Posted on 11-30-2016 05:48 AM
Hello there,
We have a few naughty users who unenrol their devices from JSS... I have pushed a webclip for their use and i would like it to remain once they have unenrolled so that they're not lost until they re enrol
Posted on 11-30-2016 07:46 AM
Hi. Couple of things. First, you should probably make this into a Feature Request instead of a regular discussion thread.
Second, the behavior you're describing (web clip disappearing upon un-enrollment) isn't really something JAMF has control of. Its an Apple thing, and is how they designed their MDM. Basically, if the web clip is deployed as a Configuration Profile from your JSS, as I suspect it was, it means its tied to the overall enrollment configuration to your JSS. All config profiles deployed from your MDM server are tied to that enrollment config. Once the top level enrollment is removed, it auto removes all the sub config profiles under it. Its just how it works. The only way to prevent it would be to install a separate standalone config profile (.mobileconfig file) on the devices that adds the Webclip, which would not be tied to the enrollment configuration. This can be done a few ways, but I'm not going to go into that here since I'm not the most well versed in mobile device management. Someone else can probably better explain the ways to do this.
Lastly, you should at least consider not doing this, since it may provide an incentive to those naughty users to stop un-enrolling their device. if they are losing access to certain resources, such as a special Wi-Fi connection, or email, etc. this may make them think twice about removing the overall enrollment again. If you give them an easy way to un-enroll, re-enroll, over and over, they will just continue to do it to temporarily get around any restrictions you may have in place, which kind of defeats the purpose.
That's just my 2¢ on the issue.
Posted on 11-30-2016 07:25 PM
thank you, that's very helpful... back to the drawing board then :)