New Jamf admin here- best practice for failed configuration profile?

[rahern]

Hi everyone. New to Jamf Pro Cloud, as of a few weeks ago. I understand Configuration Profiles from my macOS Server days, but what is the best thing to do if a config profile fails to install? I'm managing about 75 machines, and have a failed profile on one machine.

[stevewood]

@rahern

Try removing the machine from the profile scope, save the profile, and then re-add the machine to the profile scope. If you are using a group, or the "All Computers" group, to scope, just add the one machine as an Exclusion under the Scope tab, save, and then remove from the Exclusion to re-deploy.

[larry_barrett]

Can you post the configuration profile that is failing, for research purposes? :)

[rahern]

The one that is failing, and it's always on the one same machine, is a bind to Active Directory.

[stevewood]

@rahern what is the error on the Management tab under "Management Commands" -> "Failed Commands"? You should see an error message of some kind there. That might help you diagnose.

Is the machine in question on the internal network and able to communicate with the DC?

[rahern]

@stevewood , it says "The ‘Directory Binding Account’ payload could not be installed. The server ‘*.**.edu’ either couldn’t be found, or was not responding."

Not sure that helps though, since the same profile works on 70 other machines.

[stevewood]

@rahern sounds like the machine is unable to communicate with the DC when the profile is being installed. Have you verified communication with the DC on that machine? That would be my first stop. Perhaps even try manually binding the machine using dsconfigad from Terminal to see if you receive any errors.

[rahern]

Good news and bad news. Good news, figured out what caused the problem. Someone messed with the DNS on this machine, /sigh. Fixed that. Bad news, I'm not sure how to 're-push' this configuration profile to a single machine. Ideas?

[cpresnall]

exclude the system, save, clear pending commands, remove exclusion to re-push.

[sdagley]

If you have a profile that has a tendency to fail on install you might find it helpful to create a Static Group named something like "Exclude from <Some Configuration Profile>" then add that group as an exclusion to the scope for <Some Configuration Profile>. When you need to re-push add the machine having the problem to the Static Group then delete it. No prompts for push to all or only new machines so you're less likely to select the wrong thing.

[rahern]

Thanks everyone. I excluded the machine, saved, removed the exclusion, and then it pushed fine. This is my first post on Jamf Nation, glad to see everyone was responsive and helpful!