OS X Configuration Profiles Applied but not enforced?

Valued Contributor II

There's been a few threads regarding config profiles in the last few weeks, and I was definitely a victim of those. But something different (though possibly related?) seems to be happening to me. I am working through deploying our 10.11 upgrade (yes, I know it's been out for months, but vendors need time to update) and I can't tell if it's profile specific or 10.11.4 specific.

Here's the situation. I've got an existing safari configuration profile to set trust settings for plugins based on sites (in this case for our VPN) written to com.apple.Safari.plist:


That's been in place for a few months, works just fine, adds the trust/site info and enforces it without issue.

In the last few weeks, I've been working to add a few more trusted plugin/site configurations. Anything new seems as if it will apply the setting, but not enforce it. Doesn't matter what the plugin is. Doesn't matter if I have one config profile for all plugins, or each plugin gets its own profile.

Let's talk variables. So what's changed from the time that I'd built the first one to now? JSS upgraded from 9.7 (old plugin) to 9.82 (new ones that are testing/failing). OS X updated to 10.11.4 (which may or may not have been the bug over the last few weeks) but the old profile still works on 10.10.x/10.11.x.

Looking to see if others have had similar issues? Was probably going to open a support ticket just in case. FWIW, this is happening in a test environment where I wouldn't think it's related to database bloat/corruption/etc since it's only got a few computers that I test against.

And I also have a running bet with myself as to who the first person will be to respond to this...


Contributor II

@easyedc I have experienced the same. We are on 10.10.5 across the board. Started working on the 10.11.3 and now 10.11.4 upgrade. Noticed that the config profile from my Yosemite world with Safari 8.0.8 was not applying any settings to the El Cap devices, nothing at all.

So, I created a test Safari setup on El Cap, grabbed the plist and uploaded it, applied to only the El Cap devices. Everything works fine. Not sure if it is/was a Safari thing (8.0.8 vs 9.0.3/9.1) or an OS thing. Or, a combo of both.

We have since deployed Safari 9.0.3 to Yosemite without issue. The profile that I created on and for Yosemite is fine with the new version of Safari.

Currently running two Safari config profiles. One scoped to Yosemite, the other scoped to El Cap.

When the new setup created on El Cap worked fine I put the task of trying to figure out why on the back burner. Interested to know the reason behind it though.

Valued Contributor II

Interestingly, the newer ones were built on El Cap and deployed straight to El Cap. Only the one built on 10.10.5 is working, but seems to be working for both YOSX and El Cap.