Recert<\/p>\n
\/usr\/sbin\/jamf removeMdmProfile -verbose\r\n\/usr\/sbin\/jamf manage -verbose\r\n\/usr\/sbin\/jamf recon<\/pre>\nOr<\/p>\n
jamf mdm -verbose\r\nJams recon<\/pre>\nCheck EA’s
\nMake sure you don’t have any extension attributes that are hanging up recon. For example, we had a script that set the hostname variable with a “scutil –get HostName”<\/p>\nBut even if hostname is present in Sharing Preference Pane, it may not be recognized by scutil – especially if hostname was created dynamically. So that command will just hang – causing recon to hang.<\/p>\n
When you enroll, a quick computer record is created in JSS, containing very little system info – MAC addresses, Serial Number, etc. And a UUID and JSS Computer ID is generated for the record. But the MDM enrollment does NOT occur until after the recon is done with enrollment.<\/p>\n
At any rate – the “No Name” record will appear in JSS until a full recon is done.<\/p>\n
For testing – it may be beneficial to create a quick add, but then modify the enroll command with a “-noRecon” option. For example —<\/p>\n
\/usr\/sbin\/jamf enroll -invitation 123456789876543212345678976543 -noRecon -verbose<\/pre>\nThen, run a<\/p>\n
jamf recon -verbose<\/pre>\nto try to determine where the hangup is<\/p>\n
Verify JAMF Keychain
\nAs part of your troubleshooting, make sure your system is actually receiving its device certificate. The device certificate is NOT in the System Keychain. It’s in the \/Library\/Application Support\/JAMF\/JAMF.keychain<\/p>\nTo verify<\/p>\n
sudo security dump-keychain \/Library\/Application\\ Support\/JAMF\/JAMF.keychain<\/pre>\nYou should see a public key, a private key, and a certificate. This of course is assuming that you are using the built-in JSS CA.<\/p>\n
IF you get an error like <\/p>\n
Error installing the computer level mdm profile: profiles install for file:'\/Library\/Application Support\/JAMF\/tmp\/mdm.mobileconfig' and user:'root' returned -1202 (The certificate for this server is invalid. You might be connecting to a server that is pretending to be \u201cblah.blah.com\u201d which could put your confidential information at risk.)<\/pre>\nRemove the JAMF.keychain and then re-enroll<\/p>\n
sudo rm -f Library\/Application\\ Support\/JAMF\/JAMF.keychain\r\nsudo jamf enroll -prompt<\/pre>\nJSS CA Problems
\nIf you have attempted to enroll the computer several times, there is a chance that the internal JSS CA is just plain mucked up and confused, and when it issues a device certificate, it can’t verify it because there have been too many certs issued.<\/p>\nJAMF is aware of this issue. I don’t think a defect is official yet.<\/p>\n
The solution below is NOT official by any means, but it worked for me (to an extent)<\/p>\n
In JSS – find the computer that is failing to enroll (should be a “No Name”). Find by MAC address, or serial number. Under Inventory \/ Hardware – find the UUID
\nThen navigate to Global Management – PKI – Issued Certificates
\nSearch the page for the UUID you found in step 1
\nAre there more than one for that UUID
\nIf yes – you may need to purge some of those via MySQL
\nCopy the DEVICE certificate name that corresponds to that UUID. Should look like “CN=C9E7JK12-GH44-63F9-8Z8B-A66777888999,OU=JAMF Device Certificate”
\nThen in MySQL – as root or user with write access —<\/p>\nuse jamfsoftware;\r\nSELECT * FROM certificate_authority_issued where subject_name=\"CN=C9E7JK12-GH44-63F9-8Z8B-A66777888999,OU=JAMF Device Certificate\";<\/pre>\nThat should simply list all the corresponding certificates that are found. Better to do this before running the delete command, just in case. Make sure that all those found are actually ones you want to delete. Then run<\/p>\n
delete FROM certificate_authority_issued where subject_name=\"CN=C9E7JK12-GH44-63F9-8Z8B-A66777888999,OU=JAMF Device Certificate\";<\/pre>\nObviously – replace the certificate from my example with the certificate you copied in step 6<\/p>\n
Conclusion
\nEven after saying all that – we are STILL having trouble with clients who were in one JSS enrolling into a new, clean JSS. The steps above helped me with a few scenarios, but we still have many lingering failed enrollments.<\/p>\nAlso – for anyone who “wishes” to recreate this issue, we have been able to recreate at will – even in a completely vanilla JSS or even in our JAMF Cloud test instance.<\/p>\n
I strongly recommend you only do this on a dev JSS, but by simply enrolling over and over again (sometimes a dozen or so enrolls) – we can produce the same device certificate errors – at least in 9.72 (haven’t tried other versions)<\/p>\n","protected":false},"excerpt":{"rendered":"
Recert \/usr\/sbin\/jamf removeMdmProfile -verbose \/usr\/sbin\/jamf manage -verbose \/usr\/sbin\/jamf recon Or jamf mdm -verbose Jams recon Check EA’s Make sure you don’t have […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2475","post","type-post","status-publish","format-standard","hentry","category-info-on-tech"],"_links":{"self":[{"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/2475","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2475"}],"version-history":[{"count":0,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=\/wp\/v2\/posts\/2475\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2475"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2475"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.designed79.co.uk\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2475"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}