Tracking if a mac has its MDM profile's or not

There is a built in template for an extension attribute that can show you if MDM profiles exist on your macs or not.

If you require more info (as I have recently), I used this code pasted into a different attribute.

#!/bin/bash

# Script to read MDM profile address into an Extension Attribute
# This is needed to make sure that our computers are pointing to the correct URL

# Author : r.purves@arts.ac.uk
# Version: 1.0 - Inital Version

# Read the current computer profile and grep for the organisation name

CurrentJSSURL=$( profiles -C -v | grep -m1 "organization:" | cut -d " " -f 4 )

# Check to see if a MDM cert is present

if [ -z $CurrentJSSURL ];
then
   echo "<result>No MDM Certificate</result>"
   exit 0
fi

# Since a cert is present, report it's address. Leave the checking to a smart group.

echo "<result>$CurrentJSSURL</result>"

exit 0

This is an extension attribute I use to track installed configuration profiles:

#!/bin/bash

profiles=$(profiles -C -v | awk -F: '/attribute: name/{print $NF}' | sort)
echo "<result> $profiles </result>"

exit 0

This will return a sorted list of all installed profile names.

I also saved an advanced search that displays them. In my environment, there are large blocks of machines that should all have the same profiles, so I can see at a glance when one is out of whack.

Guys,

GREAT stuff!!!!

Have you noticed that the profiles hold pretty well? Or do they sometimes disappear ?

If they are not there do you then just wait and hope for them to come back down or do you manually make the machine attempt to get them again ?

If they drop them expectantly, they won't come back. Due to an Apple defect (13189964), the JSS has no idea that they were removed and will not attempt to correct the problem. It has to be done manually.

We haven't had any disappear, but I wrote the attribute code above so we could selectively replace MDM certificates as we change our JSS address. That attribute is scoped to a smart group. The smart group is added to a policy that executes the following command:

jamf mdm -verbose

This neatly replaces/installs the MDM cert.