Skip to content

Home

Jump to bottom
Rod Christiansen edited this page Oct 8, 2026 · 5 revisions

BootstrapMate for Windows

BootstrapMate is an MDM-agnostic bootstrapping tool for Windows. It downloads a JSON or YAML manifest over HTTPS and installs the packages that manifest lists, in two install phases named setupassistant and userland, after an optional preflight stage that decides whether and how the run goes ahead. It is a provisioning tool, not an ongoing config-management tool: once the manifest is done, BootstrapMate hands the device off to whatever manages it day to day, which on Windows is normally Cimian.

Who this is for

Windows fleet administrators who need software on a device early, during Out-of-Box Experience (OOBE) and the Autopilot Enrollment Status Page (ESP), before the ongoing management agent exists or has had a chance to run. If you have ever shipped a first-boot script to install the thing that installs everything else, that is the job BootstrapMate does, with session logs, a last-run record for remediation scripts, per-phase status in the registry, SHA-256 pinning of downloads, Authenticode verification of MSI and EXE installers, and a daily scheduled task that can keep a provisioned machine's tooling current through throttled baseline runs.

It is deliberately small. There is no Windows Service, no dependency graph and no reboot handling.

Start here

  • Getting Started: install the MSI, write a one-package manifest, run it, and confirm the result. Do this first.
  • Overview: the moving parts: the CLI, the Managed Bootstrap Install app, the MSI, the scheduled task, the manifest, the handoff target.
  • How It Works: the real order of a run, and why "device phase" and "user phase" come from when you start the tool, not from anything it detects.
  • Preflight and Baseline: how one manifest provisions new machines and keeps provisioned ones current.
  • Manifest Reference: every key the parser reads.
  • Troubleshooting and Gotchas: read this before you file a bug.

New to the vocabulary, or arriving from Munki? Start at the Glossary, which spells out how BootstrapMate's "manifest" differs from a Munki or Cimian manifest.

The macOS sibling

A macOS implementation of BootstrapMate exists at https://github.com/bootstrapmate/bootstrapmate-macintosh/wiki. Its wiki carries the same page names as this one, so you can move between the two. The implementations share the concept, the manifest vocabulary and the last-run.json, baseline.json and run-summary schemas; they do not share code, and they differ in real ways, including item types, verification and handoff target.

Related projects

  • ReportMate for Windows, https://github.com/reportmate/reportmate-client-win/wiki: its management module surveys C:\ProgramData\ManagedBootstrap\logs as the bootstrap tool, so BootstrapMate's session logs appear in ReportMate's device view.
  • Run summary reporting: any service that accepts a JSON POST can receive the summary BootstrapMate sends to ReportingUrl. See Logging and Reporting.

Getting help

Open an issue on this repository: https://github.com/bootstrapmate/bootstrapmate-windows/issues. Include the output of managedbootstrapinstall.exe --last-run and --status, the newest run's session directory from C:\ProgramData\ManagedBootstrap\logs\<date>\<time>\ (bootstrap.log, events.jsonl and session.json), and the manifest you ran, with any credentials, hostnames and serial numbers removed.

See also

Introduction

The Manifest

Configuration

Operations

More

Clone this wiki locally