Imaging with auto run not enrolling

[bsuggett]

Running Casper 9.21

Imaging machines with auto run data results in the enrollment field in the JSS to be blank, in addition the enrollment triggers don't get triggered.

If we run the exact same imaging steps without auto run, enrollment is completed and enrollment triggers work successfully.

Another thing is the machine policy logs don't get flushed when using auto run. We've just imaged 6 computer labs consisting of 45 computers each and they've not flushed the policy logs. Oh bother ! Have to revisit them again.

Anyone experience this?

[stevewood]

I haven't tested with Auto Run data, but I have seen similar with Pre-Stage imaging on MacBook Airs with the Thunderbolt ethernet adapter. My configuration that they are running is simply to lay down a first boot package that installs a LaunchDaemon to run my first boot script which installs all of our software.

I've noticed that after Casper Imaging reboots, it will install that package, reboot again, and that's it. The machine is not enrolled and the admin user is not added to the machine. A boot into single user mode shows that the enroll.sh script never runs, and a check of the logs shows that the machine cannot connect to the JSS.

My guess is that for some reason the machine is not adding or activating the Thunderbolt adapter, and so the machine cannot reach the JSS. I can sometimes get it to work after a restart or two, but not 100% of the time.

I vaguely remember reading something here that people were having similar problems with the Thunderbolt adapters on MBA and possibly MBP models (both retina and non-retina).

I have a new iMac on the bench and I will be imaging that later today, so I'll post if I have different results with it.

What types of machines are you seeing this on?

[bsuggett]

Update Request

JAMF requested if this was related to Thunderbolt adapters as Steve Wood mention.

[bsuggett]

Update Response

I can confirm that the mac is question are not portable. They are imac 2010, 2012, and 2013 models.
They are using the built in ethernet adapter.
Something else has come up. Since the machines didnt go through an enrollment, the management account that was used previously has remained in the jss. Regardless of the management account set in the configuration for imaging. As we are going through a transition of changing the management account its become a problem now for us.

[bsuggett]

Update Report

JAMF reports

So after some testing I have come to a couple of conclusions.

1.) Enrollment does appear to be a defect. For some unknown reason, we are not removing the old SCEP ID when the machine is re-imaged. So when we reboot, enroll again, the JSS is verifying the client to the old signature.

2.) The flush on re-enroll is no longer an option within the JSS. The polices of the previous run are kept intact. While I don't personally agree this "feature", it now the 'standard'. For post enrollment policies, we suggest using the "Enrollment Complete" triggers in conduction with smart-groups.

This is a defect

The defect ID for this particular issue is:
D-006210

[bsuggett]

The work around we shall be using is
Wipe all autorun data from every machine in the JSS and run imaging. Without autorun data, Casper imaging prompts for a username and password. Logon to Imaging and manually applying the same configuration to each machine. This runs the enroll process as expected after imaging.

[bsuggett]

JAMF suggests workaround

Workaround both problems by removing the computers from the JSS first. Then setting up Pre-Stage Imaging. If you haven't used it before, pre-stage is like autorun for computers that don't exist in the JSS database. Because we would not have policy history, all existing policies would run on re-enroll.
Let me know if you have any questions about how to set this up or anything else!

[lynnp]

I realize this thread is old, but is there an updated solution to this problem? Re-enrolling after imaging negates the functionality of autorun imaging. In a lab environment, having to re-add machines to the JSS after each imaging is a complete headache.

[noah]

This thread is now much older...
I'm having the same issues with iMacs that needed to be imaged twice because of a mistake in the original config. They fail out with improper device certificates unless I manually run the /Library/Application Support/JAMF/FirstRun/Enroll/enroll.sh script. If I do that they recognize the invitation and everything seems fine.

[jrippy]

@noah I noticed the same issue and contacted my support contact at JamF. So a couple of things happened. We had a prestage imaging setup to image the machines. It was failing almost immediately but it goes ahead and creates the JSS record for that machine. Once I fixed the prestage configuration, we would have to delete the record and reuse the computer name from the prestage logs. Then it would prestage again.
As for the Autorun not enrolling, we also asked our guy about that. He relayed the message from the Engineering group that this is actually EXPECTED behavior. The idea being if we have a machine in the JSS already, then using Autorun imaging we shouldn't "re-add" the machine to the JSS.
I wanted the information so I knew the last time a machine was imaged. He suggested on those configurations, adding a QuickAdd package as the last step. That would re-enroll regardless.

[CasperSally]

We've had to use a quickadd because of autorun since upgrading to 9. Fun times.

[noah]

Now I'm imaging new MacBook Airs (via Ethernet to Thunderbolt adapters) that have never been in the JSS with the same issues. I even told PreStage Imaging to install a QuickAdd package on reboot but it doesn't seem to do it. My full PreStage is:
1. Set computer name
2. Reboot to internal drive
3. Add two admin users
4. Bind to AD
5. QuickAdd
6. KACE agent
7. Script to turn on SSH
8. Script to Kickstart ARD
9. Script to add IsHidden bit to admins

It renames the computer and reboots, adds my admins and installs the KACE agent but nothing else. I still have to run enroll.sh manually at which point everything comes together.
So far I've tested this on eight machines. I have 43 to go...

[CasperSally]

Try adding a script to enabled wifi adapter (link to one in feature request below).

If that fixes it, vote up my feature request :)

Casper Imaging - build in enable ethernet adapters functionality

[noah]

Our wifi network setup requires the user to login with their unique credentials. It also creates a trust certificate for each machine because there's a limit. Gotta do this over Ethernet. I'll try your script though!
I voted up anyway. It's a good cause.

[CasperSally]

@noah, i had a typo above. the script enables the ethernet adapter (not wifi).

[noah]

End of the day update:
I added two more scripts to the Configuration/PreStage based on my research here. One that enables the Ethernet adapter as suggested above and one that sets the timezone correctly and turns on ntpd. Still no luck. I'm using an external drive with Casper Imaging set to run on login. The machines are identified by serial number.