Smart Groups - How to stop using on a config profile without effecting computers?

touringband
New Contributor

Hi all,  I am new to jamf and still understanding the intricacies with deploying config profiles using smart groups.

 

I have a config profile being deployed to computers via a smart group.  The smart group is defined as computers that dont have the config profile installed.  Its been working well, but due to changes in the way we are installing a particular application,  I no longer want that config profile active in the environment for net new devices but I dont want the profile removed from the computers that already have it.  How would I go about doing this?  

 

thanks

2 ACCEPTED SOLUTIONS

Tribruin
Valued Contributor II

Tread lightly here, if you do it wrong, you could end up removing the profile from computers. 

Essentially, you want to replace the scope of the profile with a new scope that encompasses all the existing computers. You coudl try creating a new smart group that is a duplicate of the existing smart group and add a "enrolled before" criteria and set the cut off date. 

Then compare the contents of the new smart group and the old smart group and make sure you still have all the computer you expect. Then, if the groups match, change the scope of the config profile. Make sure so to only apply the profile all new computers, otherwise all the existing comptures will have the profile removed and re-added. 

View solution in original post

Bol
Valued Contributor

- Try creating a smart group on devices that currently have the config profile installed.

- Scope this group to the configuration profile

I've used this approach when moving to a new wireless profile but without disrupting the devices out in the wild. As Tribruin answered, my newly enrolled devices will get the newer profile which I scope on a "Enrolled after this date" type group.

View solution in original post

3 REPLIES 3

Tribruin
Valued Contributor II

Tread lightly here, if you do it wrong, you could end up removing the profile from computers. 

Essentially, you want to replace the scope of the profile with a new scope that encompasses all the existing computers. You coudl try creating a new smart group that is a duplicate of the existing smart group and add a "enrolled before" criteria and set the cut off date. 

Then compare the contents of the new smart group and the old smart group and make sure you still have all the computer you expect. Then, if the groups match, change the scope of the config profile. Make sure so to only apply the profile all new computers, otherwise all the existing comptures will have the profile removed and re-added. 

Bol
Valued Contributor

- Try creating a smart group on devices that currently have the config profile installed.

- Scope this group to the configuration profile

I've used this approach when moving to a new wireless profile but without disrupting the devices out in the wild. As Tribruin answered, my newly enrolled devices will get the newer profile which I scope on a "Enrolled after this date" type group.

touringband
New Contributor

Thanks Tribuin and Bol.  Yes Im making the post because I noticed before profiles disappearing before - was nothing serious - but it certainly got me thinking. 

 

Your posts make complete sense and gives me a sense of direction now.  Thanks so much for your prompt help.