Help

Question about re-enrolling Macs in Jamf

batunkhal
New Contributor

Posted on ‎03-10-2022 09:19 PM

So this has been an issue for my workplace the past couple of years, but I was just recently made an admin in Jamf meaning I can talk to Jamf Support about it. What often happens is that after a Mac is set up and enrolled in Jamf (using the OEM version of whatever OS came with it, no imaging), then sometime later on Jamf Remote doesn't update the IP address for that computer. Ever since Mojave, when trying to re-enroll certain computers through Jamf Recon it gave a "No Computer ID returned." error. I've noticed it's usually only MacBook Pros, but mainly newer ones with the T2 chip. Mac Minis and iMacs do enroll through Recon for whatever reason. I reported the issue to our team that handled it at the time but was never resolved, and my workaround has been running a QuickAdd.pkg they created.

This means for end users I can't use Jamf Remote to connect with them until the IP is correct in there. If a refresh doesn't fix it, and Recon won't enroll them, I need to send them the QuickAdd.pkg file to run. But most users don't have admin rights. After reporting the issue Jamf, they informed me that both QuickAdd and Recon aren't supported with Big Sur, so we'll need to move towards an alternate method anyway.

To fix what's happening now on Catalina/Mojave machines, they sent me a Terminal command to run and what entry to remove from Keychain Access, then what to run in order to re-enroll it. Now I have enough trouble getting users to find the IP address or open Teams so I can do a screenshare session with them. I don't trust them to input a Terminal command correctly and remove the correct Keychain entry without severely messing something up. Jamf told me the only alternative is to trigger Setup Assistant which wipes the machine, so that's also not ideal.

So what are my options at this point? What can I do to figure out why Jamf Remote isn't refreshing IPs correctly, and is there a user-initiated enrollment option that users with no local admin rights can perform?

xender



0 Kudos
Reply
1 REPLY 1

daniel_behan
Contributor III

Posted on ‎03-11-2022 09:14 AM

I wrote a script that I leave in Self Service for users that need to renew their MDM Profiles.  It will temporarily grant admin rights in order to profiles -N to work.  If the computer is not in Apple Business Manager, the script will enroll with an invitation ID and prompt the user to approve the MDM Profile.

 

#!/bin/sh
user=`/usr/bin/who | /usr/bin/awk '/console/{ print $1 }'`
adminneeded=`/usr/bin/dsmemberutil checkmembership -U "$user" -G admin`
DEPURL="JAMF URL Goes Here"
DEPAssigned=`/usr/bin/profiles show -type enrollment | grep ConfigurationURL | cut -d '"' -f2`
OS=`/usr/bin/defaults read /System/Library/CoreServices/SystemVersion ProductVersion | awk '{print substr($1,1,5)}'`
 
#Temporarily Grant Admin Rights to Standard User for Enrollment
if [[ "$adminneeded" == *not* ]]; then
/usr/sbin/dseditgroup -o edit -a $user -t user admin
if [[ "$OS" < "10.13" ]]; then
/usr/local/jamf/bin/jamf removeMDMProfile
/usr/local/jamf/bin/jamf enroll -invitation <InvitationIDGoesHere> && /usr/local/jamf/bin/jamf recon -endUsername $user
/usr/libexec/mdmclient dep nag
/usr/sbin/dseditgroup -o edit -d $user -t user admin
elif [[ "$DEPAssigned" == "$DEPURL" ]];then
    /bin/launchctl unload /Library/LaunchDaemons/com.zscaler.*
/usr/local/jamf/bin/jamf removeMDMProfile
/usr/bin/profiles -N
/usr/sbin/dseditgroup -o edit -d $user -t user admin
else
/usr/local/jamf/bin/jamf removeMDMProfile
/usr/local/jamf/bin/jamf enroll -invitation <InvitationIDGoesHere> && /usr/local/jamf/bin/jamf recon -endUsername $user
/usr/bin/osascript -e 'tell application "Finder"
activate
   open document file "Profiles.prefPane" of folder "PreferencePanes" of folder "Library" of folder "System" of startup disk
end tell'
/usr/sbin/dseditgroup -o edit -d $user -t user admin
fi
fi
 
#Leave Admin rights in Tact if account is already elevated
if [[ "$adminneeded" != *not* ]]; then
if [[ "$OS" < "10.13" ]]; then
/usr/local/jamf/bin/jamf removeMDMProfile
/usr/local/jamf/bin/jamf enroll -invitation <InvitationIDGoesHere> && /usr/local/jamf/bin/jamf recon -endUsername $user
/usr/libexec/mdmclient dep nag
elif [[ "$DEPAssigned" == "$DEPURL" ]];then
/usr/local/jamf/bin/jamf removeMDMProfile
/usr/bin/profiles -N
else
/usr/local/jamf/bin/jamf removeMDMProfile
/usr/local/jamf/bin/jamf enroll -invitation <InvitationIDGoesHere> && /usr/local/jamf/bin/jamf recon -endUsername $user
/usr/bin/osascript -e 'tell application "Finder"
activate
   open document file "Profiles.prefPane" of folder "PreferencePanes" of folder "Library" of folder "System" of startup disk
end tell'
fi
fi
0 Kudos
Reply