We've been experiencing an issue where some policies fail to execute on about half of the client machines within the scope. The JSS interface shows that the policy is "pending", but it never runs. We've noticed this "flaky" behavior with several policies, each with different triggers. The most consistently problematic policies are those which trigger at login. Testing has revealed that logging in to one of these clients does not execute the policy, and running a "sudo jamf policy -event login" returns: "No policies were found for the "login" trigger."
The most baffling thing is that some of the machines in the scope will execute the policy without issue, while others do not. All of the machines in the group have had the same imaging workflow run on them, show as managed in the JSS, and have been pulling down other polices without issue. So I'm not sure what could be causing the problem. Since the policy never executes, the policy logs are unhelpful.
During my testing, I cloned a policy (leaving all the settings the same as the original), and logged in on one of the problem machines. Lo and behold, the new, cloned policy ran without issue on the problem machine. However, other clients within the group still fail to run the policy, and still only show as "pending" in the logs. There doesn't seem to be any rhyme or reason to which clients fail to execute the policies. All in all, some clients just never seem to execute some of the policies that are scoped to them, but they will execute others. We've been able to replicate this behavior with several different policies and clients.
Any thoughts or ideas? I've made sure that I have login/logout hooks enabled, and I've tried unchecking "Perform login hook actions in background". See screen shot of our settings. external image link
We're running 9.32 for our JSS with a SMB file share as our distribution point (no http).
