Configuration Policies - Restricted Payload

[BobbyH]

I am new to JAMF and my organization recently stood up an on-prem server and I am working out the management kinks so we can start applying policies to our iPads and Macs.

My problem: Whenever I attempt to set a configuration policy containing a 'restricted' payload, I get Failed Commands.

Command: Install Configuration
Error: The data couldn't be read because it isn't in the correct format.

I do not understand this error because it triggers whenever I alter the payload and whenever I leave it at the defaults. This happens if I push the configuration or attempt to apply it during device enrollment. This is a PreStage enrollment using DEP in Apple School Manager.

Everything else I tested a configuration profile with (Wi-Fi, Passcode, Single App Mode, etc.) seems to work. I even enabled and disabled the PreStage Enrollments options during my testing. However, I cannot figure out what I am doing wrong with the 'restricted' payload.

What am I missing?

Please advise.

[mm2270]

I assume you're talking about the Restrictions payload in a Config Profile, like, the built in one, correct?

If so, can you possibly provide a breakdown of what is enabled/checked in the profile? I'm wondering if a simple process of elimination would work to narrow down what's causing the error.
Honestly, everything in that payload should work just fine, since it's something built in, and not a custom plist profile or the like, but I don't know if I've ever enabled all options in it, since it contains a lot of stuff. It's possible one of the items that is checked isn't jiving well with the machines it's being pushed to or something.

[BobbyH]

Right now, the configuration is set at the default (for testing via process of elimination). I made the same assumption you made when I first configured multiple restrictions options to completely lock down the devices I was testing. Even after placing the configuration at the default, I am still seeing the same behavior so there is not a specific setting I am knowingly toggling to trigger the error.

[mm2270]

Well, that's strange. So even creating a new profile that has the Restrictions payload enabled, but nothing changed in it, trying to save it results in an error? Do I have that right? Or is it saving ok, but not deploying?

Whichever one it is, have you tried doing a restart of your Jamf Pro server to see if it clears anything up? And since you have an on-prem environment, you should be able to look at some of the server logs to see if it helps pinpoint what's going on. It might be worth opening a case with Jamf and getting the logs over to someone in support to see if they can help you find out what the issue is. Because it's not making sense to me that a default Restrictions profile would generate such errors, unless there is a database issue or something else going on on the server side. If it was a general profile deployment issue, then none of them would work most likely. It's only affecting this one payload type.

[BobbyH]

Thank for your help. I will give your suggestions are try and report my findings either way.