 
 if [ $(id -u) -ne 0 ]; then
     echo "Please run as root"
diff --git a/scripts/macos-install-wine.sh b/it-and-security/lib/macos/scripts/install-wine.sh
similarity index 93%
rename from scripts/macos-install-wine.sh
rename to it-and-security/lib/macos/scripts/install-wine.sh
index daa7c596795..64eb473e0ff 100755
--- a/scripts/macos-install-wine.sh
+++ b/it-and-security/lib/macos/scripts/install-wine.sh
@@ -1,5 +1,6 @@
-#!/usr/bin/env bash
+#!/bin/bash
 
+# Please don't delete. This script is linked to, as a redirect, from fleetctl and the Fleet website.
 
 set -eo pipefail
 
diff --git a/it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh b/it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
old mode 100644
new mode 100755
diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml
index 6800db9bc84..7db949c0509 100644
--- a/it-and-security/teams/workstations-canary.yml
+++ b/it-and-security/teams/workstations-canary.yml
@@ -133,6 +133,7 @@ controls:
     - path: ../lib/macos/scripts/system-maintenance.sh
     - path: ../lib/macos/scripts/santa-block-script.sh
     - path: ../lib/macos/scripts/uninstall-fleetd-macos.sh
+    - path: ../lib/macos/scripts/install-wine.sh
     - path: ../lib/windows/scripts/turn-off-mdm.ps1
     - path: ../lib/windows/scripts/install-bitdefender.ps1
     - path: ../lib/windows/scripts/enable-ms-defender.ps1
diff --git a/it-and-security/teams/workstations.yml b/it-and-security/teams/workstations.yml
index 7422aea25de..0d54d040c8d 100644
--- a/it-and-security/teams/workstations.yml
+++ b/it-and-security/teams/workstations.yml
@@ -82,6 +82,7 @@ controls:
     - path: ../lib/macos/scripts/see-automatic-enrollment-profile.sh
     - path: ../lib/macos/scripts/remove-old-nudge.sh
     - path: ../lib/macos/scripts/uninstall-fleetd-macos.sh
+    - path: ../lib/macos/scripts/install-wine.sh
     - path: ../lib/windows/scripts/uninstall-fleetd-windows.ps1
     - path: ../lib/windows/scripts/turn-off-mdm.ps1
     - path: ../lib/windows/scripts/create-admin-user.ps1
diff --git a/orbit/tools/cleanup/cleanup_macos.sh b/orbit/tools/cleanup/cleanup_macos.sh
deleted file mode 100755
index 5141a968502..00000000000
--- a/orbit/tools/cleanup/cleanup_macos.sh
+++ /dev/null
@@ -1,58 +0,0 @@
-#!/bin/sh
-
-if [ $(id -u) -ne 0 -a -z "$GITHUB_ACTIONS" ]; then
-    echo "Please run as root"
-    exit 1
-fi
-
-function remove_fleet {
-    set -x
-
-    rm -rf /Library/LaunchDaemons/com.fleetdm.orbit.plist /var/lib/orbit /usr/local/bin/orbit /var/log/orbit /opt/orbit/
-
-    pkgutil --forget com.fleetdm.orbit.base.pkg || true
-
-    launchctl stop com.fleetdm.orbit
-    launchctl unload /Library/LaunchDaemons/com.fleetdm.orbit.plist
-
-    pkill fleet-desktop || true
-
-    # Check MDM status on a macOS device
-    mdm_status=$(profiles status -type enrollment)
-
-    # Check for MDM enrollment status and cleanup enrollment profile
-    if echo "$mdm_status" | grep -q "MDM enrollment: Yes"; then
-        echo "This Mac is MDM enrolled. Removing enrollment profile."
-        profiles remove -identifier com.fleetdm.fleet.mdm.apple
-    elif echo "$mdm_status" | grep -q "MDM enrollment: No"; then
-        echo "This Mac is not MDM enrolled."
-    else
-        echo "MDM status is unknown."
-    fi
-
-}
-
-if [ "$1" = "remove" ]; then
-    # We are in the detached child process
-    # Give the parent process time to report the success before removing
-    echo "inside remove process" >>/tmp/fleet_remove_log.txt
-    sleep 15
-    if [ -z "$GITHUB_ACTIONS" ]; then
-        # We are root
-        remove_fleet >>/tmp/fleet_remove_log.txt 2>&1
-    else
-        # Inside a github action, sudo is passwordless
-        sudo remove_fleet >>/tmp/fleet_remove_log.txt 2>&1
-    fi
-else
-    # We are in the parent shell, start the detached child and return success
-    echo "Removing fleet, system will be unenrolled in 15 seconds..."
-    echo "Executing detached child process"
-    if [ -z "$GITHUB_ACTIONS" ]; then
-        # We are root
-        bash -c "bash $0 remove >/dev/null 2>/dev/null </dev/null &"
-    else
-        # We are in a github action
-        sudo bash -c "bash $0 remove >/dev/null 2>/dev/null </dev/null &"
-    fi
-fi
diff --git a/scripts/mdm/windows/windows-change-password.ps1 b/scripts/mdm/windows/windows-change-password.ps1
deleted file mode 100644
index 43cca1128e9..00000000000
--- a/scripts/mdm/windows/windows-change-password.ps1
+++ /dev/null
@@ -1,52 +0,0 @@
-# PowerShell script to log off all users and change their passwords
-
-# Function to generate a random password
-function Generate-Password {
-    param (
-        [int]$length = 12
-    )
-    $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_-+=<>?/"
-    $password = -join ((1..$length) | ForEach-Object { Get-Random -Maximum $chars.length } | ForEach-Object { $chars[$_]} )
-    return $password
-}
-
-# Log off all non-administrative users
-$loggedOffUsers = @{}
-Get-WmiObject -Class Win32_UserProfile | Where-Object { $_.Special -eq $false } | ForEach-Object {
-    $username = $_.LocalPath.Split('\')[-1]
-    if ($username -ne "Administrator" -and $username -ne $env:USERNAME -and -not $loggedOffUsers.ContainsKey($username)) {
-        try {
-            $userSessions = query user | Where-Object { $_ -match "\b$username\b" }
-            foreach ($session in $userSessions) {
-                if ($session -match "\s+(\d+)\s+Disc\s+") {
-                    # Disconnected sessions can't be logged off
-                    continue
-                }
-                elseif ($session -match "\s+(\d+)\s+") {
-                    $sessionID = $matches[1]
-                    logoff $sessionID
-                    $loggedOffUsers[$username] = $true
-                    Write-Host "Logged out user: $username"
-                }
-            }
-        } catch {
-            Write-Host "Could not log off user: $username. Error: $($_.Exception.Message)"
-        }
-    }
-}
-
-# Get all local user accounts except built-in accounts like 'Administrator'
-$users = Get-LocalUser | Where-Object { $_.Name -notlike "Administrator" -and $_.PrincipalSource -eq "Local" }
-
-# Change password for each user and output the new password
-foreach ($user in $users) {
-    $newPassword = Generate-Password -length 12
-    $securePassword = ConvertTo-SecureString $newPassword -AsPlainText -Force
-
-    try {
-        Set-LocalUser -Name $user.Name -Password $securePassword
-        Write-Host "Password for user $($user.Name) changed successfully. New Password: $newPassword"
-    } catch {
-        Write-Host "Failed to change password for user $($user.Name)"
-    }
-}
diff --git a/scripts/mdm/windows/windows-disable-administrator.ps1 b/scripts/mdm/windows/windows-disable-administrator.ps1
deleted file mode 100644
index de66080e7b2..00000000000
--- a/scripts/mdm/windows/windows-disable-administrator.ps1
+++ /dev/null
@@ -1,8 +0,0 @@
-# PowerShell script to disable the Administrator account
-
-# Run this script as an administrator
-
-# Disable the Administrator account
-Disable-LocalUser -Name "Administrator"
-
-Write-Host "Administrator account has been disabled."
diff --git a/scripts/mdm/windows/windows-enable-administrator.ps1 b/scripts/mdm/windows/windows-enable-administrator.ps1
deleted file mode 100644
index 13c48b04fea..00000000000
--- a/scripts/mdm/windows/windows-enable-administrator.ps1
+++ /dev/null
@@ -1,29 +0,0 @@
-# PowerShell script to enable the Administrator account and set a random, secure password
-
-# Run this script as an administrator
-
-# Function to generate a random password
-function Generate-Password {
-    param (
-        [int]$length = 12
-    )
-    $chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_-+=<>?/"
-    $password = -join ((1..$length) | ForEach-Object { Get-Random -Maximum $chars.length } | ForEach-Object { $chars[$_]} )
-    return $password
-}
-
-# Generate a random password
-$password = Generate-Password -length 12
-
-# Convert the password to a SecureString
-$securePassword = ConvertTo-SecureString $password -AsPlainText -Force
-
-# Enable the Administrator account
-Enable-LocalUser -Name "Administrator"
-
-# Set the generated password for the Administrator account
-Set-LocalUser -Name "Administrator" -Password $securePassword
-
-# Output the password
-Write-Host "Administrator account has been enabled."
-Write-Host "Generated Password: $password"
diff --git a/scripts/mdm/windows/windows-lock.ps1 b/scripts/mdm/windows/windows-lock.ps1
deleted file mode 100644
index 98f3e785cfa..00000000000
--- a/scripts/mdm/windows/windows-lock.ps1
+++ /dev/null
@@ -1,47 +0,0 @@
-# PowerShell script to log off all non-administrative users and disable their accounts
-
-# Log off all non-administrative users
-$loggedOffUsers = @{}
-Get-WmiObject -Class Win32_UserProfile | Where-Object { $_.Special -eq $false } | ForEach-Object {
-    $username = $_.LocalPath.Split('\')[-1]
-    if ($username -ne "Administrator" -and $username -ne $env:USERNAME -and -not $loggedOffUsers.ContainsKey($username)) {
-        try {
-            $userSessions = query user | Where-Object { $_ -match "\b$username\b" }
-            foreach ($session in $userSessions) {
-                if ($session -match "\s+(\d+)\s+Disc\s+") {
-                    # Disconnected sessions can't be logged off
-                    continue
-                }
-                elseif ($session -match "\s+(\d+)\s+") {
-                    $sessionID = $matches[1]
-                    logoff $sessionID
-                    $loggedOffUsers[$username] = $true
-                    Write-Host "Logged out user: $username"
-                }
-            }
-        } catch {
-            Write-Host "Could not log off user: $username. Error: $($_.Exception.Message)"
-        }
-    }
-}
-
-# Disable all non-administrative local user accounts
-Get-LocalUser | Where-Object { $_.Enabled -eq $true -and $_.Name -ne "Administrator" } | ForEach-Object {
-    $username = $_.Name
-    Disable-LocalUser -Name $username
-    Write-Host "Disabled account for $username"
-}
-
-# Disable additional AD logins
-New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 3 -PropertyType DWORD -Force
-
-# Disable cached logins for AD/Azure/Entra accounts
-New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 0 -PropertyType String -Force
-
-Write-Host "All local non-administrative users have been logged out and their accounts disabled."
-Write-Host "Logging in with other Microsoft accounts has been disabled"
-Write-Host "Cached Logins have been disabled, disable the MDM-Enroled account to prevent further logins"
-
-# Shutdown computer in 15 seconds, after command has returned to fleet
-Write-Host "Shutting down in 15 seconds"
-shutdown /s /f /t 15
diff --git a/scripts/mdm/windows/windows-remove-fleetd.ps1 b/scripts/mdm/windows/windows-remove-fleetd.ps1
deleted file mode 100644
index 77a420781d2..00000000000
--- a/scripts/mdm/windows/windows-remove-fleetd.ps1
+++ /dev/null
@@ -1,132 +0,0 @@
-function Test-Administrator
-{
-    [OutputType([bool])]
-    param()
-    process {
-        [Security.Principal.WindowsPrincipal]$user = [Security.Principal.WindowsIdentity]::GetCurrent();
-        return $user.IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator);
-    }
-}
-
-# borrowed from Jeffrey Snover http://blogs.msdn.com/powershell/archive/2006/12/07/resolve-error.aspx
-function Resolve-Error-Detailed($ErrorRecord = $Error[0]) {
-  $error_message = "========== ErrorRecord:{0}ErrorRecord.InvocationInfo:{1}Exception:{2}"
-  $formatted_errorRecord = $ErrorRecord | format-list * -force | out-string
-  $formatted_invocationInfo = $ErrorRecord.InvocationInfo | format-list * -force | out-string
-  $formatted_exception = ""
-  $Exception = $ErrorRecord.Exception
-  for ($i = 0; $Exception; $i++, ($Exception = $Exception.InnerException)) {
-    $formatted_exception += ("$i" * 70) + "-----"
-    $formatted_exception += $Exception | format-list * -force | out-string
-    $formatted_exception += "-----"
-  }
-
-  return $error_message -f $formatted_errorRecord, $formatted_invocationInfo, $formatted_exception
-}
-
-#Stops Orbit service and related processes
-function Stop-Orbit {
-
-  # Stop Service
-  Stop-Service -Name "Fleet osquery" -ErrorAction "Continue"
-  Start-Sleep -Milliseconds 1000
-
-  # Ensure that no process left running
-  Get-Process -Name "orbit" -ErrorAction "SilentlyContinue" | Stop-Process -Force
-  Get-Process -Name "osqueryd" -ErrorAction "SilentlyContinue" | Stop-Process -Force
-  Get-Process -Name "fleet-desktop" -ErrorAction "SilentlyContinue" | Stop-Process -Force
-  Start-Sleep -Milliseconds 1000
-}
-
-#Remove Orbit footprint from registry and disk
-function Force-Remove-Orbit {
-
-  try {
-
-    #Stoping Orbit
-    Stop-Orbit
-
-    #Remove Service
-    $service = Get-WmiObject -Class Win32_Service -Filter "Name='Fleet osquery'"
-    if ($service) {
-      $service.delete() | Out-Null
-    }
-
-    #Removing Program files entries
-    $targetPath = $Env:Programfiles + "\\Orbit"
-    Remove-Item -LiteralPath $targetPath -Force -Recurse -ErrorAction "Continue"
-
-    #Remove HKLM registry entries
-    Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" -Recurse  -ErrorAction "SilentlyContinue" |  Where-Object {($_.ValueCount -gt 0)} | ForEach-Object {
-
-      # Filter for osquery entries
-      $properties = Get-ItemProperty $_.PSPath  -ErrorAction "SilentlyContinue" |  Where-Object {($_.DisplayName -eq "Fleet osquery")}
-      if ($properties) {
-
-        #Remove Registry Entries
-        $regKey = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" + $_.PSChildName
-
-        Get-Item $regKey -ErrorAction "SilentlyContinue" | Remove-Item -Force -ErrorAction "SilentlyContinue"
-
-        return
-      }
-    }
-  }
-  catch {
-    Write-Host "There was a problem running Force-Remove-Orbit"
-    Write-Host "$(Resolve-Error-Detailed)"
-    return $false
-  }
-
-  return $true
-}
-
-function Main {
-
-  try {
-    # Is Administrator check
-    if (-not (Test-Administrator)) {
-      Write-Host "Please run this script with adming privileges."
-      Exit -1
-    }
-
-    Write-Host "About to uninstall fleetd..."
-
-    if ($mode -eq "remove") {
-        # "remove" is received as argument to the script when called as the
-        # sub-process that will actually remove the fleet agent.
-
-        # sleep to give time to fleetd to send the script results to Fleet
-        Start-Sleep -Seconds 20
-        if (Force-Remove-Orbit) {
-            Write-Host "fleetd was uninstalled."
-            Exit 0
-        } else {
-            Write-Host "There was a problem uninstalling fleetd."
-            Exit -1
-        }
-    } else {
-        # when this script is executed from fleetd, it does not immediately
-        # remove the agent. Instead, it starts a new detached process that
-        # will do the actual removal. This is done to avoid the agent being
-        # killed by the removal process, which prevents it from sending the
-        # script execution results to Fleet, causing the script to remain
-        # "Pending" and being re-executed when/if the host reinstalls the
-        # agent.
-        #
-        # See https://github.com/fleetdm/fleet/issues/19197#issuecomment-2150020270
-        $execName = $MyInvocation.ScriptName
-        $proc = Start-Process -PassThru -FilePath "powershell" -WindowStyle Hidden -ArgumentList "-MTA", "-ExecutionPolicy", "Bypass", "-File", "$execName remove"
-        Start-Sleep -Seconds 5 # give time to process to start running
-        Write-Host "Removal process started: $($proc.Id)."
-    }
-
-  } catch {
-    Write-Host "Errorr: Entry point"
-    Write-Host "$(Resolve-Error-Detailed)"
-    Exit -1
-  }
-}
-
-$mode = $args[0]
-$null = Main
diff --git a/scripts/mdm/windows/windows-unenroll-mdm.ps1 b/scripts/mdm/windows/windows-unenroll-mdm.ps1
deleted file mode 100644
index 2ffc3be05d3..00000000000
--- a/scripts/mdm/windows/windows-unenroll-mdm.ps1
+++ /dev/null
@@ -1,27 +0,0 @@
-Add-Type -TypeDefinition @"
-using System;
-using System.Runtime.InteropServices;
-
-public class MdmRegistration
-{
-    [DllImport("mdmregistration.dll", SetLastError = true)]
-    public static extern int UnregisterDeviceWithManagement(IntPtr pDeviceID);
-
-    public static int UnregisterDevice()
-    {
-        return UnregisterDeviceWithManagement(IntPtr.Zero);
-    }
-}
-"@ -Language CSharp
-
-try {
-    $result = [MdmRegistration]::UnregisterDevice()
-
-    if ($result -ne 0) {
-        throw "UnregisterDeviceWithManagement failed with error code: $result"
-    }
-
-    Write-Host "Device unregistration called successfully."
-} catch {
-    Write-Error "Error calling UnregisterDeviceWithManagement: $_"
-}
diff --git a/scripts/mdm/windows/windows-unlock.ps1 b/scripts/mdm/windows/windows-unlock.ps1
deleted file mode 100644
index 21951cfffb0..00000000000
--- a/scripts/mdm/windows/windows-unlock.ps1
+++ /dev/null
@@ -1,20 +0,0 @@
-# PowerShell script to enable all disabled local user accounts
-
-# Get all local user accounts
-$localUsers = Get-LocalUser
-
-# Enable each disabled user account
-foreach ($user in $localUsers) {
-    if ($user.Enabled -eq $false) {
-        Enable-LocalUser -Name $user.Name
-        Write-Host "Enabled user account: $($user.Name)"
-    }
-}
-
-Write-Host "All disabled user accounts have been enabled."
-
-# Re-enable additional AD logins
-New-ItemProperty -Path "HKLM:\Software\Microsoft\PolicyManager\default\Settings\AllowSignInOptions" -Name 'value' -Value 0 -PropertyType DWORD -Force
-
-# Re-enable cached logins for AD/Azure/Entra accounts
-New-ItemProperty -Path "HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\" -Name 'CachedLogonsCount' -Value 10 -PropertyType String -Force
diff --git a/tools/tuf/test/migration/migration_test.sh b/tools/tuf/test/migration/migration_test.sh
index e81dd234786..142a8d0461a 100755
--- a/tools/tuf/test/migration/migration_test.sh
+++ b/tools/tuf/test/migration/migration_test.sh
@@ -47,7 +47,7 @@ prompt () {
 prompt "Please change 'const' to 'var' in orbit/pkg/update/update.go."
 
 echo "Uninstalling fleetd from macOS..."
-sudo orbit/tools/cleanup/cleanup_macos.sh
+sudo ./it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
 prompt "Please manually uninstall fleetd from $HOSTNAMES."
 
 OLD_TUF_PORT=8081
@@ -520,7 +520,7 @@ for pkgType in "${pkgTypes[@]}"; do
 done
 
 echo "Uninstalling fleetd package from macOS..."
-sudo ./orbit/tools/cleanup/cleanup_macos.sh
+sudo ./it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
 echo "Sleeping 60 seconds..."
 sleep 60
 echo "Installing fleetd package on macOS..."
@@ -644,7 +644,7 @@ for pkgType in "${pkgTypes[@]}"; do
 done
 
 echo "Uninstalling fleetd package from macOS..."
-sudo ./orbit/tools/cleanup/cleanup_macos.sh
+sudo ./it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
 echo "Sleeping 60 seconds..."
 sleep 60
 echo "Installing fleetd package on macOS..."
diff --git a/website/config/routes.js b/website/config/routes.js
index c77f1260f4f..4665a460a15 100644
--- a/website/config/routes.js
+++ b/website/config/routes.js
@@ -832,7 +832,7 @@ module.exports.routes = {
   'GET /learn-more-about/enrolling-hosts': '/docs/using-fleet/adding-hosts',
   'GET /learn-more-about/setup-assistant': '/guides/macos-setup-experience#macos-setup-assistant',
   'GET /learn-more-about/policy-automations': '/docs/using-fleet/automations',
-  'GET /install-wine': 'https://github.com/fleetdm/fleet/blob/main/scripts/macos-install-wine.sh',
+  'GET /install-wine': 'https://github.com/fleetdm/fleet/blob/main/it-and-security/lib/macos/scripts/install-wine.sh',
   'GET /learn-more-about/creating-service-accounts': 'https://console.cloud.google.com/projectselector2/iam-admin/serviceaccounts/create?walkthrough_id=iam--create-service-account&pli=1#step_index=1',
   'GET /learn-more-about/google-workspace-domains': 'https://admin.google.com/ac/domains/manage',
   'GET /learn-more-about/domain-wide-delegation': 'https://admin.google.com/ac/owl/domainwidedelegation',


Reviews:
user: login: lucasmrod
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-20T22:13:45Z
user: login: eashaw
state: DISMISSED
author_association: CONTRIBUTOR
submitted_at: 2025-03-25T21:25:41Z
user: login: noahtalerman
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-27T13:50:30Z
user: login: lucasmrod
state: APPROVED
author_association: MEMBER
submitted_at: 2025-03-27T13:58:47Z
user: login: lukeheath
state: APPROVED
author_association: MEMBER
submitted_at: 2025-03-27T21:43:33Z

Review comments:
diff_hunk: @@ -373,7 +373,7 @@ jobs:
 
       - name: Uninstall pkg
         run: |
-          sudo ./orbit/tools/cleanup/cleanup_macos.sh
+          sudo .it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
path: .github/workflows/fleet-and-orbit.yml
user: login: lucasmrod
body: ```suggestion
          sudo ./it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
```
created_at: 2025-03-20T22:13:45Z
author_association: MEMBER
path: website/config/routes.js
user: login: eashaw
body: @noahtalerman Can you revert the whitespace changes to this file?
created_at: 2025-03-25T21:25:28Z
author_association: CONTRIBUTOR
path: website/config/routes.js
user: login: noahtalerman
body: Yes! Whoops.
created_at: 2025-03-27T13:50:30Z
author_association: MEMBER

PR comments:
user: login: noahtalerman
created_at: 2025-03-20T21:33:59Z
body: @lucasmrod dang... the orbit-mac test failed: https://github.com/fleetdm/fleet/actions/runs/13979019455/job/39140574728?pr=27307

Do you know how I can fix it?
author_association: MEMBER
user: login: lucasmrod
created_at: 2025-03-20T22:28:12Z
body: > @lucasmrod dang... the orbit-mac test failed: https://github.com/fleetdm/fleet/actions/runs/13979019455/job/39140574728?pr=27307
> 
> Do you know how I can fix it?

I committed the fix to save you some time.
author_association: MEMBER
user: login: noahtalerman
created_at: 2025-03-24T21:15:16Z
body: Marked this as draft. Merge is blocked: https://fleetdm.slack.com/archives/C03C41L5YEL/p1742824902955999
author_association: MEMBER
user: login: noahtalerman
created_at: 2025-03-27T16:12:51Z
body: Hey @lukeheath can you please give this PR a review when you get the chance? If changes look good, please feel free to merge!
author_association: MEMBER
user: login: lukeheath
created_at: 2025-03-27T17:41:44Z
body: @noahtalerman Looks good to me. Did you do a search in the codebase for every script you moved? Some of these are referenced in the code I believe. 

cc @dantecatalfamo @georgekarrv 
author_association: MEMBER
user: login: noahtalerman
created_at: 2025-03-27T19:55:41Z
body: > Did you do a search in the codebase for every script you moved?

@lukeheath I did! Thanks for checking.
author_association: MEMBER