How to force OSXConfigurationProfiles before Software Install Policy

[chelm]

I have what I would guess is a simple problem, I am trying to apply an order of importance for the various tasks related to a DEP build. The issue I am having is that I cannot find a way to force the configuration profile we made to allow kernel extension before installing the software that needs it exemption. I have tried the following:

https://www.jamf.com/jamf-nation/discussions/23349/can-you-package-a-configuration-profile
https://www.jamf.com/jamf-nation/discussions/6006/command-to-manually-update-configuration-profiles

Basically, I need a way to force a configuration profile for kext extension before a policy is run. Without the ability to do this a user who is sitting in front of a machine as it installs software see's a lot of popups they have to manually approve.

I wish it was as simple as a command like:
sudo jamf OSXConfigurationProfiles -id xxxx

What I know doesn't work:
sudo jamf mcx
sudo jamf manage
sudo jamf mdm

I tried the scripts @mm2270 posted in the above discussion threads, but they don't seem to work anymore. Perhaps they just don't work for kernel extensions? Any advice?

[alexjdale]

Hmm, when I run a recon I swear it brings in all MDM profiles that are scoped to that system that it doesn't have yet.

We don't use DEP yet, so our kernel extension profile needs user approval. After I approve the MDM, as soon as I run a recon that computer will pop into that profile scope (using an extension attribute that detects MDM approval) and the profile is deployed immediately. Maybe it's a scoping issue?

[chelm]

@alexjdale Scoped to "All Computers". I would think that would cover it, maybe not though?

[alexjdale]

It should, but maybe it's happening too early? It will fail to deploy if the MDM profile isn't approved, and it's entirely possible with DEP that it can't apply a profile that needs approval until a bit later in the process. I would check to see if Jamf tried to push the profile to the system early in the DEP process and encountered a failure.

This is all speculation on my part and I could be way off base, but I'd play with the scoping and see if I could come up with a scope that would kick in after initial MDM enrollment but before the app is installed, with a recon triggering the profile push. For example, keying off of the previous step in the process.

[chelm]

My understanding of how it works -- The prestage enrollment happens, which pushes the MDM profile to the machine. So the MDM profile is definitely approved before the configuration. The first thing my policy does is bind the computer to the domain. When I do a directory binding I do force a recon and it still doesn't push down the configuration. This happens before software installation. I tried all 4 of these before software install and still have a problem:

sleep 10
sudo /usr/local/jamf/bin/jamf recon -verbose
sudo /usr/local/jamf/bin/jamf jamf mcx -verbose
sudo /usr/local/jamf/bin/jamf jamf manage -verbose
sudo /usr/local/jamf/bin/jamf jamf mdm -verbose

[alexjdale]

Are you able to check the JSS for the profile push to see if it was even attempted or successful/failed after enrollment?

[chelm]

@alexjdale To be honest, I am not quite sure where a useful log would be. When I go into the "Configuration Profiles" and select the one for Kernel Extensions, then I select logs, it brings me to a list of computer names. I select the computer name and it just brings me to that computers inventory. Not sure where a useful log would be.

[chelm]

Apparently, there used to be a binary verb "configruationProfile" that was intended to do exactly what I am looking for:

Configuration Profiles - How does this work?

In this discussion @jason.vanzanten talked about the verb and its uses:

jamf configurationProfile -username <username>
jamf configurationProfile <for computer-level>

I am trying to figure out where the relevant logs would be, but I can say that the configuration profiles do not show in my profile pane until after prestage enrollment and site policy is pushed. They seem to take like an hour to show up.

To get DEP working the way it is intended, I really need to be able to get all profiles before site policy. Anyone else experiencing issues or have a workaround?

[dpertschi]

@chelm We occasionally see that profiles take a few minutes to come down to a DEP built machine, but not too often. You might want to troubleshoot your access to APNS. Check out : https://youtu.be/Z-Lg9uBbmfk

Could you possibly add the presence of your kext profile to your policy scope, policy can't run if profile isn't present? I'm pretty sure recon isn't necessary, just check-in, to update a computer record when a new profile loads.

Also, FWIW, I did hear at JNUC that there will be a feature/option coming to ensure profiles are installed before leaving setup assistant!

[chelm]

@dpertschi APNS are good. Running the policy on a Smart Group is a great idea. I am testing this now. Unfortunately, it seems to add 30-90 minutes to a build. Not really good for a model where you deliver an unconfigured machine to an end user and expect it to build in front of them.