Enrolled Computer prompting for Device Enrollment

[AdamCraig]

I have a user who is repeatedly getting prompted for Device Enrollment. The computer has an approved MDM profile, the device is checking in and running policies, and has all of the expected profiles. Yesterday I manually re-enrolled via our mycompany.jamfcloud.com/enroll site, but this morning the user informed me he is getting the prompt again.

my next thought is to run sudo jamf removeFramework then manually re-enroll again, but wanted to see if there are any other ideas.

[AdamCraig]

update: sudo profiles renew -type enrollment just immediately brings up the prompt again and it still fails to install over the currently installed MDM profile.

[ThijsX]

@strayer Are you able to remove the user-approved MDM profile, and then do the "sudo profiles renew -type enrollment" ?

[AdamCraig · Accepted solution]

@txhaflaire that worked, it ended up being a little more involved. Posting my full steps here in case someone else runs into this:
Remove MDM profile via Jamf

Sudo Jamf removeFramework

verify all profiles are gone. Remove profiles that aren’t.

sudo profiles renew -type enrollment

Have user approve the profile

Received error: The mdm server for your organization returned an unexpected status 403

delete the /Library/keychains/apsd.keychain file https://www.jamf.com/jamf-nation/discussions/29413/device-enrollment-installation-failed-the-mdm-server-for-your-organization-returned-an-unexpected-status-403

Actually needed to reboot into safe mode (by holding shift at boot) due to terminal and other apps crashing.

sudo profiles renew -type enrollment

Approved profile, and Jamf start pushing other computer profiles down.

Rebooted back into normal mode and the apps that were crashing were to be working normally.

[UESCDurandal]

@strayer Are you on Jamf Pro 10.15.0 or higher? It looks like the issue that requires you to delete the apsd.keychain file was solved with this release.

[UESCDurandal]

https://www.jamf.com/jamf-nation/feature-requests/8525/when-device-certificates-signed-apple-iphone-device-ca-are-evaluated-their-validity-dates-should-be-ignored