Issues with Configuration Profiles & Yosemite

[jonathank]

Has anyone had problems removing Configuration Profiles manually (using the profiles command from Terminal) on machines upgraded from Mavericks to Yosemite? Apple is telling me that the error I'm receiving is due to the profiles that are pushed via the JSS have PayloadRemovalDisallowed set to true and no password which apparently prevents the removal of these profiles manually in 10.10.

I've also noticed that my fresh Yosemite machines are not deploying Configuration Profiles at all so this may be related. I'm on JSS 9.2.

[mm2270]

I think before you can expect the JSS to work reliably with Yosemite you need to update it to version 9.6 release yesterday. Any previous versions can't be guaranteed to work with 10.10.

[mjohnston]

I'm on version 9.3 and have just enrolled my first Yosemite machine and am finding that configuration profiles are not being pushed.
I've set a restriction to stop users from upgrading to Yosemite but this machine was already upgraded before I set the block so I guess I will manually configure those half dozen remaining items.

So basically, the fix is to upgrade the JSS? Wow I just spent 2 months building our Casper environment so I better look into backing up and upgrading.

[alexjdale]

Backing up and upgrading is easy, especially if you are on 9.3. I upgraded from 9.23 to 9.52 with no issues: stop Tomcat, use JSS Database Utility to take a backup, copy backup to another location (just in case), run the new JSS installer.

The great thing is that the database backup is everything: if anything goes south, you can rebuild from that pretty easily.

[gachowski · Accepted solution]

Jonathan,

I am seeing the same behavior and it is what I want, don't want the users removing profiles : )

You should be able remove the profiles with "sudo jamf removeMdmProfile"

C

[jonathank]

gachowski:

Indeed, that does wipe the the Configuration Profiles. Thanks for that. I was unable to get any of them to reapply after running "sudo jamf manage" other than the default one however. I'll do as mm2270 suggested and test again after upgrading.

[gachowski]

I have a EA that verify that the profiles are installed and if they are not then the machine is in a smart group that will run a "sudo jamf mdm" and that has re-added the profiles. I am using 9.6 beta 1 for testing : )

sudo jamf manage didn't work for getting the profiles back for me either : )

C

[rmanly]

They brought back jamf mdm.

See @rtrouton's post here

https://jamfnation.jamfsoftware.com/discussion.html?id=12375

[mapurcel]

I am also seeing this behavior on Yosemite, you can no longer remove Configuration Profiles individually. You can remove the MDM Profile which removes them all and then use jamf mdm to get them back, but it was nice to be able to remove them individually. My JSS is on 9.61. Is this something you can set on the JSS?

[mapurcel]

According to my JAMF rep this is a Yosemite thing, individual profiles can no longer be removed by an admin user, but removing the MDM profile removes all of the profiles.