REmote Lock/Wipe

It won't work unless the Mac can communicate in with your JSS. APNs only acts as a relay. It uses the persistent connection to the Mac to tell it to "check in" with its JSS, because it has something for it to execute.. If the Mac can't actually connect to your JSS, it will never receive the Remote Lock/Wipe command. The command doesn't come from Apple's servers, it comes from your JSS.

I was afraid you would tell me that.

I tested this a couple days ago and it doesn't work. Hopefully I can put a Mac mini in the DMZ and have it point to the internal JSS db. I tried a remote lock, remote wipe and added a few settings to an Apple Profile and the Mac did not recieve any of these while off the internal network.

I just tried a remote lock and well it said it was sent successfully, but i can still use the computer. Any idea how long the command takes to get to the Mac?

Tested this post renewing APNS cert, locked within 2 minutes.

BUT Mac was on our WAN at the time.

There are a lot of possible reasons why the remote lock/wipe functions don't work, or take some time to actually work. I can say that we had a few issues at first getting it to work and had to get with our network folks to make sure the proper ports and traffic wasn't being blocked. But now that its set up, it works quite well and pretty fast actually. Usually in less than 1 minute from sending a command to a Mac that is connected to the internet they receive the push and do the action.
I don't know that we've actually tested the more destructive wipe command, but we've done remote lock in a lot of tests and it works nicely.

well looking at history all my commands have completed, this one has yet to complete, 21 minutes now. So i guess i will just let it sit and see what happens.

On the mac you sent the command to run:

netstat | grep tcp4

Do you see an entry for something along the lines of Apple courier port 5223?

nope

Does the mac get any other profiles?

(Other than the MDM one).

no it does not, but i rebooted just for fun and now its locked.
enough playing for the week, everybody have a good holiday weekend in the US. ttl and thanks for the help.

It hunk you need port 5223 & 443 open to 17.0.0.0/8 (or whatever apples range is).

Saw it on a tech doc like https://developer.apple.com/library/ios/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/Chapters/ApplePushService.html#//apple_ref/doc/uid/TP40008194-CH100-SW9

Port 5223 is the persistent connection between the client & apple that the push notifications are delivered. (Again i think).

JAMF rep should be able to assist.

It hunk you need port 5223 & 443 open to 17.0.0.0/8 (or whatever apples range is).

Saw it on a tech doc like https://developer.apple.com/library/ios/documentation/NetworkingInternet/Conceptual/RemoteNotificationsPG/Chapters/ApplePushService.html#//apple_ref/doc/uid/TP40008194-CH100-SW9

Port 5223 is the persistent connection between the client & apple that the push notifications are delivered. (Again i think).

JAMF rep should be able to assist.

This might help too http://support.apple.com/kb/TS4264

Also try: https://jamfnation.jamfsoftware.com/discussion.html?id=8195#respond