Quick backstory: we're making a new policy in our organization that says all corporate-owned devices need to be enrolled with the appropriate agent-software - for the case of this discussion we are enrolling approximately 300-400 additional Macbooks, user-initiated via Safari.
We already have over 300 machines enrolled and have been pushing out various policies to these machines without any real issue. As soon as a machine is enrolled, our JSS pushes a handful of policies to the machine, which is expected behavior since previously the only individuals enrolling a machine was done by our Help Desk who is also imaging the new machine.
So now, our organization is prepping sending communication around the new policy which will have a lot of extra Mac-based end-users (300+) enrolling themselves in Casper via Safari and agent download. Because it is a fair handful of people, and not necessarily "IT minded", we're wanting to roll everything out in phases. Phase 1 (which is what we are talking about for this discussion) is simply getting the agent on the users' machine, updating JSS inventory, and enabling an admin account as a backup administration account on the machine (in the event a user leaves the machine with Help Desk, we do not need the end-user to provide us their password).
So what we have done is this:
- Created Smart Computer Group name "user-initiated enrollment"
- Added criteria of "Packages installed by Installer.app/SWU" has com.jamfsoftware.osxenrollment
- Added criteria of "Last Enrollment" is after 01-01-2015
We currently have 74 policies in our organization that are being pushed based on Smart Computer Group membership as well as 2 static computer groups (our 2 test groups). What we did was applied the above SmartGroup as an exclusion in the scope of the policies we do not want pushed. However, what we are seeing now is that even though the members of "user-initiated enrollement" SmartGroup are excluded from the policies, they are still being pushed to these machines.
As an example here is how we have Adobe Reader set:
- Options: 1 package (reader.dmg), update inventory
- Scope: Targets="Systems w/out Adobe Reader" group, Limitations=none, Exclusions="User-initiated enrollment" group
- Self-Service: Available
It seems like the exclusions group doesn't seem to be excluded. Adobe Reader is pushed, after manual-enrollment from web (client-side) and a restart, even though it shouldn't be (this and other policies as well)... Any ideas?
