Delay Configuration Profile application

jdeltazulu
New Contributor

I have a configuration profile setup to allow certificate based wireless authentication which includes the configuration for acquiring an AD certificate and setting the wireless network settings. It works great when applied to a computer that has already been imaged, however, when I image a computer using Casper Imaging it attempts to apply and fails. To correct this I then have to go into the computer object and cancel the failed profile attempt and then on next check it applies as it should. I assume this has something to do with when the profile is getting applied within the imaging chain, so I am wondering if there is a way I can delay the profile until the end or if anyone has any other ideas I might try?

1 REPLY 1

mm2270
Legendary Contributor III

I assume this is a Config Profile that is created in the JSS and not something being installed locally in a pkg with a postinstall script, correct?
Since Config Profiles are scope-able, and you can make use of Smart Groups for those scopes, I would look at creating some kind of file or receipt dropped to the Macs at the end of imaging and when they are completely set up. You can capture the existence (or non-existence) of that file or package receipt in an Extension Attribute. Build a Smart Group by using that EA value ("yes" or "no" for example) and then use that group as the scope for deploying the Configuration Profile. Meaning, only Macs that have that file present to indicate they aren't in the middle of imaging should have the profile deployed to them. That should I imagine stop it from being deployed until a Mac lands in that Smart Group.
Of course, I'm glossing over a detail here, which is that you'd also need to create a policy or maybe just an additional package as part of your imaging to drop that file/receipt onto the system. Make sure that its set to run as part of a first run setup though so it doesn't install it too early in the process.
Anyway, that's a high level look at one approach. There are probably at least a half dozen other ways though.