Configuration Profiles - inconsistent

stevehillnz
New Contributor III

I have a lab of iMacs that have user level configuration profiles containing restrictions. The profiles are scoped to a Smart Group and work flawlessly.

Now I am trying to deploy a computer level profile the same way, but the client machines will not pick it up, and the management history shows no pending commands. When I try to add the machines individually to the scope, they do not appear in the computers list.

They all have the latest OS (10.8.3) and have recently checked in with the JSS which is version 8.64.

10 REPLIES 10

jszaszvari
New Contributor III

Maybe a similar issue?

I'v had issues with something similar

https://jamfnation.jamfsoftware.com/discussion.html?id=6609

tkimpton
Valued Contributor II

See mcxtoprofile by Tim Sutton. I only managed restrictions by using Tims tool to take my mcx plists for restrictions, converting them to config profiles.

https://github.com/timsutton/mcxToProfile

This is the only thing that has worked! I dont believe its a JAMF issue but more like Apple releasing Config Profiles too early without doing PROPER UAT!

Tim & Greg Thanks for this tool and all the effort that goes with it :)

Without it i really dont know what we would do!

stevehillnz
New Contributor III

Thanks jszaszvari. I had read that, but this is different. The client machines are not even receiving the new profiles, even though they have picked up previous ones. I cannot even see them to add them to the scope.

mcxtoprofile looks very useful, but unless I can scope these machines I can't do anything.

tkimpton
Valued Contributor II

You may need to open ports. Time to be nice with the Network guys ;)

https://jamfnation.jamfsoftware.com/article.html?id=34

stevehillnz
New Contributor III

If it it is a port issue, how was I able to deploy user-level profiles?

tkimpton
Valued Contributor II

i would contact your support rep at JAMF

david_yenzer
Contributor II

I have experienced this same issue - we currently have MCX settings to block System Preferences items like Sharing - and were directed to attempt to port these over to Config Profiles. So far I have only had success on the 'user' level - the computer level doesn't work at all. I might be able to make it work by adding the user groups in, but there is also only the ability to enable access to the default items in SysPrefs - how do I allow a user to be able to access a third-party "Other" item in System Preferences? Something like Flash Player, Java, or Xerox PrintBack.

bajones
Contributor II

@david.yenzer https://jamfnation.jamfsoftware.com/article.html?id=204 The changes don't stick when upgrading the JSS, but it's as simple as saving the modified file and replacing the one created during the upgrade and restarting Tomcat. Hopefully this will still be relevant with 9.0 or better yet, there will be a less hacky way to accomplish this!

david_yenzer
Contributor II

I've got a handle on the MCX settings (Management > Managed Preferences) and was trying to move that restriction over to Management > Configuration Profiles. However, the Config Profiles area doesn't seem to have a place to customize - they have a 'restrictions' area, but on the payload page there are only check boxes to allow the pre-listed items. When a user installs Java, Flash Player, Xerox PrintBack or whatever else - those also show up in System Preferences and we would want the user to be able to use them. (Basically all we want to block is Sharing.)

Until this becomes possible in Config Profiles we will continue to use the MCX.

bajones
Contributor II

The formatting on my last post could have been better, but the link I posted contains instructions to do exactly what you need. I followed these instructions to add the Wacom preference pane to the pre-listed items in the restrictions payload of our config profiles.