Mobile Device Smart Groups - Best Practices

[Michael_Meyers]

We have been running into a high CPU usage issue on our Database server (Windows 2008r2) caused by multiple items in the Smart group criteria. We were able to narrow it down to one of our techs cloning other Smart groups, renaming Smart group, deleting the serial number data, and filling in new iPad serial number data. There are at least 120 serial number criteria entries in a few of the Mobile Device Smart groups, and any blank entries were causing our server CPU to ramp up excessively. I went in and deleted the empty entries and the CPU went down quite a bit.

We started using this method as an addition to pre-staging the incoming iPads. We are still using mostly carts (no One to One) for students and have one main PreStage Enrollment. We enter all of the serial numbers from the new iPads into the Smart groups, so once they are enrolled, Apps scoped to the Smart groups start installing automatically.

We have been told multiple times that we have too many criteria entries in our Smart groups from JAMF, but we see no other mostly automated solution for this issue. Multiple schools are being done at one time this summer, so resetting the PreStage Enrollment location for each cart manually won't work.

So, here are my questions for Mobile Device Smart Groups: How many of you use less than 10 criteria items for your Smart groups? Would a Smart group for each cart (vs. each building) where 30 iPads would be the most in the group be a better option? Is there such a thing as too many Mobile Device Smart groups?

Thanks!

Mike

[bumbletech]

Cart iPads are hard without Configurator. You might want to check out (shameless bit of self promotion) using Configurator 2 automation by way of what I call Casfigurator: https://github.com/bumbletech/casfigurator

What I did is setup an extension attribute for "App Distribution Groups." I then make a smart group with the criteria for each list that I want to assign apps to. We'll later use a Configurator automation script to populate these fields during iPad setup. For Example:

Google Drive, Google Sheets, Google Slides, Google Docs all get scoped to the "Distribution Group: GoogleDriveApps" where the criteria is "App Distribution Groups" LIKE "GoogleDriveApps."

Pages, Keynote and iMovie all get scoped to the smart group "Distribution Group: GoogleDriveApps" where the criteria is "App Distribution Groups" LIKE "AppleiLife."

Lather, rinse repeat for grade level or department specific distribution groups. You'll want to

When techs are setting up iPads with Configurator 2's DEP-automated workflow, they run a script that prompts them to build the device name and select the app distribution groups the iPads should be a part of. The script grabs the serial numbers out of Configurator and fills in the "App Distribution Groups" extension attribute via the JSS API, which then puts the devices into their correct smart groups, and apps start installing after setup.

Here's a video of what the process looks like for a tech: https://www.youtube.com/watch?v=g98iwQDwUb0&t=2m37s

This way you can break down your apps into basic groups, and if a new cart needs to be created that uses any of pre-existing distribution groups, nothing needs to happen on the JSS.

[Michael_Meyers]

We did the whole Configurator process before, and with over 30 schools and about the same amount of Sync Stations, we are done with it. Never again. We have had some success with getting them enrolled and the Apps out using DEP and VPP, but we are trying to get them as automated as we can. Especially if we have to reset one of the iPads, we want it to go right back into the same group and get the same Apps/Configuration Profiles.

[bumbletech]

Just want to make sure we're on the same page: All of the apps are still being assigned from the JSS. This is just an AppleScript that uses Configurator 2 to grab the serial numbers of all the USB-connected devices so your Mac can write custom data to the device records. If your devices are being supervised and enrolled via DEP, the Configurator instance can be completely disposable.

If you want to send an erase command or wipe a device by hand, the device will get all of the same apps it had before. The data's being written to the device record so it will stay put unless you delete the device from your JSS.

[cdenesha]

@Mike_Meyers I know the summer is done, but this is what I came up with for my deployment:

An Extension Attribute where I can choose from a set of values. For you, that would be a string for each of your carts - perhaps 'building - room'.

A Smart Group where the criteria is that EA = 'this building - room cart'. This will be the app scope.

Make sure your PreStage is not renaming the devices on enroll and that it is reusing the User & Location data, so they can keep the same name as before.

This does require all devices to be edited once in Casper to set the EA, but it'll stick across enrollments.