Software re-installing repeatedly.

[plouis]

This is my workflow -

• I have a CONFIGURATION POLICY running for anyone that does not have Office installed. It's called "Install Office 2016"

• "Install Office 2016" has a recurring check-in trigger, and assigned to a scope consisting of a SMART COMPUTER GROUP called "Office Not Installed".

• The Smart Computer Group "Office Not Installed" has one critera, set as "Application Title Does Not Have Microsoft Outlook.app". This group currently shows ZERO members.

Regardless of this, the log on end user's devices are showing this over and over and over -

Wed Aug 17 10:46:35 COMPUTER-NAME jamf[15302]: Verifying package integrity...
Wed Aug 17 10:47:43 COMPUTER-NAME jamf[15302]: Installing Microsoft_Office_2016_Volume_Installer.pkg...
Wed Aug 17 10:49:22 COMPUTER-NAME jamf[15302]: Successfully installed Microsoft_Office_2016_Volume_Installer.pkg.
Wed Aug 17 11:04:54 COMPUTER-NAME jamf[18648]: Checking for policies triggered by "recurring check-in" for user "chovrud"...
Wed Aug 17 11:04:57 COMPUTER-NAME jamf[18648]: Executing Policy Install Office 2016 (Automatic)
Wed Aug 17 11:04:57 COMPUTER-NAME jamf[18648]: Verifying package integrity...
Wed Aug 17 11:05:53 COMPUTER-NAME jamf[18648]: Installing Microsoft_Office_2016_Volume_Installer.pkg...

Can anyone tell me what I'm doing wrong here?

[AVmcclint]

Make sure the policy isn't set for Ongoing. It should be Once per Computer.

OR you can make the computer check inventory (basically run recon) after the package is installed so it pulls itself out of the Smart group for "Office not installed"

[mm2270]

I assume by CONFIGURATION POLICY, you actually just mean a policy, correct? At least it sounds like that from the description.
In looking at the log info you posted here, I wonder if you don't have a second policy doing this other than the one you're thinking of. The log is showing a policy name of "Install Office 2016 (Automatic)" but in your OP above you mentioned a policy name of just "Install Office 2016" Are these the same, or 2 different ones?

[djdavetrouble]

Unless you have chosen to run inventory at the completion of policy they will still be a member of the smart group. Since you have set to ongoing, it will keep looping until an inventory has completed (usually once per day depending on your environment). This is why I try to avoid ongoing policies, too easy to end up here....

[plouis]

AVmcclint - It is set to ongoing by design. I want the server to make sure my end users have Office installed. Still, shouldn’t actual installation be limited to the scope that I defined?

mm2270 - Yeah, just policy. Sorry, I’ve been at the JAMF stuff for about a week so I’m still wrapping my head around all of it, nomenclature included. And yes, it’s actually called “Install Office 2016 (Automatic)”. I created a generic one called “Install Office 2016 (Targeted)” that is disabled. Good catch, though!

djdavetrouble - Even if the inventory was not run, shouldn't the next check in with the JSS have the server go looking for "Microsoft Outlook.app" and skip the whole process? Regardless of all of it, the smart group is empty (as it should be).

Thanks all for the feedback!

[stevewood]

@chovrud your Smart Groups will only update after an inventory. So if the policy is not updating inventory, the machines will stay in the SG.

[AVmcclint · Accepted solution]

Ongoing means it will install it over and over and over until it meets the criteria to not run- in this case to be removed from the Smart Group. The only way to automatically remove a computer from a smart group is to have inventory run immediately after the policy runs... OR Ongoing means that it will always be available in Self Service even after it successfully runs if you have a policy setup there. Don't worry, if you have it set to Once per Computer, that means it will run to completion. There's no expiration date on that.

[plouis]

stevewood - even though the smart user group is showing zero members? You're cueing my inner Doctor Nick ...

[plouis]

Okay guys, I changed it to Once Per Computer and re-enabled it. If it goes sideways again I'll let you know.

EDIT - and changed the policy to update the inventory.

Thanks all!

[stevewood]

@chovrud no, if the SG is at zero it should not be running multiple times. I was merely pointing out that a check-in will not get a machine out of a SG. Only an update of inventory should do that.

What does the policy log show? Does it show completed for the computer(s) in question?

And you're positive you are scoped to only the SG, right? Can you upload a screen shot of the Scope tab?

[plouis]

stevewood - Here is an image of the scope on the policy.

And here is the log for the policy "Install Office 2016 (Automatic)"

COMPUTER-NAME Chad Today at 10:20 AM Completed Flush Show
COMPUTER-NAME Chad Today at 10:26 AM Completed Flush Show
COMPUTER-NAME Chad Today at 10:40 AM Completed Flush Show
COMPUTER-NAME Chad Today at 10:58 AM Completed

Regardless, the changes that I made above appear to have stopped the software from installing again and again. I'm not sure if it was forcing the inventory to update (kind of doubt it) or if it was changing the Execution Frequency to "Once per computer" (seems more likely).

[stevewood]

@chovrud yeah, it would've been the change to "Once Per Computer" that stopped it. If you can test setting it back to Ongoing and enabling the inventory update, I'd be curious if that corrected the problem.

Thanks for posting that info. It all looks correct, so I'm not certain why you were having that issue.

[mm2270]

Something's fishy here. Changing the frequency from Ongoing to Once per computer certainly stopped it, as mentioned above, but it does nothing to explain why it was running on those Macs in the first place. @chovrud, if its true that the only Smart Group scoped to the policy had zero members in it, then I honestly can't explain why it was ever running on any Macs at all. Scope controls targets, Frequency controls how often. If I set a policy to Ongoing frequency, but have no targets, I should never see it running on anything, no matter what the frequency is. That's just how the Casper Suite works.

Like @stevewood, I'd be curious to see if putting it back to Ongoing now if it stays fixed, or if you see the problem surface again. Hopefully it was just something fluky or wonky going on before, that making those changes somehow fixed.