Edit Existing Configuration Profiles

[mattw421]

So I have existing Config Profiles that were created before my time as the JAMF admin. They are outdated and need to be changed and renamed. If I update them will JAMF simply overwrite the existing or will it add a new one? If I delete a Profile does it remove it from the Mac? If it adds a new one what is the best way to remove the old ones?

[tomhastings]

I am in the same boat, old Config Profiles and no documentation as to why they were created in the first place. What I am doing with a couple of test computers is excluding them from scope to then test functionality. Outdated Config Profiles will then be completely un-scoped which does remove them from the Macs. Because I was not here when the bulk of our JSS was configured, I want a safety net so I don't delete anything that I can't find an answer for... yet.

[mattw421]

@tomhastings So if I un-scope the configuration profile then it removes it? That does help. I could in turn then create the one I want and un-scope the rest potentially giving me the same affect.

[tomhastings]

Yes, un-scope will remove it from at inventory check-in.

[sdagley]

Un-scoping a machine level Configuration Profile can remove it much sooner than an inventory check-in as it's the Apple Push Notification Service that does the removal, not the Jamf binary

[sshort · Accepted solution]

@mattw421 Apple will enforce the most restrictive setting if you happen to have two profiles with the same preference domain. So if you run into timing issues where you may not want to remove/unscope the original profile yet, you can always just push out the new one (depending on your needs).

Example: If an existing profile allows Touch ID to unlock the Mac, and you push a second profile that disables Touch ID, then it's disabled. If an existing profile allows iCloud and a new profile is scoped (that also allows iCloud), then nothing changes.