802.1x Profiles + AD - JSS 8.7

[boberito]

This has worked in the past for us no problem but all of a sudden it appears to have stopped working.

Has anyone had any problems applying a Network Configuration Profile with a 802.1x configuration with JSS 8.7?

These machines are bound to Active Directory. We want users to be able to login for the first time over wireless. This is actually very important for us because they are Macbook Air. It appears as though it's either not applying to profile correctly or it's not reading the credentials correctly from Directory Services and the LoginWindow. If I login over a wire, it asks for the Username and Password for the Wifi, which it shouldn't do.

The machines are running 10.8.3 and our JSS is 8.7. In the past when it worked we were running 10.7.5. I'm not sure if it's the JSS to blame or Mac OS X to blame.

[boberito]

In fact I just imaged a machine to 10.7.4 and it worked perfectly.

Must be another 10.8 annoyance.

Any thoughts?

[tomt]

This may have absolutely nothing to do with this but the new 10.8.4 update that was just released mentions resolving an issue between Mtn. Lion and Enterprise WiFi.

[boberito]

I'll have to try that tomorrow.

And I spoke too soon about 10.7. It didn't work there either.

This is especially frustrating because I've been on 8.7 since it came out. I had tested our imaging over and over (last week in fact) and these profiles worked then today when we started production if you will it totally failed. /end rant

[TimT]

This could be related or maybe not. I updated to 8.7 over last weekend and have noticed some flakiness with our Config profiles (network shares) since the update.

We were with 8.52 previously and they performed consistently well. Have you checked the logs to find out what's going on?

I had a look at ours and have been getting the mdmclient error / MDM AuthToken with no valid connection to our jss and the profile gets removed. It performs worse at certain times of the day, afternoons (AEST) flaky. Possibly network related, difficult to say. Only really cropped up since the 8.7 upgrade. Seriously considering giving CP's the shove, too many variables and inconsistencies.

[boberito]

I was looking throught he logs but I couldn't find anything that looked right.

Would it just be system.log? Or elsewhere?

[TimT]

I searched All Messages and found the error log there.

I have added complication whereby sometimes the payload doesn't apply because the profile has been removed (insert mdm error that I posted above) or the payload doesn't apply but the profile remains and I get the same mdm error with additional System Preferences error concerning the payload. Frustrating..

[boberito]

To force the machines to get MDMs I talked to the nice folks at JAMF and they suggested a script to run at Reboot that runs the jamf mdm command and set it once per computer.

However I still can't login over wireless to AD, but that's due to a bug in 8.7 I believe

[barnesaw]

We've been having this issue on MacBook Pros for a year. Deploy the profile to the hard drive and install it from the command line outside of Casper. Only way that worked for us.