Orphaned profile I can't remove

[AVmcclint]

Yesterday I was experimenting with setting the homepage in Safari via Config Profile. It worked quite well, but it was only a test so I removed my computer from the scope and went home for the day. This morning I discovered that my computer was still locked in to the homepage I set in the test profile. I was done with my test so I deleted the profile from the JSS thinking that would definitely remove it from the computer. Nope. My computer still has the profile installed and it definitely managing my Safari homepage. I can't remove it from System Preferences > Profiles because the minus sign is grayed out. I tried using the profiles remove command but it tells me that the profile cannot be removed. How on earth can I remove this unremovable profile? I can't scope and unscope my computer to the profile since I deleted it from the JSS. Is there some magic way of removing this?

[mm2270 · Accepted solution]

Unfortunately you might need to blow away the profiles database - see this post: https://www.jamf.com/jamf-nation/discussions/21384/hostile-takeover-possible-to-purge-non-removable-...

Outside of that, you could try first deleting the plist file that should be located in /Library/Managed Preferences/ somewhere. I'm guessing it would show up as com.apple.Safari.plist, but not 100% sure. If you delete it from there, there's a remote possibility it could come back, but I have not tested that after deleting a Profile from the JSS. It may not push down again if there's nothing in scope to deploy. Of course, the actual profile will remain in System Preferences even if you delete the managed plist for it. The first method above of deleting the profiles db will surely get rid of it, but it will also remove all other profiles.

[larry_barrett]

Post your config profile if you haven't deleted it yet. Interested.

[AVmcclint]

I already deleted it from the JSS, but I created it by uploading a com.apple.Safari.plist file that contains this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>HomePage</key>
    <string>https://internalsite.company.com</string>
    <key>NewWindowBehavior</key>
    <integer>0</integer>
</dict>
</plist>

That's it. I set it for Computer level & auto install.

[mm2270 · Accepted solution]

Unfortunately you might need to blow away the profiles database - see this post: https://www.jamf.com/jamf-nation/discussions/21384/hostile-takeover-possible-to-purge-non-removable-...

Outside of that, you could try first deleting the plist file that should be located in /Library/Managed Preferences/ somewhere. I'm guessing it would show up as com.apple.Safari.plist, but not 100% sure. If you delete it from there, there's a remote possibility it could come back, but I have not tested that after deleting a Profile from the JSS. It may not push down again if there's nothing in scope to deploy. Of course, the actual profile will remain in System Preferences even if you delete the managed plist for it. The first method above of deleting the profiles db will surely get rid of it, but it will also remove all other profiles.

[AVmcclint · Accepted solution]

Now this is very strange.... throughout the day I've been checking on System Preferences > Profiles to see if maybe it decided it had had enough and left on its own accord. The "Safari homepage" profile was there all day until about 15 minutes ago. It was just gone. I looked in /Library/Managed Preferences/ and there was no com.apple.Safari.plist file to be found. I quit and relaunched Safari and checked the preferences and sure enough I can now change the homepage to what I want. I can't see any indication of something happening in the computer record for my Mac. I am glad it resolved itself but it is a definite mystery why it stayed when I removed the computer from the scope AND why it finally disappeared almost 24 hours later. I'm glad I didn't have to nuke all the profiles like you suggested @mm2270

[Chris]

Maybe the „remove“ MDM command was stuck for that long?
It should show in the „Management History“ tab of your computer object when the profile was removed