Student restrictions (time managed) installation fails (randomly)

[Tobbse]

Hello everybody,

In our school students use their 'own' iPads which means in the afternoon and on weekends they're theirs to the fullest. This being said, we assigned all the student-owned iPads a profile with restrictions during school hours (such as 'no turning of the wifi' or only using certain apps). These profiles only apply Mon-Fri from 7.30 a.m. to 2.30 p.m..

Problem is: Many students' iPads are listed as 'failed' ('Fehlgeschlagen') in the profile installation overview. When I get one of these iPads and I manually reinstall the profile it works. Next day, it might work or it might fail again, there doesn't seem to be any connections to certain students.

We're only using two payloads: restrictions and whitelist. Following a suggestion from the support, we split up the two payloads into two separate profiles (Schueler_Restriktionen and Schueler_Whitelist) as they said the problem might be having several payloads within the same profile. This didn't work, unfortunately.

I'm open for any suggestions and thank you in advance.

Best wishes
Tobias

[ryan_w]

Hi Tobbse, 

Does the activity log on the device page show any additional details to why it failed?  I've used some scheduled profiles in the past and have seen some similar things happen, but unfortunately I don't have any quick fixes.  What percentage is failing?

[Nevinho]

Hi Tobias,

we have the same set of requirements set up at our institution (possibly in your vicinity) and have been encountering the same issue. After having gone through a serious of possible solutions (and having Jamf support itself check on our environment), I simply gave up on time-based restrictions. I'm pretty sure that some students tampered with their time settings, but not all. A complete reset and re-enrollment weren't succesful. Generally, this approach worked too unreliably anyway, selectively and randomly kicking in quite some time after school has started and persisting after school hours.

In the end, I opted for a "region-based" approach (actually it is based on the public IP of the school wifi), which has been working more reliably. The only proactive way of corcumventing it seem to be private hotspots (or connecting to other wifis). Let me know if you need instructions.

The fact that Jamf School doesn't allow for adjusting the check-in cycles of the devices (officially every 2 hours) remains an obstacle for some devices which remain stuck on the school's IP address (in Jamf School) despite being connected to the home wifi. At least, you can unlock them by updating the device status manually (unfortunately, no task automation for Jamf School, nor scripting).

Additional rant: We were promised by our educational partner that the switch between school and private use of the iPads would be smooth and unproblematic. Well, this turned out to be only partially true.

Best wishes

Neven