Ongoing enroll issues post imaging

[jamesdurler]

After casper imaging i'm aware JAMF use their own enroll script / post install script which are triggered by launchdaemons. What I've seen sometimes happen randomly is machines will not enroll. Attempting to re-image results in the same problem. After trawling through the logs where the enroll script re-directs output and also the jamf.log the error message i'm almost always presented with is :
**
There was an error.

Device Signature Error - A valid device signature is required to perform the action.**

I have spoken to JAMF support countless times about this and also searched JAMFNation about this message and it seems as though this message relates to a problem with certificates. Deleting the computer record in the JSS always fixes the above issue; probably because it removes the related cert in the JSS.

Deleting the affected record is not really an acceptable solution for us, especially since we are looking to roll out encryption. (What concerns me here is you can delete a computer record with no warning that there is an associated FV2 key.)

Anyway, what i'm getting at is if the issue is the cert stored on the JSS and deletion of the record resolves this because it removes the cert why can't the enrolment:

1)check if there is an existing record for the machine that is attempting to enrol

2)check if the cert matches - if it doesn't remove the cert from the server and leave the record behind to allow the enrolment to go through.

Does anyone have a fix for this which doesn't involve deleting the record and can easily be added to our post imaging scripts?

[bentoms]

@jamesdurler Is this only affecting new macs or reimaged?

[jamesdurler]

Hi @bentoms ,

Yes it only happens upon reimaging.

I just got a response back from JAMF support with the following:

1) Log into the MySQL server with the root user
2) Select the jamfsoftware database with "use jamfsoftware;"
3) Next do a count on the computers table: select count() from computers;
4) Next do a count on the computers_denormalized table: select count() from computers_denormalized;
5) Compare the counts and if the computers_denormalized count is not the same as the computers count let us know and we'll go from there.

I'm guessing if there is a mismatch in these tables then it can be cleaned up. However, it will only be a matter of time before the problem crops up again.....

I'll keep you posted if this goes anywhere. Do you have any ideas ? :)

[bentoms]

@jamesdurler I've seen it before when a Macs UUID has changed.

I've been trying to hunt down exactly what is needed to change a UUID so i can test something to resolve this, as I've had Macs with a change in UUID that have had NO hardware changes.

Essentially the JSS is getting confused as to who the Mac is is & expects one certificate from it to identify itself but it gets another.

[jamesdurler]

Thats interesting. The next time I get this issue I'll see if I can compare UUID on the machine and inventory record.

Thanks for the heads up!