+9Hello, everyone,
we added our existing MacBooks to jamf via UIE. The devices still have manually installed user profiles under System Settings - Profiles. Certificates were distributed with the configuration profile. Is there a way to uninstall this profile via jamf?
Cheers
Best answer by BookMac
Ah, Ok. I didn't know it had that. So in that case you may be able to script removing this by passing the actual profile password after that flag. I would give that a try. It seems to me that's the reason why you haven't been able to remove it in your policy. It's looking for that removal password.
i think we got it. this script in a policy removed the profile
#!/bin/sh
username=$( scutil <<< "show State:/Users/ConsoleUser" | awk -F': ' '/[[:space:]]+Name[[:space:]]:/ { if ( $2 != "loginwindow" ) { print $2 }}' )
loggedInUID=$(id -u "$username")
/bin/launchctl asuser $loggedInUID sudo -iu $username profiles -R -p CompanyCertificates -z password
exit
+10Hi, can you explain what you mean by "manually installed config profiles"?
+9Before we had jamf we installed a configuration profile on every mac by double click the profile and insert the admin credentials for the installation.
+10Ah I see, thank you for clarifying. Then yeah if it was manually installed then you have to manually uninstall the profiles.
You can try the script route to search for the config profile UUID and then remove it.
You might have to use the command sudo profiles -R -p profileidentifier
+9I'm getting the error:
profiles remove for identifier:'xxx' and user:'root' returned -205 (The operation couldn't be completed. (CPProfileManager error -205.))
To uninstall the profile a pasccode is required. Could this be a problem?
+10How did you obtain the profile identifier?
+9sudo profiles list -all
then I get the user and the certificate as output:
givenname.surname[1] attribute: profileIdentifier: CompanyCertificates
+10Sorry for the delay, I got busy. Hmmm, that is correct. Did you run the removal as a script or just in the terminal to test it out?
+9just in terminal to test it out. if i delete the configuration profile in system preferences i must insert a passcode and it's gone. But i don't want to connect to every mac and insert the passcode to delete it
+10Passcode or password?
+9Password, sorry
+16just in terminal to test it out. if i delete the configuration profile in system preferences i must insert a passcode and it's gone. But i don't want to connect to every mac and insert the passcode to delete it
@BookMac wrote:just in terminal to test it out. if i delete the configuration profile in system preferences i must insert a passcode and it's gone. But i don't want to connect to every mac and insert the passcode to delete it
I'm not understanding this. Don't you have Jamf Pro? That's a perfect scenario for using Jamf since it runs scripts and commands as root. If you put that into a script and deploy it it should not require you entering any passwords.
+9
@BookMac wrote:just in terminal to test it out. if i delete the configuration profile in system preferences i must insert a passcode and it's gone. But i don't want to connect to every mac and insert the passcode to delete it
I'm not understanding this. Don't you have Jamf Pro? That's a perfect scenario for using Jamf since it runs scripts and commands as root. If you put that into a script and deploy it it should not require you entering any passwords.
yes, we have jamf pro. i've tried a policy with "Files and Processes" and the execute command "sudo profiles -R -p CompanyCertificates
The result of the policy is the same like in terminal:
Result of command:
profiles remove for identifier:'CompanyCertificates' and user:'root' returned -205 (The operation couldn’t be completed. (CPProfileManager error -205.))
+9Passcode or password?
password
+10yes, we have jamf pro. i've tried a policy with "Files and Processes" and the execute command "sudo profiles -R -p CompanyCertificates
The result of the policy is the same like in terminal:
Result of command:
profiles remove for identifier:'CompanyCertificates' and user:'root' returned -205 (The operation couldn’t be completed. (CPProfileManager error -205.))
When you run sudo profiles -R -p in the terminal with the profile ID does it ask for a password?
+9When you run sudo profiles -R -p in the terminal with the profile ID does it ask for a password?
exactly. this is what it looks in terminal:
username@devicename ~ % profiles -R -p CompanyCertificates
Enter the profile removal password:
After the password the profile is gone. the user is no admin user.
+16exactly. this is what it looks in terminal:
username@devicename ~ % profiles -R -p CompanyCertificates
Enter the profile removal password:
After the password the profile is gone. the user is no admin user.
Ok, I see what’s going on here. Your profile has a removal password applied to it. Meaning the password is something separate from an admin password.
if this is the case, the only way I believe you can automate this would be with an expect script. I don’t think the ‘profiles’ command has a flag for using a removal password, not that I’m aware of anyway. You can look thru the man page for it to see.
+10Ok, I see what’s going on here. Your profile has a removal password applied to it. Meaning the password is something separate from an admin password.
if this is the case, the only way I believe you can automate this would be with an expect script. I don’t think the ‘profiles’ command has a flag for using a removal password, not that I’m aware of anyway. You can look thru the man page for it to see.
In the man pages for Profiles there is a flag to pass a password which is -password.
+16In the man pages for Profiles there is a flag to pass a password which is -password.
Ah, Ok. I didn't know it had that. So in that case you may be able to script removing this by passing the actual profile password after that flag. I would give that a try. It seems to me that's the reason why you haven't been able to remove it in your policy. It's looking for that removal password.
+9Ah, Ok. I didn't know it had that. So in that case you may be able to script removing this by passing the actual profile password after that flag. I would give that a try. It seems to me that's the reason why you haven't been able to remove it in your policy. It's looking for that removal password.
i think we got it. this script in a policy removed the profile
#!/bin/sh
username=$( scutil <<< "show State:/Users/ConsoleUser" | awk -F': ' '/[[:space:]]+Name[[:space:]]:/ { if ( $2 != "loginwindow" ) { print $2 }}' )
loggedInUID=$(id -u "$username")
/bin/launchctl asuser $loggedInUID sudo -iu $username profiles -R -p CompanyCertificates -z password
exit
+5Ok, I see what’s going on here. Your profile has a removal password applied to it. Meaning the password is something separate from an admin password.
if this is the case, the only way I believe you can automate this would be with an expect script. I don’t think the ‘profiles’ command has a flag for using a removal password, not that I’m aware of anyway. You can look thru the man page for it to see.
@mm270 Explain what is removal password here as I'm also facing an issue in removing the profile via shell script.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
