Bound Macs not Getting Wireless Certs

fotofojo
New Contributor III

Hi. I will start by saying that I have limited experience with Jamf Pro and Jamf Connect but can find my way around most of the time. Here is what we have happening: when our Mac footprint was only a few Macs, they got bound to AD and were never in ABM. This seemed to work ok, but as our Mac presence increased and we learned of issues that binding Macs could lead to, we decided to go the route of ABM enrollment, then leverage intune and Jamf Connect, keeping the Macs unbound. Since doing this, any config profiles pushed from Jamf Pro seem to work well. We ran into any issue where we had to update wireless certs and push them out through a config profile and all of the Macs that were enrolled and using jamf connect/intune got the profile and updated cert no problem. However, the Macs that were bound to AD "got" the profile and certs, but those machines cannot connect to the wireless network now. My question is (and thanks for your patience) - is it possible to "unbind" the Mac from AD and get it working with Jamf Connect and intune without having to wipe it? We know that if we wipe it and then manually enroll the machine into ABM via an ipad scan, we can be successful in achieving what we need, but like I mentioned that requires wiping. Or maybe a simpler question would be, can we take a Mac that is not currently in ABM and get it in there without wiping? Thanks and apologies for the noviceness. 

1 REPLY 1

AJPinto
Honored Contributor II

Your issues is probably the NPS policy. The NPS policy was probably built for your nondomain bound devices, and there is something causing the policy to trip up with domain bound devices. 

 

My recommendation, is to go ahead and unbind your devices as its not a good workflow to use. You will likely need to delete the AD Objects just so NPS has nothing to even try to reference just in case. Reprovisioning would be a good idea, if those devices were enrolled without Automated Device Enrollment you have some limitations on Management and users can remove the MDM profile. 

 

All that aside, what kind of certificate are you using? ADCS/SCEP/etc.