Problems with smart groups after 9.2 upgrade

[lhscasper]

Hi All,

I have a problem with smart groups after upgrading to 9.3. I upgraded yesterday (and haven't changed anything else).

Now, every time a device updates, I get notifications that it has been removed from the smartgroup, then almost immediately I get a notification that it has been added to the smartgroup.

The smartgroup in question checks to see whether specific profiles are installed.

I have noticed many devices, it seems as though the current inventory is deleted for several seconds before the new inventory is added and this removal then addition of the inventory is causing these emails.

This is of considerable concern as I use smart groups to define whether users are entitled to have their WiFi certificates and authentication installed - if the system decides to remove their WiFi then tries to add it again then the re-addition will fail.

How do I prevent these deletions / additions?

Cheers,
Chris.

[lhscasper]

oops. the title should read 9.3 update.

[bentoms]

@lhscasper, how are you defining the groups? Via location?

[lhscasper]

Hi Bentoms,

Not via location. It's simply a department and a check of 3 different profile names. Please see attached image.

Cheers,
Chris.

[bentoms]

@lhscasper, I see you've caught up with the thread I was going to point you too.

[GabeShack]

I used to see a similar issue when defined by Department. Thought they fixed it though.

Gabe Shackney
Princeton Public Schools

[were_wulff]

Hi @lhscasper ,

Thanks for reaching out with this issue! Currently, we’re trying to replicate and confirm this behavior, as we have seen it happen in a couple of other environments in 9.3.

Scoping by department typically does pull from LDAP for information. Do we have departments defined in LDAP, or are we entering/creating Departments manually through the JSS?

If we’re creating Departments in the JSS, could we check and see if we also have “Collect user and location information from LDAP” checked in Mobile Devices >> Mobile Device Management >> Inventory Collection? If things have changed on the LDAP side, we’d expect to see the behavior described, however, we’ve been seeing that any time inventory is updated the profiles are removed from the device and then re-installed.

It would be helpful here to get a case going so we can get that attached and start gathering information; this will be helpful for our development team in their troubleshooting, and hopefully working with your Technical Account Manager, we’ll be able to come up with a workaround until we know why the behavior is occurring.

I’ve also let your Technical Account Manager know that you’re experiencing this issue and gave her the link to this thread; if you’d prefer to reach out directly and get a case started, please either give us a call, send an e-mail to support@jamfsoftware.com, or through My Support on JAMF Nation.

Thanks!

Amanda Wulff
JAMF Software Support

[were_wulff]

Hello again, @lhscasper !

I’ve got a quick update for you.

It looks like our development team was able to get this reproduced in house, and they’ve opened up a defect for the behavior.

For reference, the defect ID is D-006797.

We’d still recommend reaching out to your Technical Account Manager (support@jamfsoftware.com. It’ll get routed directly to your AM’s case queue) to get a case going, so that we can confirm whether or not the specific issue that you’re seeing is the same behavior as D-006797 or see if it is something different.

It also helps our development and QA people to have as much information as possible, so getting a case going and attached is super helpful for that process.

Feel free to reference D-006797 when contacting your Technical Account Manager about this issue, as that will give them a starting place to go for troubleshooting and will help us more quickly figure out if the behavior that you’re seeing is related to the defect or has a different cause.

Thanks for your patience!

Amanda Wulff
JAMF Software Support

[lhscasper]

Hi Amanda,

thanks for the response. I have opened the support case as requested. I can confirm that I have setup my system to pull the department from our Active Directory and that this is setup to update at each inventory update.

The profiles I'm actually testing for here are installed by 3rd party apps so I don't think the JSS is removing them and then re-installing. I suspect that the update of the department field from the AD is the culprit here.

Cheers,
Chris.