Enrollment Complete

[dstranathan]

This is a totally dumb question, but what exactly is the Trigger type "Enrollment Complete". I assume its set when a new Mac is imaged or a QuickAdd package runs, correct? Are there other situations that qualify as "Enrollment Complete"? Just wanna make sure I fully understand what its doing and what it signifies in the context of JAMF.

I'm asking because I noticed that test Macs that get imaged over and over are not picking up my first-run Policy and related scripts, etc until I manually run:

-sudo jamf flushCaches -sudo jamf flushPolicyHistory
-sudo jamf manage

1) I was told by Support that there is know bug in the JSS related to this. Not sure exactly what the bug is.

I was told that in 9.81 any "Enrollment Complete" Trigger that runs "Ongoing" should not have the issue mentioned above (i.e.; Macs that are wiped & re-imaged shouldn't hold-on to prevails ran first-run policies, etc). But I am seeing an issue for sure.

2) Next, I was told by JAMF to modify my MySQL database as shown below, but that didn't help either.

flush_management_history_on_remanage from enrollment_settings = set from 0 to 1
flush_location_information_on_remanage from enrollment_settings = set from 0 to 1
flush_management_history_on_remanage from client_check_in = set from 0 to 1
flush_location_information_on_remanage from client_check_in =Already set to 1

(these MySQL settings were set and verified - look perfect)

3) Then I was told that my Policy with the "Enrollment Complete" Trigger may be broken.

I'm checking the /var/log/jamf log file on my test client and I see this single entry.

jamf[1336]: Checking for policies triggered by "enrollmentComplete"...

But that's all I see. Is it reasonable to assume from the line above that policies that are triggered from "Enrollment Complete" are not running as expected on this particular Mac? Shouldn't I see more info in the log?

Are there better was to check the status of Triggers besides the jamf client log?

4) Finally, JAMF support told me to add another Payload to my Enrollment Complete Policy to run the following 1-liner:

"jamf flushPolicyHistory && jamf flushCaches && jamf manage" (Not a separate script, just a one-liner command payload)

Has anyone else see this issue in 9.81? Seems like I'm making a lot of changes all over to work around a single bug.

There are other posts referring to this subject matter, but they are older and thus referring to older version of JAMF, so Im not sure they are identical issues to what I am seeing or not.

JSS 9.81

[davidacland]

I normally avoid the enrolment complete trigger. I've found it to be a little unpredictable.

Instead I use a custom trigger and call it at the end of the imaging process or quick add deployment to ensure it runs exactly when I need it.

[dstranathan]

That was the 5th suggestion I was given by Support: Create a custom Trigger and move my Enrollment Complete stuff over to that one (assuming it works well and does what I need it to do, etc).

I havent started on this task yet as I havent created a custom Trigger before and I still need to do some homework.

[ant89]

any update on this? 9.82 broke the enrollment complete trigger. i need a workaround.

[CasperSally]

Isn't adding a quickadd to your imaging process a workaround (runs on boot drive after imaging). This will make your policies run again.

[dstranathan]

@acorn

Has it been confirmed/documented that 9.82 broke (or re-broke) "Enrollment Complete" Triggers?

Im about to atempt to update from 9.81 to 9.82 but Ill hold off if this is indeed a known issue.

[ant89]

I have a ticket with JAMF, but they have not responded yet. Ive been imaging all morning today and cannot get my enrollment complete triggers to work.

As for adding a quickadd to my imaging process? doesnt casper imaging automatically enroll the machine? I did however enroll via quickadd package after i imaged and my enrollment complete policies did not run. These are set as ongoing.

The os that im imaging is 10.10.5

check out this thread https://jamfnation.jamfsoftware.com/discussion.html?id=17287

[ant89]

check out my fix: https://jamfnation.jamfsoftware.com/discussion.html?id=17287

Make sure everything is on 9.82. I had to update our netboot image using AutoCasperNBi with casper imaging 9.82. after image, my enrollment triggers are now working again.

[ant89]

I may have found a fix.

I have updated our netboot image and used autocasperNBI to create it. I have updated it with casper imaging 9.82 and it seems to have fixed the enrollment complete trigger. I imaged my test machine twice and the policies with this trigger works as expected.

[pmcgurn]

@acorn

I'm on 9.82 for JSS, and also rebuilt my NBI to fix an issue with imaging the new iMacs. This did not seem to fix the enrollment triggers for us, however I do see several "failed to connect to JSS" errors in the local jamf.log when the machine reboots and does the root auto-login. Are you all seeing similar?

I opened a ticket with JAMF to confirm, but I think that what may be happening in my case is that it's skipping part of the enrollment process because the Mac hasn't brought the network up in time for the enrollment script(s) to run properly. Our environment is mostly newer MBP's, so they're all using thunderbolt adapters for network during imaging.