MDM Profile Expiration Date

kgam
Contributor

I'm curious as to what happens when a computer hits the "MDM Profile Expiration Date".

Will MDM commands stop working?
Will the profile be renewed automatically or do I have to issue a new profile using 'Action' -> 'Send Remote Commands' -> 'Renew MDM Profile'?

Thanks!

7 REPLIES 7

cnixon14
New Contributor III

Hello. Do you have any updates on this? I noticed the MDM Cert on our server is about to expire but the Certs pushed to machines auto renews. Thanks!

vinu_thankachan
Contributor

You can use the Below EA to check the MDM verification state https://www.jamf.com/jamf-nation/third-party-products/files/830/mdm-profile-verification-state
You can create a smart group and send mass action "Renew MDM Profile" command

@vinu_thankachan Taht link is no longer working. I have been trying to locate how to get our systems to renew their MDM Profile date, en mass.
Thanks for any updates

 

kgam
Contributor

Can't remember if the below script was the content of the now expired link above but this is what we use to check the verification state in an extension attribute:

#!/bin/bash
####################################################################################################
#
# Copyright (c) 2015, JAMF Software, LLC.  All rights reserved.
#
#       Redistribution and use in source and binary forms, with or without
#       modification, are permitted provided that the following conditions are met:
#               * Redistributions of source code must retain the above copyright
#                 notice, this list of conditions and the following disclaimer.
#               * Redistributions in binary form must reproduce the above copyright
#                 notice, this list of conditions and the following disclaimer in the
#                 documentation and/or other materials provided with the distribution.
#               * Neither the name of the JAMF Software, LLC nor the
#                 names of its contributors may be used to endorse or promote products
#                 derived from this software without specific prior written permission.
#
#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
#       EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
####################################################################################################
# Gather MDM Profile Verification State v1 - gmaki 1/4/16
# v2 updated awk to print a "Not Verified" result appropriately - bschmidt 1/5/16
# Note, If an MDM Profile is not installed on the client, or if this script cannot find a verification state attribute within 3 lines after the profile identifier using the system_profiler command, this EA will return an "Undecided" result to the JSS.
profileVerifyStatus=`system_profiler SPConfigurationProfileDataType | grep -A3 "UUID: 00000000-0000-0000-A000-4A414D460003" | grep "Verification State: " | awk -F ': ' '{ print $2 }'`
if [ "$profileVerifyStatus" != "" ]; then
echo "<result>$profileVerifyStatus</result>"
else
echo "<result>Undecided</result>"
fi
exit 0

musat
Contributor III

I know this is a bit old, but I am wondering this same thing. I see the solution to see if the MDM Profile has expired or not. But I have a bunch of devices with an expired Profile and am trying to figure out a way to get the certificate "renewed". So far nothing seems to be working, but maybe I just have yet to try the one thing that will get them renewed.

@musat , Did you figure this out?  I have a several hundred AppleTVs with expired MDM profiles.  I really don't want to re-enroll, but it seems that might be my only option. 

musat
Contributor III

I have not, and so far on the MacBooks, a complete erase and reinstall is the only solution we have come up with. We could do a `jamf removeframework`, and full reenroll, but that isn't something that our school-based help desk techs can readily do.