Jamf Pro 10.3 Maintenance Release Coming Soon

[michael_devins]

We have identified an issue when using current and previous versions of Jamf Pro to upgrade devices to iOS 11.3. As a part of the MDM Software Update workflow, Jamf Pro will monitor the status of that update. Devices upgraded to iOS 11.3 are returning a new response that does not match Apple’s documented protocol. This response will cause the device to remain in a failed loop, which prevents it from receiving further commands.

We are working on a maintenance update for Jamf Pro 10.3 that will handle the new response from iOS 11.3 devices and prevent this failure. We recommend that organizations avoid using the MDM Software Update workflow to upgrade devices to iOS 11.3 until this maintenance release is available.

Any devices that did go through this MDM Software Update workflow should have their MDM communication restored after upgrading to this maintenance release of Jamf Pro 10.3.

This release will be available in the coming days to all on-premises and cloud customers. We will communicate in a future email when you can download the installers on Jamf Nation. The cloud upgrade, still scheduled for April 14th, will receive this maintenance release as well.

Please reach out to your account representative if you have any questions.

[nstrauss]

@michael.devins Thanks for your quick response.

I have to advocate for a 9.101.x release as well though. As far as I know Jamf never announced end of support for version 9. This is a severe enough bug I think it warrants a new release. We have no plans to update to Jamf Pro 10 until this summer. As it stands that would mean we don't get access to this fix. Upon release 9.101 was promised as having support for iOS 11 and macOS 10.13.

[blackholemac]

@michael.devins I want to clarify what “the MDM Software Update workflow” is. I suspect it is where I would send an iOS update command out to devices from the server side. I wish for a confirmation though such a workflow is the only one affected.

[michael_devins]

@blackholemac The MDM Software Update workflow I'm referring to is using the Jamf Pro action to "Send Remote Commands" and select "Update iOS Version..."

[blackholemac]

We are on the same page.

[a_stonham]

Will this Maintenance release also address the issues with Jamf Imaging and Enrollment Invitation errors?

[pmartin]

I would also like to see a patch for version 9 of Jamf Pro.

[sedwards]

The MDM Software Update workflow I'm referring to is using the Jamf Pro action to "Send Remote Commands" and select "Update iOS Version..."

@michael.devins Where in the JSS is this "Update iOS Version" command that you speak of? I don't see it.

[CGundersen]

Not sold that v10 is a good fit for us at this time. I would also advocate for v9.101.x fix. Thank you.

[michael_devins]

@sedwards From a selection of Mobile Devices, select Action in the lower right, Send Remote Commands. On the top of the next page is "
Update iOS Version on supervised devices." This will send an MDM command to update iOS based upon your selection and iOS Update Action.

[miregan]

We are seeing far more issues than ios update commands after upgrading to 10.3. Our Self Service web clip no longer functions on iOS. Update Inventory commands backup the queue's on the device, etc. None of our devices are on 11.3, they are all 11.2.5.

[nvandam]

Does it matter if I chose "Download the update for users to install" or "Download and install the update, and restart devices after installation"?

[galionschools]

I would also advocate for a 9.101 patch. At the very least give us 9.101 folks the option to go through the support channels to get a patch and or a database tweak.

[smunroe]

I have to say that Jamf Pro 10+ has been a disaster so far. Right now, we can't image machine. We can't create QuickAdd packages in Recon. And the admin console is just so incredibly slow and frustrating to work with. It doesn't seem that the functionality hasn't changed at all -- JAMF just wanted to make it 'prettier.' I wish we could roll back to 9.101. With Apple breaking everything left-and-right with the release of 10.13.4, and Jamf Pro 10.3 removing the simplest of functionality, I'm going to need serious migraine medication.

[jl789work]

Does it affect those of us on hosted Jamf 10.2.2? Or those users who update on their own?

[bpavlov]

@michael.devins Some people on Slack have mentioned they did not get an email about it. I personally got an email about it though. I was wondering how it was determined who would receive emails or not. Good job on communicating this quickly by the way.

[CasperSally]

@smunroe I've been 10.2.1 for weeks without imaging issues and can create quickadds and use the admin console ok. I'd nicely suggest testing releases in a test environment if you don't already to try to minimize the upgrade pain (and try not to wait too long between releases if you can, it makes them easier to swallow and test in my experience). I also wouldn't upgrade to new release (not sure you did, just general info) the day or even week it comes out if you can help it. Though it seems like lots of people may be jumping to latest release when this MR comes out.

[michael_devins]

@jl789work The affected workflow is using MDM commands to upgrade devices to iOS 11.3, regardless of Jamf Pro version. End users who upgrade on their own are not impacted.

[michael_devins]

@bpavlov We sent the email to all current Jamf Pro customers, though that group appears to have missed some MSP and Integrator partners. We posted the same message to Jamf Nation in tandem to ensure full transparency with our communication.

[thejenbot]

the picking and choosing of which questions/comments to respond to on this thread is interesting to see. there are several people asking about a possible patch for 9.101 that are being blatantly ignored. i'm at 10.1.1something so not personally affected - i just think it is curious...

[kstrick]

@michael.devins will there be a 9.101.x update? i did push an update to an ipad to 11.3, and it did display symptoms of the issue that was reported...

using 9.101.4

[kmeyer]

Is there any chance of this being released today, or this weekend? We've got PARCC testing on Monday, and right now this issue has us a bit handcuffed, as our effected student devices cant receive commands from Self Service.

Either way, your hard work is greatly appreciated. Thanks!

[cbrewer]

@kmeyer Contact your account manager or support. There are options.

[donmontalvo]

We've been told Jamf Pro 9.101.x will not receive any more development, although we might see a patch if a show stopper is found.

The writing is on the wall on getting to Jamf Pro 10.x, not just for compatibility/feature support, but so Jamf doens't get strung so thin that they have to split resources between two different sets of code. That would affect the quality of both versions IMHO.

We are not the cutting-edge-gotta-keep-up-with-the-Jones'-gun-slingers type, so we try hard to avoid jumping into the scream-test rabbit hole. But in this case we're doing everything we can to get to Jamf Pro 10.x, because it makes so much sense.

With all Apple's recent missteps...KEXT management...FileVault2/APFS/secureToken madness...etc...we can't afford to get caught with our pants down, being on Jamf Pro 9.101.x.

We tested Jamf Pro 9.101.4 > 10.3 and despite our having Jamf Pro clustered, load balanced (internal and DMZ), MySQL replicatino/failover, tons of API development going to/from Jamf Pro, and a bunch of complex deployment workflows, the upgrade process was refreshingly smooth.

Don

[nstrauss]

@donmontalvo Good to hear you had a positive experience. Writing's on the wall we will most likely be forced to version 10 as well.

Have to ask though, is breaking MDM communication with iOS not a show stopper? Depending on your scale that could mean hundreds of work hours to fix.

[Sandy]

The affected workflow is using MDM commands to upgrade devices to iOS 11.3, regardless of Jamf Pro version. End users who upgrade on their own are not impacted.

[PatrickD]

Hi @michael.devins, anything further on this?

Cheers,
Pat

[CSNavigateurs]

We have notice when sending an Enrollment Invitation that the new invited iPad receives Self Service but it is not able to connect. (Pic 1) This invitation also causes the iPad's to request updating its AppleID See Pic 2 ... Also ALL our 900 apps are "Pending - Unavailable to Install" in management pane. We are on premise JAMF PRO 10.2.2-t1520356605 running in a VM Windows 2012 R2 server and iPads 11.3

Hope you guys correct this soon as my 5000K+ iPads are creating a gigantic pending back-up..and logging exploding

[miregan]

Also with 10.3 self service apps that are made to be available to self service only install by themselves after a wipe if they were installed initially. I work in a hospital and we deploy iPads to every room for the patient and then in turn they are wiped on patient discharge. If a patient installs say "Hulu" from self-service and the patient is discharged, that tablet is wiped. When a new patient is admitted and enrolls the ipad Hulu is automatically installed on the iPad despite it being set to available in self-service only and not an automatic install.

Also, in 10.3, Change Management doesnt function as when you click "Details" it either doesnt load or it flashes for a second and goes away.

Seems like there are alot of issues with 10.3 that shouldve been discovered in testing. The automatic install of self service apps is a bit ridiculous imo.

[russeller]

@CSNavigateurs I'm also seeing the same errors on my web apps behind a load balancer. So I grabbed a packet capture and found the problem they spoke about. I think at this point we need to wait for that maintenance release.

[snourse]

@miregan We have found the same issue with apps reinstalling after a device wipe. However- it doesn't seem to be consistently getting ALL apps from what little testing I've done- just some of them.... Is that what you are seeing?

[michael_devins]

Today, we released Jamf Pro 10.3.1. See discussion and release notes for full details.

[miregan]

@snourse I am seeing all apps that were installed prior being reinstalled. I have been told by jamf support that the workaround is to delete the devoceninventory or wipe the device twice. Both of which are crap workarounds in my scenario given that he wiping of he device is handled automatically by the hcl. How jamf can make self service completely worthless is beyond me. I hope it’s fixed soon.

[HNTIT]

Is there any news on when JamfCloud subscriptions get this update ?

We are an EMEA based Tennant and we are still on 10.2.2 and could really do with this update