Laptop meets requirement for MDM but JSS shows as unmanaged.

[matthew-c]

Hi I'm having a weird issue with one of our machines that refuses to enrol correctly in MDM.

It a current spec 13" Macbook Pro with 10.7.3 and a working Apple recovery partition.
It receives the MDM enrolment profile but will not apply any of the payloads assigned to it. The JSS also shows it as unmanaged.

All other machines i've enrolled (with an identical setup in the JSS and casper imaging) so far are working correctly and receive the pushed profiles immediately.

I have tried completely wiping the laptop and removing it from the JSS and rejoining.

Repeatedly output to console on this machine is

30/04/2012 09:45:29.247 mdmclient: [Agent:501] Current user is not bound by the MDM configuration:
'<Payload: MDM Enrollment (00000000-0000-0000-A000-4A414D460004) from profile:
MDM Enrollment (00000000-0000-0000-A000-4A414D460003)>'
because it was installed by a different user on the system.

and here is the output when trying to enforce management using the jamf binary (the only difference marked in bold.)

Not working machine

[casperlaptop:~] macadmin% sudo jamf manage -verbose
Getting Management Framework from JSS...
Enforcing Management Framework...
Enforcing Login/Logout Hooks...
 verbose: Creating Login Hook...
 verbose: Enabling Login Hook...
 verbose: Creating Logout Hook...
 verbose: Enabling Logout Hook...
 verbose: Writing preferences for LoginWindow...
 verbose: Timeout: 10
Checking availability of https://caspermanage.mpc.local:8443/...
The JSS is available.
 verbose: Creating Startup Item script...
 verbose: Created Startup Item script.
 verbose: Creating launchd item for Startup Item...
Enrolling machine...
    **Previous (1) MDM Identities found on this machine. Removing...**
Enforcing Scheduled Tasks...
 verbose: Removing Task ID 3...
 verbose: Removing existing launchd task com.jamfsoftware.task3.plist...
 verbose: Removing Task ID 3...
 verbose: Creating Task Every 15 Minutes...
 verbose: Adding launchd task com.jamfsoftware.task.3...
    Creating Usage Monitoring Task...
 verbose: Removing Task ID monitorUsage...
 verbose: Removing existing launchd task com.jamfsoftware.taskmonitorUsage.plist...
 verbose: Creating Task monitorUsage...
 verbose: Adding launchd task com.jamfsoftware.task.monitorUsage...
 verbose: Removing Task ID blacklist...

Machine that works correctly:

casperdesktop:~ > sudo jamf manage -verbose
Password:
Getting Management Framework from JSS...
Enforcing Management Framework...
Enforcing Login/Logout Hooks...
 verbose: Creating Login Hook...
 verbose: Enabling Login Hook...
 verbose: Creating Logout Hook...
 verbose: Enabling Logout Hook...
 verbose: Writing preferences for LoginWindow...
 verbose: Timeout: 10
Checking availability of https://caspermanage.mpc.local:8443/...
The JSS is available.
 verbose: Creating Startup Item script...
 verbose: Created Startup Item script.
 verbose: Creating launchd item for Startup Item...
Enforcing Scheduled Tasks...
 verbose: Removing Task ID 3...
 verbose: Removing existing launchd task com.jamfsoftware.task3.plist...
 verbose: Removing Task ID 3...
 verbose: Creating Task Every 15 Minutes...
 verbose: Adding launchd task com.jamfsoftware.task.3...
    Creating Usage Monitoring Task...
 verbose: Removing Task ID monitorUsage...
 verbose: Removing existing launchd task com.jamfsoftware.taskmonitorUsage.plist...
 verbose: Creating Task monitorUsage...
 verbose: Adding launchd task com.jamfsoftware.task.monitorUsage...
 verbose: Removing Task ID blacklist...

Any idea would be greatly appreciated.

Cheers

Matt

[matthew-c]

Right, getting somewhere with this. Seems that it may be due to proxy/firewall blocks that are in place on specific IP ranges inside our network.

Will document what fixes the issue when i've narrowed it down.

Matt

[bentoms]

Hi Matt,

try the following on you firewall:

Incoming TCP port 5223 from 17.0.0.0/8 to all

[matthew-c]

I've gotta get that past the network security guys but once they open it up i'll test and let you know.

thanks

Matt