Apple Profile Manager

[JonnyAlpha]

Hi;

I have inherited a mixture of iPads, the majority of which are managed with Profile Manager on a Mac Mini in our school.

I am in the process of trying to get the non managed 15 iPads onto Profile Manager but am having a lot of difficulties and have a couple of questions. Our offsite IT contractor started but is only in school once a month and therefore I have taken it on.

I have managed to link a couple to PM and have deployed a couple of apps using PM successfully. Yippee

However I am having some real difficulties with some of the others.

First problem (there will be more) I have one particular iPad that allows me to install the Trust Profile but always fails when I try to install the Enrollment Profile. Message says:
Profile Installation Failed:

The server certificate for "https://macserver.(our schools domain name/devicemanagement/api/device/auto_join_ota_service" is invalid?

Any ideas?

Separate Question:
After Wiping the iPads, when setting them up I have skipped the Apple ID and was planning on letting the teachers put in thier own but restricting it to using a school email address for the reason that we can reset the password. The problem is will this cause me an issue if I ever need to re-deploy the iPad after the teacher has left?

Instead should I however create a unique apple ID using a separate school email account that I have?

FYI
The process I am following is:

1. Click on the users name if applicable and click sign out.
2. Click sign out of iCloud and Store, enter password, this switches of Find My iPad if switched on.
3. Navigate to the Mac Mini server using the iPads Safari Browser.
3. Login
4. In Profile Manager select the button at the top right hand side of the screen.
5. From the drop down menu select "Go to my devices".
6. Click on Profiles and Install both the Trust Profile and the Enrollment Profile.
7. Click on the Devices Tab and select Enroll - after a short delay, the iPad should now appear in profile Manager
8. In Profile Manager select Devices and select the iPad that you have just enrolled.
9. Add the apps that you wish to deploy.
10. Have a cuppa

 

[JonnyAlpha]

OK so I seem to have gotten around the first problem when I came across this post:
https://www.jamf.com/jamf-nation/di...allation-failed-server-certificate-is-invalid

In particular this piece of advice:

"On the iPad go to General: About: Certificate Trust Settings and Enable the JSS Certificate".

On this iPad the Trust Certificate was turned off. I turned it on and the Trust Profile installed. I have turned off iCloud and iTunes and enrolled the iPad. I am now trying to Wipe the iPad but whether I try initiate a wipe by accessing Profile Manager from the device in question or from another device logged into Profile Manager, the Wipe is allways pending and never completes?

Any ideas?

Thanks

 

[Mabus51]

Jamf and Casper Suite have a huge forum and support repository. You will probably be able to find an answer there faster than you will be able to here. It’s been awhile since I’ve had to manage it. But from what I remember the remote wipe doesn’t wipe the entire device, it wiped the managed content and access to the managed content off the device.

 

[TriBruin]

OK so I seem to have gotten around the first problem when I came across this post:
https://www.jamf.com/jamf-nation/di...allation-failed-server-certificate-is-invalid

In particular this piece of advice:

"On the iPad go to General: About: Certificate Trust Settings and Enable the JSS Certificate".

On this iPad the Trust Certificate was turned off. I turned it on and the Trust Profile installed. I have turned off iCloud and iTunes and enrolled the iPad. I am now trying to Wipe the iPad but whether I try initiate a wipe by accessing Profile Manager from the device in question or from another device logged into Profile Manager, the Wipe is allways pending and never completes?

Any ideas?

Thanks

Can you send any commands that device and does it acknowledge them? Is the device supervised? (Remote wipe, requires a supervised device, IIRC). Are you sure the iPad is receiving commands from PM?

I would really encourage you to look at alternates besides Profile Manager. While is it is free with Server.app, it is not meant for production. Even Apple engineers cringe at the thought. (Yes, there will be someone who comes along as says that Profile Manager works fine. Yes, it might for awhile, until it doesn't). Plus being a locally based server, it has to be exposed to the Internet if you want any off-campus management.

There are a number of good MDMs (especially for iPads) that are inexpensive (unlike Jamf, which is admittedly expensive, ate least for Jamf Pro).

Jamf has JamfNow for $2/device/mo
Zuludesk is great deal at $5.50/device/yr (But it education focus.)
Mosyle is good solution for $1/device/mo

A new up and comer is Fleetsmith. It is more expensive ($8.25/device/mo), but is very robust. (Note: I requires either Azure AD or G-Suite for user management.)