Posted on 01-17-2023 03:51 PM
Hello all,
I have a JamfPro instance with about 40 Macbooks. Of those, I have 10 devices that are not accepting any management commands. To clarify, all of the management commands and configuration profiles are stuck in pending and nothing that I have done so far appears to have any effect.
I have attempted the following in an attempt to fix:
Script result: Error: Renewing DEP enrollment failed: (null) ((null):0) |
Has anyone else run into this where specific devices are not accepting management commands? Is there any way to fix this without having to physically visit all 10 devices?
Solved! Go to Solution.
Posted on 01-18-2023 05:15 AM
They may just need to be rebooted. You probably need to get your hands on the devices as if profiles are not loading, JAMFs MDM commands wont work. The JAMF Binary may allow you to run some commands with a policy, but that is really it.
I can tell you now Apple will say reinstall macOS from recovery if rebooting does not resolve. Honestly I'd probably reinstall macOS from recovery also as it only takes a few minutes and will likely be less of a time investment then figuring out what is going on.
Posted on 01-17-2023 08:15 PM
Are you able to connect to any of the machines on the command line?
If so, maybe try
sudo jamf recon
and see whether it can do a full recon
Posted on 01-18-2023 01:15 AM
Things you could check: Do these devices have up-to-date MDM profiles? Are the MDM profiles user approved?
Posted on 01-18-2023 05:15 AM
They may just need to be rebooted. You probably need to get your hands on the devices as if profiles are not loading, JAMFs MDM commands wont work. The JAMF Binary may allow you to run some commands with a policy, but that is really it.
I can tell you now Apple will say reinstall macOS from recovery if rebooting does not resolve. Honestly I'd probably reinstall macOS from recovery also as it only takes a few minutes and will likely be less of a time investment then figuring out what is going on.
Posted on 01-18-2023 07:40 AM
This has helped in a few instances where devices were still checking in but not running commands.
https://www.modtitan.com/2022/02/jamf-binary-self-heal-with-jamf-api.html
Posted on 01-18-2023 03:18 PM
Posted on 01-20-2023 12:16 PM
Seeing some sporadic success with using the self-heal. Thank you @channy-cl and @bfrench !! Had no idea such an option was available, and I want to be sure I thank you for the suggestion.
That said, is there no other way to issue the sudo profiles renew -type enrollment from the MDM? Just trying to think of a way this could possibly be automated?
Again, thank you all for taking the time, I'm still learning a lot.
Posted on 01-20-2023 12:24 PM
That is a chicken and egg problem!
We generally want the "profile renew" command executed on a device where for some reason MDM is broken. But when MDM is broken on the device, there is no way to send the command via MDM :|
Posted on 01-20-2023 12:26 PM
I'm fully able to scope them into policies and scripts just fine. Those run and execute regularly and pretty much as expected. Its *only* management commands and configuration profiles.
Posted on 01-20-2023 12:36 PM
Ahh I see what you mean!
I have not tried it myself, but may be you can try find the active user and run the command as that user.
For example,
sudo -u johnd sudo profiles renew -type enrollment
Basically, I believe (might be completely wrong) that policy scripts run as root user and that might be the reason it does not work when run via policy.
If you test it, I would be super curious to know how it goes.
Posted on 01-20-2023 12:45 PM
I'll give it a try and let you know. Thank you! As a side note, I have limited access to the devices right now, but will have more direct physical access on Monday, 1/23/23.
Posted on 01-24-2023 01:45 PM
@Leafeon182 I was thinking about running "profile renew" via script and don't think that will solve your issue completely!
Assuming even if the command runs as the user successfully, the mac will then wait for the user to go to the profile list and approve the new profile, no?
Posted on 06-04-2023 02:36 PM
What if there are no profiles in the list?