Reporting/Searching on Configuration Profiles

[andyparkernz]

Hi,

We're looking to push out Wifi settings via Configuration Profiles to 10.7 and above machines. In testing and pilot this is working well. When we go live to the rest of the campus we'd like to be able to search/report on devices which do and don't have the profile installed.

We've hunted high and low to find this, but don't seem to have any luck - is this possible?

TIA

Andy

[mm2270]

As far as I know, this can only be done currently with the use of an Extension Attribute. I'm hoping Casper Suit 9 will have some better reporting method for these, In my opinion, anything we can deploy from the JSS we should have the ability to report on.
Anyway, take a look at the 'profile' command in Terminal (man profiles) There is a -C flag that displays all Computer Level profiles. Also a -L flag for User profiles. I assume your profile is the former.

You can do something like

profiles -C | awk '/profileIdentifier/{ print $NF}'

which will bring back the reverse URL identifier of your profile, such as org.schoolwifi.profile or whatever. Just use something like that to echo back in the script a Yes/No result or just the actual results of the command.

[Cem]

@mm2270 profiles -C | awk '/profileIdentifier/{ print $NF}'
returns as bunch of numbers as below
BC5A655A-F346-412D-BA48-68602FB5954A
20A51BBA-8278-444A-9A19-E30D218255E0
00000000-0000-0000-A000-4A414D460003

I hope there is a better way in Casper Suit 9

[mm2270]

@Cem, hmm, that's odd. In our case it returns the URL, but that may be because we installed our Wi-Fi profile in a different manner. What I'd do is just run a 'profiles -C' in Terminal on a Mac with your profiles installed to see what gets returned. There should be some line with a proper identifier in it, though it may not be the one that works for me. You might have to grep for a different pattern than what I'm doing.

And yes, I agree, I hope Casper Suite 9 addresses some of these shortcomings. As i said, I don't see a reason why we can't report back on items we actually deployed from the JSS.

[Cem]

profiles -C
_computerlevel[1] attribute: profileIdentifier: BC5A655A-F346-412D-BA48-68602FB5954A
_computerlevel[2] attribute: profileIdentifier: 20A51BBA-8278-444A-9A19-E30D218255E0
_computerlevel[3] attribute: profileIdentifier: 00000000-0000-0000-A000-4A414D460003
There are 3 system configuration profiles installed

I am running JSS 8.6

[mm2270]

Cem, the only thing I can think of is, if the profiles are created in the JSS, it assigns those profiles strings to the name instead of a proper identifier. I think we made ours outside of the JSS. Maybe that accounts for the difference. When I get to it I can test that theory, but someone else may already know the answer.

Edit:Confirmed. The JSS will assign those numbers to the profile identifier. If you go into the JSS to create a profile, you'll notice there is no "Identifier" field place to add in a reverse URL identifier for it. Contrast this to using something like iPhone Configuration Utility and there is a field specifically for that. It would be nice to see the JSS match all editable fields when creating these, unless there is some technical reason the JSS needs to assign the identifier in that way for it to work.
If you go into your JSS and head to https://your.jss.url:8443/exportOSXConfigurationProfile.html and download one of them, drag it into iPCU and you'll see that random looking string (UUID) show up in the Identifier field under the General tab. So that's what's going on. You created yours directly in the JSS, so they don't have those human readable identifiers, only the UUID.

I smell a feature request. I don't care for those codes it assigns as it makes it pretty much impossible to tell one from the other.

[nkalister]

Cem, try adding the -v switch to get verbose output. You'll get a ton of info, there must be something you can awk for in there.

[Cem]

@nkalister nice!

[Cem]

@mm2270, I have a similar future request
https://jamfnation.jamfsoftware.com/featureRequest.html?id=750

[Cem]

profiles -C | awk '/name/{ print $NF}'
didn't picked the profile name "blank". see below. Any ideas?

_computerlevel[3] attribute: name: blank
_computerlevel[3] attribute: configurationDescription: _computerlevel[3] attribute: installationDate: 2012-11-20 16:20:33 +0000
_computerlevel[3] attribute: organization: companyname
_computerlevel[3] attribute: profileIdentifier: 20A51BBA-8278-444A-9A19-E30D218255E0
_computerlevel[3] attribute: profileUUID: 20A51BBA-8278-444A-9A19-E30D218255E0
_computerlevel[3] attribute: profileType: Configuration
_computerlevel[3] attribute: removalDisallowed: TRUE
_computerlevel[3] attribute: version: 1
_computerlevel[3] attribute: containsComputerItems: TRUE
_computerlevel[3] attribute: internaldata: TRUE
_computerlevel[3] payload count = 0

[Cem]

this works OK.
profiles -C -v | awk '/name/{ print $4}'

returns:
MDM
=
=
blank

[SamF]

The following produces just the names of the profiles and prints the full name if your profile has a name longer than a single word.

profiles -C -v | grep attribute | awk '/name/{$1=$2=$3=""; print $0}'

[Cem]

thanks Sam!
@andyparkernz if you create a script based Extension Attribute as below it should give you the profile names.

#!/bin/sh

profiles=`profiles -C -v | grep attribute | awk '/name/{$1=$2=$3=""; print $0}'`
echo "<result> $profiles </result>"

exit 0

[Cem]

@andyparkernz WIFI report can be run by creating a Smart Group with Extension Attribute, select Like and fill the blank line "WIFI" (assuming that is what your WIFI profile is called)

[mm2270]

Hey, nice one Sam. Just want to point out that that could actually be shortened a few different ways, like so-

profiles -C -v | awk '/attribute: name/{$1=$2=$3=""; print $0}'

or even

profiles -C -v | awk -F: '/attribute: name/{print $NF}'

Both of those return my profile name, which is two words, so it seems to work on a multi word name. Only thing is, for both (and Sam's original) I end up with some spaces in the front of the name. You could pipe it through a simple sed command to make it a little more concise:

sed 's/^ *//'

That said, I'd still like to see the ability to add a proper identifier name to a profile created in the JSS. I don't care for the fact that it just assigns the UUID as its identifier. Given we can add it when creating these in iPCU I don't see why that's not an option in the JSS.

[andyparkernz]

Many thanks for all of your replies. Working a treat.

Andy

[MacJunior]

How do you get profiles identifiers and their names at the same time?