Skip to main content
Question

Is there a way to find out if a user has deleted the MDM profile without having access to their Mac?

  • March 16, 2023
  • 3 replies
  • 73 views

Forum|alt.badge.img+1

New to Jamf.

 

We're finding that a fair few of our users are no longer checking in on the frequency we've set. Also finding that sending blank pushes etc doesn't seem to be doing anything, so the assumption is they've deleted the MDM profile. Is there a way to tell this for sure without having access to the Macbook itself?

3 replies

sdagley
Forum|alt.badge.img+25
  • Jamf Heroes
  • 3567 replies
  • March 16, 2023

@miszerkyst Short of having a LaunchDaemon triggered script that looks for the MDM profile and sends a notification via a non-Jamf Pro mechanism (e.g. via SMTP) your only indication will be a Mac stops checking in.


Forum|alt.badge.img+4
  • Contributor
  • 21 replies
  • March 16, 2023

Taking a step back, it is a common issue that devices stops syncing with Jamf, specially when not rebooted in a long time.

Our steps

* If the device is checking-in but not doing full sync (Device history -> Policy logs, Management history), Redeploy Jamf Framework via API.

* Ask users to run "sudo jamf policy && sudo jamf recon"

* Ask users to reboot

 

 


AJPinto
Forum|alt.badge.img+26
  • Legendary Contributor
  • 2801 replies
  • March 20, 2023

Just deleting the MDM Profile should not stop a device from checking in as the MDM Profile has very little to do with the JAMF Framework and Recon itself. There is really nothing you can do to be alerted if the JAMF Framework is removed. Security clients that rely on Configuration Profiles would stop working. You would be stuck with a LaunchDaemon to do an API or SMTP thing.

 

To rule out the obvious, have you had a user reboot to see if a device comes back up? The JAMF Binary and MDM Framework can hang up just like any other Daemon.