Remove User Level Configuration Profile

[BookMac]

Hello, everyone,

we added our existing MacBooks to jamf via UIE. The devices still have manually installed user profiles under System Settings - Profiles. Certificates were distributed with the configuration profile. Is there a way to uninstall this profile via jamf?

Cheers

[junjishimazaki]

Hi, can you explain what you mean by "manually installed config profiles"?

[BookMac]

Before we had jamf we installed a configuration profile on every mac by double click the profile and insert the admin credentials for the installation.

[junjishimazaki]

Ah I see, thank you for clarifying.  Then yeah if it was manually installed then you have to manually uninstall the profiles.  

You can try the script route to search for the config profile UUID and then remove it. 

You might have to use the command sudo profiles -R -p profileidentifier

[BookMac]

I'm getting the error:

profiles remove for identifier:'xxx' and user:'root' returned -205 (The operation couldn't be completed. (CPProfileManager error -205.))

To uninstall the profile a pasccode is required. Could this be a problem?

[junjishimazaki]

How did you obtain the profile identifier?

[BookMac]

sudo profiles list -all

then I get the user and the certificate as output:

givenname.surname[1] attribute: profileIdentifier: CompanyCertificates

[junjishimazaki]

Sorry for the delay, I got busy. Hmmm, that is correct. Did you run the removal as a script or just in the terminal to test it out?

[BookMac]

just in terminal to test it out. if i delete the configuration profile in system preferences i must insert a passcode and it's gone. But i don't want to connect to every mac and insert the passcode to delete it

[mm2270]

---

@BookMac wrote:

just in terminal to test it out. if i delete the configuration profile in system preferences i must insert a passcode and it's gone. But i don't want to connect to every mac and insert the passcode to delete it

---

I'm not understanding this. Don't you have Jamf Pro? That's a perfect scenario for using Jamf since it runs scripts and commands as root. If you put that into a script and deploy it it should not require you entering any passwords.

[BookMac]

yes, we have jamf pro. i've tried a policy with "Files and Processes" and the execute command "sudo profiles -R -p CompanyCertificates

The result of the policy is the same like in terminal: 

Result of command:
profiles remove for identifier:'CompanyCertificates' and user:'root' returned -205 (The operation couldn’t be completed. (CPProfileManager error -205.))

[junjishimazaki]

When you run sudo profiles -R -p in the terminal with the profile ID does it ask for a password?

[BookMac]

exactly. this is what it looks in terminal:

username@devicename ~ % profiles -R -p CompanyCertificates

Enter the profile removal password:

After the password the profile is gone. the user is no admin user.

[mm2270]

Ok, I see what’s going on here. Your profile has a removal password applied to it. Meaning the password is something separate from an admin password. 

if this is the case, the only way I believe you can automate this would be with an expect script. I don’t think the ‘profiles’ command has a flag for using a removal password, not that I’m aware of anyway. You can look thru the man page for it to see. 

[junjishimazaki]

In the man pages for Profiles there is a flag to pass a password which is -password. 

[mm2270]

Ah, Ok. I didn't know it had that. So in that case you may be able to script removing this by passing the actual profile password after that flag. I would give that a try. It seems to me that's the reason why you haven't been able to remove it in your policy. It's looking for that removal password.

[BookMac · Accepted solution]

i think we got it. this script in a policy removed the profile

#!/bin/sh

username=$( scutil <<< "show State:/Users/ConsoleUser" | awk -F': ' '/[[:space:]]+Name[[:space:]]:/ { if ( $2 != "loginwindow" ) { print $2 }}' )
loggedInUID=$(id -u "$username")

/bin/launchctl asuser $loggedInUID sudo -iu $username profiles -R -p CompanyCertificates -z password

exit

[sk25]

@mm270 Explain what is removal password here as I'm also facing an issue in removing the profile via shell script.

[junjishimazaki]

Passcode or password?

[BookMac]

password

[BookMac]

Password, sorry