Configuration Profile help

[Sean_M_Harper]

Hello everyone,

In a great attempt to remove our lion servers profile manager, we would like to use the JSS to push configuration profiles. We are doing this only for one simple reason; our secure network (for staff and teachers requires certs to be present).

This used to be handled by our Lion server running profile manager. When I create a config profile and set the scope to be all machines, it only seems to stick on a few machines. If I tweak the profile and select "all machines" as a deployment option, it still seems only a few machines are getting the profile.

Is there a way to check what went wrong? or to force the profile to a certain machine? or even to download a .config file (created by the JSS) to manually attach it to the machine that is refusing?

Thanks in advance.

[Cem]

Try to push a newly created blank profile in JSS to one those Macs that don't play nice. See if it's getting the profile.
I mean blank as no payload. Then just scope the desired Mac.

If stil doesn't get it. I will be looking into APN and Casper PKI certs etc... But try the above first.

[ernstcs]

Also need to make sure that firewall ports 2195 (out) and 2196 (in) are open on the JSS to talk to APN servers. You can see on an inventory record for a system that has a profile assigned what the status is, or why a profile did not apply. Look under the Management History section.

For some reason after reimaging, in order to get a nice green verified message for even the base MDM configuration profiles in System Preferences, I had to do a 'jamf enroll' command and reboot.

[Sean_M_Harper]

is there a handly list of command line commands somewhere? such as "jamf enroll"

[ernstcs]

jamf help

[Sean_M_Harper]

The empty profile never pushed. It will push to my other devices, but not the machine in question. All it ever seems to have is the MDM JSS profile.

[bentoms]

Sean, it sounds like the mac can contact the JSS to get the MDM profile... But not Apple's APNS servers, (ports 2195,2196 & 5223)... & so it cannot get the profiles.

Verify those ports are open to 17.0.0.0/8 then you should be good to go.

[ernstcs]

As it relates to the computer not properly enrolling after imaging until you run an additional 'jamf enroll' command, here's the confirmation of that from JAMF. You won't get a verified MDM status in System Preferences until you do the command again, and THEN you should get profiles if that piece is setup properly.

"I wanted to let you know that I have submitted a defect for this. It seems as though imaging with Autorun is consistently not working in properly having the MDM Enrollment profile installed. The ID for this is D-003103"

[clifhirtle]

Thanks for posting this Ernstcs. Can you confirm if this bug affects all computers post-imaging? We just completed our Jumpstart and cannot get machines automatically managed, even when running the JSS QuickAdd package as part of the imaging process.