MDM Profile Expiration Date

[kgam]

I'm curious as to what happens when a computer hits the "MDM Profile Expiration Date".

Will MDM commands stop working?
Will the profile be renewed automatically or do I have to issue a new profile using 'Action' -> 'Send Remote Commands' -> 'Renew MDM Profile'?

Thanks!

[cnixon14]

Hello. Do you have any updates on this? I noticed the MDM Cert on our server is about to expire but the Certs pushed to machines auto renews. Thanks!

[vinu_thankachan]

You can use the Below EA to check the MDM verification state https://www.jamf.com/jamf-nation/third-party-products/files/830/mdm-profile-verification-state
You can create a smart group and send mass action "Renew MDM Profile" command

[rhooper]

@vinu_thankachan Taht link is no longer working. I have been trying to locate how to get our systems to renew their MDM Profile date, en mass.
Thanks for any updates

[kgam]

Can't remember if the below script was the content of the now expired link above but this is what we use to check the verification state in an extension attribute:

#!/bin/bash
####################################################################################################
#
# Copyright (c) 2015, JAMF Software, LLC.  All rights reserved.
#
#       Redistribution and use in source and binary forms, with or without
#       modification, are permitted provided that the following conditions are met:
#               * Redistributions of source code must retain the above copyright
#                 notice, this list of conditions and the following disclaimer.
#               * Redistributions in binary form must reproduce the above copyright
#                 notice, this list of conditions and the following disclaimer in the
#                 documentation and/or other materials provided with the distribution.
#               * Neither the name of the JAMF Software, LLC nor the
#                 names of its contributors may be used to endorse or promote products
#                 derived from this software without specific prior written permission.
#
#       THIS SOFTWARE IS PROVIDED BY JAMF SOFTWARE, LLC "AS IS" AND ANY
#       EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
#       WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
#       DISCLAIMED. IN NO EVENT SHALL JAMF SOFTWARE, LLC BE LIABLE FOR ANY
#       DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
#       (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
#       LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
#       ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
#       (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
#       SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
#
####################################################################################################
# Gather MDM Profile Verification State v1 - gmaki 1/4/16
# v2 updated awk to print a "Not Verified" result appropriately - bschmidt 1/5/16
# Note, If an MDM Profile is not installed on the client, or if this script cannot find a verification state attribute within 3 lines after the profile identifier using the system_profiler command, this EA will return an "Undecided" result to the JSS.
profileVerifyStatus=`system_profiler SPConfigurationProfileDataType | grep -A3 "UUID: 00000000-0000-0000-A000-4A414D460003" | grep "Verification State: " | awk -F ': ' '{ print $2 }'`
if [ "$profileVerifyStatus" != "" ]; then
echo "<result>$profileVerifyStatus</result>"
else
echo "<result>Undecided</result>"
fi
exit 0

[musat]

I know this is a bit old, but I am wondering this same thing. I see the solution to see if the MDM Profile has expired or not. But I have a bunch of devices with an expired Profile and am trying to figure out a way to get the certificate "renewed". So far nothing seems to be working, but maybe I just have yet to try the one thing that will get them renewed.

[palmna]

@musat , Did you figure this out?  I have a several hundred AppleTVs with expired MDM profiles.  I really don't want to re-enroll, but it seems that might be my only option. 

[musat]

I have not, and so far on the MacBooks, a complete erase and reinstall is the only solution we have come up with. We could do a `jamf removeframework`, and full reenroll, but that isn't something that our school-based help desk techs can readily do.