Self service policies not working, not showing up in policy history in Jamf

[edward]

Hi all,

I had an issue where the jamf binary stopped working (although not deleted). I received the error "command not found" when trying to run sudo jamf recon from command line. I ran a jamf API (jamf-management-framework) which fixed issues with running jamf commands in terminal. However, no policies will run in Self Service. the status bar spins, but nothing happens. When I look at the device record in jamf, it doesn't show a record of the policy being run. Please let me know if you have any suggestions.

[A_Collins]

I had similar experience before, re-install self service fixed the issue. 

to re-install simply run a script to delete self service and run "sudo jamf policy", it will re-install self service 

[edward]

Hi A_Collins,

Thank you for your message.  I was able to delete Self Service and reinstall as you stated.  Unfortunately, it still behaves the same way.  

[ajpinton1]

Terminal saying the Jamf binary is missing means someone removed it, recon is just an argument for the Jamf binary. I suggest making sure /usr/local/jamf/bin/jamf is there, and /Library/Application Support/Jamf as it sounds like this device was either tampered with or not enrolled correctly.

Restoring the Framework will not fix other issues. The reason you are not seeing anything in policy history, is Jamf dumps logs when a policy finishes and the policy is not finishing, so no logs. You can check /var/log/jamf.log and see what is being reported there.

Honestly, with a situation like this I would just reinstall macOS and reenroll the device. The chance of Shanaghan's with this one is really high, I suspect foul play. It's not like Jamf does not tell us where everything is publicly, and a privileged user could just delete stuff

Components Installed on Managed Computers - Jamf Pro Documentation 11.6.0 | Jamf

[edward]

Thank you ajpinton1

[edward]

Hi all,

As an FYI, this is looking like security software issue.  Thank you for your comments.