Remove User Level Configuration Profile

BookMac
New Contributor III

Hello, everyone,

we added our existing MacBooks to jamf via UIE. The devices still have manually installed user profiles under System Settings - Profiles. Certificates were distributed with the configuration profile. Is there a way to uninstall this profile via jamf?

Cheers

1 ACCEPTED SOLUTION

BookMac
New Contributor III

i think we got it. this script in a policy removed the profile

#!/bin/sh

username=$( scutil <<< "show State:/Users/ConsoleUser" | awk -F': ' '/[[:space:]]+Name[[:space:]]:/ { if ( $2 != "loginwindow" ) { print $2 }}' )
loggedInUID=$(id -u "$username")

/bin/launchctl asuser $loggedInUID sudo -iu $username profiles -R -p CompanyCertificates -z password

exit

View solution in original post

19 REPLIES 19

junjishimazaki
Contributor III

Hi, can you explain what you mean by "manually installed config profiles"?

BookMac
New Contributor III

Before we had jamf we installed a configuration profile on every mac by double click the profile and insert the admin credentials for the installation.

junjishimazaki
Contributor III

Ah I see, thank you for clarifying.  Then yeah if it was manually installed then you have to manually uninstall the profiles.  

You can try the script route to search for the config profile UUID and then remove it. 

You might have to use the command sudo profiles -R -p profileidentifier

BookMac
New Contributor III

I'm getting the error:

profiles remove for identifier:'xxx' and user:'root' returned -205 (The operation couldn't be completed. (CPProfileManager error -205.))

To uninstall the profile a pasccode is required. Could this be a problem?

junjishimazaki
Contributor III

How did you obtain the profile identifier?

BookMac
New Contributor III

sudo profiles list -all

then I get the user and the certificate as output:

givenname.surname[1] attribute: profileIdentifier: CompanyCertificates

junjishimazaki
Contributor III

Sorry for the delay, I got busy. Hmmm, that is correct. Did you run the removal as a script or just in the terminal to test it out?

BookMac
New Contributor III

just in terminal to test it out. if i delete the configuration profile in system preferences i must insert a passcode and it's gone. But i don't want to connect to every mac and insert the passcode to delete it

mm2270
Legendary Contributor II

 


@BookMac wrote:

just in terminal to test it out. if i delete the configuration profile in system preferences i must insert a passcode and it's gone. But i don't want to connect to every mac and insert the passcode to delete it


I'm not understanding this. Don't you have Jamf Pro? That's a perfect scenario for using Jamf since it runs scripts and commands as root. If you put that into a script and deploy it it should not require you entering any passwords.

BookMac
New Contributor III

yes, we have jamf pro. i've tried a policy with "Files and Processes" and the execute command "sudo profiles -R -p CompanyCertificates

The result of the policy is the same like in terminal: 

Result of command:
profiles remove for identifier:'CompanyCertificates' and user:'root' returned -205 (The operation couldn’t be completed. (CPProfileManager error -205.))

When you run sudo profiles -R -p in the terminal with the profile ID does it ask for a password?

exactly. this is what it looks in terminal:

username@devicename ~ % profiles -R -p CompanyCertificates

Enter the profile removal password:

After the password the profile is gone. the user is no admin user.

mm2270
Legendary Contributor II

Ok, I see what’s going on here. Your profile has a removal password applied to it. Meaning the password is something separate from an admin password. 

if this is the case, the only way I believe you can automate this would be with an expect script. I don’t think the ‘profiles’ command has a flag for using a removal password, not that I’m aware of anyway. You can look thru the man page for it to see. 

In the man pages for Profiles there is a flag to pass a password which is -password. 

mm2270
Legendary Contributor II

Ah, Ok. I didn't know it had that. So in that case you may be able to script removing this by passing the actual profile password after that flag. I would give that a try. It seems to me that's the reason why you haven't been able to remove it in your policy. It's looking for that removal password.

BookMac
New Contributor III

i think we got it. this script in a policy removed the profile

#!/bin/sh

username=$( scutil <<< "show State:/Users/ConsoleUser" | awk -F': ' '/[[:space:]]+Name[[:space:]]:/ { if ( $2 != "loginwindow" ) { print $2 }}' )
loggedInUID=$(id -u "$username")

/bin/launchctl asuser $loggedInUID sudo -iu $username profiles -R -p CompanyCertificates -z password

exit

View solution in original post

junjishimazaki
Contributor III

Passcode or password?

password

BookMac
New Contributor III

Password, sorry