Help with policy not taking

[alaiuppa]

Hello,

When pushing my deployment package, it all appears to work. However occasionally one of my policies seems to not take.

All it does is create another administrator account. Now I can see from the cloud management panel that the group I created for those 'Missing the Admin' account has the computer that got the deployment and not the policy. It is set to then remediate it by pushing the policy but that does not seem to happen.

The policy is set to deploy at EnrollmentComplete and Checkin-Frequency. Additionally I've tried manually jamf enroll, jamf manage, and jamf heal. The first two run and seem to show some output but I've tried checking back shortly after and there is no administrator account.

It's worth noting that a majority of the time it does create the admin account. Any advice or guidance would be much appreciated, thanks.

[rderewianko]

can you try running the policy as verbose?

sudo jamf policy -event -verbose

(not having anything after event would act like a reoccurring checkin)

[alaiuppa]

Absolutely, here is the output:

verbose: JAMF binary already symlinked verbose: JAMF agent already symlinked verbose: Checking for an existing instance of this application...
Checking for policies triggered by "-verbose" for user "redacted"... verbose: Checking for active ethernet connection... verbose: No active ethernet connection found... verbose: Removing any cached policies for this trigger. verbose: Parsing servers... verbose: The Management Framework Settings are up to date.
No policies were found for the "-verbose" trigger.

[rderewianko]

My apologies, because we had no trigger but called -verbose, Jamf took -verbose as a policy trigger.
Lets switch them around to get a full verbose output.

sudo jamf policy -verbose -event

[alaiuppa]

Is this better?

verbose: JAMF binary already symlinked verbose: JAMF agent already symlinked verbose: Checking for an existing instance of this application...
This policy trigger is already being run: root 10446 0.0 0.1 2521904 11216 ?? Ss 2:37PM 0:00.02 /usr/local/jamf/bin/jamf policy -randomDelaySeconds 300 verbose: Policy error code: 51

I see that policy error code so I'm going to break out my Google-Fu on that.

[rderewianko]

So the above, means you ran a checkin when one's already running. You could "kill that" and run your own, It's a pretty standard output.

sudo killall jamf

[alaiuppa]

Ah here we go, some real verbosity.

verbose: JAMF binary already symlinked

verbose: JAMF agent already symlinked

verbose: Checking for an existing instance of this application..

Checking for policies triggered by "recurring check-in" for user ".........."...

verbose: Checking for active ethernet connection...

verbose: No active ethernet connection found...

verbose: Removing any cached policies for this trigger.

verbose: Parsing servers...

verbose: Parsing Policy Create localadmin account (7)...

verbose: The Management Framework Settings are up to date.

verbose: Found 1 matching policies.

Executing Policy Create localadmin account

Running Recon...

verbose: Timeout: 10

verbose: Checking availability of ..........

verbose: The JSS is available.

Retrieving inventory preferences from .........

Finding extension attributes...

Locating accounts...

Locating software updates...

Locating package receipts...

Locating plugins...

Locating applications...

Locating fonts...

verbose: Running script for the extension attribute EFI Password Mode

Searching path: /Library/Internet Plug-Ins

Searching path: /Applications

Locating hard drive information...

Locating printers...

verbose: Locating running services...

Searching path: /private/var/jssadmin/Library/Fonts

Searching path: /Users/........./Library/Fonts

Searching path: /Library/Fonts

verbose: Found app: /Applications/App Store.app

verbose: Found app: /Applications/Automator.app

verbose: Found app: /Applications/Calculator.app

verbose: Found app: /Applications/Calendar.app

verbose: Found app: /Applications/Chess.app

verbose: Found app: /Applications/Contacts.app

verbose: Found app: /Applications/Dashboard.app

Searching path: /System/Library/Fonts

Searching path: /Library/Application Support/Adobe/Fonts

verbose: Found app: /Applications/Dictionary.app

.........

verbose: Finding CoreStorage information...

verbose: found CoreStorage PV disk0s2 LVG UUID:

verbose: found CoreStorage LV disk1

Locating hardware information (Mac OS X 10.11.6)...

verbose: Device is BLE capable: no

verbose: Checking AD status...

Gathering application usage information...

verbose: Looking in 2016-10-18

verbose: Reading (null).plist...

verbose: Reading user.plist...

Submitting data to .......

<computer_id>.........</computer_id>

Submitting log to ...........

[rderewianko]

Executing Policy Create localadmin account <-- means its executing it..

does the jamf log say anything? /var/log/jamf.log?

Does your casper management account have admin access to the machine?

[alaiuppa]

The log just mirrors the same, a lot of Executing Policy Create localadmin. It even performs the Check-in, picks up the fact that the policy needs to be deployed and then attempts to Execute the policy.

My casper management account does have admin access to the machine, to the best of my knowledge.