Remove User Level Configuration Profile

BookMac
Contributor

Hello, everyone,

we added our existing MacBooks to jamf via UIE. The devices still have manually installed user profiles under System Settings - Profiles. Certificates were distributed with the configuration profile. Is there a way to uninstall this profile via jamf?

Cheers

1 ACCEPTED SOLUTION

i think we got it. this script in a policy removed the profile

#!/bin/sh

username=$( scutil <<< "show State:/Users/ConsoleUser" | awk -F': ' '/[[:space:]]+Name[[:space:]]:/ { if ( $2 != "loginwindow" ) { print $2 }}' )
loggedInUID=$(id -u "$username")

/bin/launchctl asuser $loggedInUID sudo -iu $username profiles -R -p CompanyCertificates -z password

exit

View solution in original post

20 REPLIES 20

junjishimazaki
Valued Contributor

Hi, can you explain what you mean by "manually installed config profiles"?

BookMac
Contributor

Before we had jamf we installed a configuration profile on every mac by double click the profile and insert the admin credentials for the installation.

junjishimazaki
Valued Contributor

Ah I see, thank you for clarifying.  Then yeah if it was manually installed then you have to manually uninstall the profiles.  

You can try the script route to search for the config profile UUID and then remove it. 

You might have to use the command sudo profiles -R -p profileidentifier

BookMac
Contributor

I'm getting the error:

profiles remove for identifier:'xxx' and user:'root' returned -205 (The operation couldn't be completed. (CPProfileManager error -205.))

To uninstall the profile a pasccode is required. Could this be a problem?

junjishimazaki
Valued Contributor

How did you obtain the profile identifier?

BookMac
Contributor

sudo profiles list -all

then I get the user and the certificate as output:

givenname.surname[1] attribute: profileIdentifier: CompanyCertificates

junjishimazaki
Valued Contributor

Sorry for the delay, I got busy. Hmmm, that is correct. Did you run the removal as a script or just in the terminal to test it out?

BookMac
Contributor

just in terminal to test it out. if i delete the configuration profile in system preferences i must insert a passcode and it's gone. But i don't want to connect to every mac and insert the passcode to delete it

mm2270
Legendary Contributor III

 


@BookMac wrote:

just in terminal to test it out. if i delete the configuration profile in system preferences i must insert a passcode and it's gone. But i don't want to connect to every mac and insert the passcode to delete it


I'm not understanding this. Don't you have Jamf Pro? That's a perfect scenario for using Jamf since it runs scripts and commands as root. If you put that into a script and deploy it it should not require you entering any passwords.

yes, we have jamf pro. i've tried a policy with "Files and Processes" and the execute command "sudo profiles -R -p CompanyCertificates

The result of the policy is the same like in terminal: 

Result of command:
profiles remove for identifier:'CompanyCertificates' and user:'root' returned -205 (The operation couldn’t be completed. (CPProfileManager error -205.))

When you run sudo profiles -R -p in the terminal with the profile ID does it ask for a password?

exactly. this is what it looks in terminal:

username@devicename ~ % profiles -R -p CompanyCertificates

Enter the profile removal password:

After the password the profile is gone. the user is no admin user.

mm2270
Legendary Contributor III

Ok, I see what’s going on here. Your profile has a removal password applied to it. Meaning the password is something separate from an admin password. 

if this is the case, the only way I believe you can automate this would be with an expect script. I don’t think the ‘profiles’ command has a flag for using a removal password, not that I’m aware of anyway. You can look thru the man page for it to see. 

In the man pages for Profiles there is a flag to pass a password which is -password. 

mm2270
Legendary Contributor III

Ah, Ok. I didn't know it had that. So in that case you may be able to script removing this by passing the actual profile password after that flag. I would give that a try. It seems to me that's the reason why you haven't been able to remove it in your policy. It's looking for that removal password.

i think we got it. this script in a policy removed the profile

#!/bin/sh

username=$( scutil <<< "show State:/Users/ConsoleUser" | awk -F': ' '/[[:space:]]+Name[[:space:]]:/ { if ( $2 != "loginwindow" ) { print $2 }}' )
loggedInUID=$(id -u "$username")

/bin/launchctl asuser $loggedInUID sudo -iu $username profiles -R -p CompanyCertificates -z password

exit

@mm270 Explain what is removal password here as I'm also facing an issue in removing the profile via shell script.

junjishimazaki
Valued Contributor

Passcode or password?

password

BookMac
Contributor

Password, sorry