Profile Manager/Configurator 2, corrupt profiles?

[Garacesh]

Trying to re-work the way our iPads are managed to streamline things a little better. The idea is that rather than push a profile out via Apple Configurator 2, I can instead create a Device Group in Profile Manager and dictate the restrictions/apps/wifi/etcetera there. From that, I can download an Enrollment Profile that automatically puts that into the group (which then applies settings.)

 

So I've got my restrictions and settings configured just like I had when I made a profile with Configurator 2, and I download the .mobileconfig file. I connect a device to Configurator 2, click Prepare, Automated Enrollment, select the .mobileconfig.. Only to not be able to continue because "The selected profile is corrupt."

 

If I simply try to add the profile to the unmanaged iPad I receive the error

Profile Installation Failed

The internet connection appears to be offline.
[MCInstallationErrorDomain - 0xFA1 (4001)]

 

I can push a profile to it that contains our wifi settings, that works, but then if I try to push the Enrollment Profile downloaded from the server, I get the same error.

 

If I try to open the profile to review its settings I'm greeted with

The document "English.mobileconfig" could not be opened.

 

Anybody any ideas?

[furby]

When you say "I can push a profile...", do you mean via Configurator?

 

Actually, I'll assume yes.

 

On the device go to http://yourmacserver.domain.com/mydevices

Tap the Enroll button and see if it enrols.

 

Depending on your setup you may need to choose the Profiles tab on the same page and install the Trust Profile. Try without first.

Edited October 14, 2015 by furby

[Garacesh]

When you say "I can push a profile...", do you mean via Configurator?

Yes, as in Right-Click, Add, Profiles..

 

I've tried getting it to auto-enroll via Configurator and even with importing certificates/SCEP etc couldn't get that working, which is why I'm trying to go down the route of "Let Profile Manager do all the work".

I'll give that a try, thanks.

[Garacesh]

Update:

 

If I use the Restore option to completely wipe the iPad, and then Prepare it by using Manual Configuration, giving it the name of our MDM server (which is just a Mac Mini running Profile Manager).. Leave Supervise on, leave allowing pairing on, point it at our organisation and choose 'Don't show any of these steps', the iPad is prepared successfully but not joined to our MDM (likely because I didn't give it any wifi info so it can't contact it)

 

I then add a profile (from Configurator 2) that only contains the wireless information and proxy details. The initial setup displayed on the iPad automatically recognises the wifi settings. I'm now greeted with a screen that says $Domain can automatically configure your iPad. If I choose Apply configuration I'm asked for credentials. I give it the credentials for Profile Manager¹, press enter, the keyboard goes away and then comes back (same thing happens if I press next) so I assume it's either not accepting them, can't verify them, or can't communicate with the MDM server.

 

Alright, fine. Click back. Reselect wifi. Choose Skip configuration this time. Totally read the T&Cs, click Get Started.

 

Fire up Safari. Navigate to http://macserver.domain.com/mydevices, get greeted by "Cannot Verify Server Identity" (Certficiate related, I assume?). Click Continue. Greeted with login screen. Use same credentials as used earlier, they get accepted. Click Enroll. Asked to install profile. Install. Install. Trust. Enrolling Certificate, Installing Profile, Profile Installed. Done.

 

Login to Profile Manager on my PC. Check Active Tasks. Enroll Device: New Device. 1 of 1 in progress. Status: Pending.

How long does enrolling usually take? 5 minutes later it's still Pending and hasn't shown up in Completed Tasks. Interestingly, Completed Tasks has an Remove Device: New device. 1 canceled entry bearing an identical timestamp to the enrolling event?

 

^{1 Are those the credentials it's asking for? It isn't clear. It just says Please enter your credentials for "$Organisation"}

 

Edit: Active Tasks still says Pending. iPad has shown up in Devices.

Edited October 15, 2015 by Garacesh

[furby]

I've never used Configurator so can't help you there. I just use profile manager to setup devices, so I don't know how they interact. (You might want to leave it out of the process to make sure profile manager is working).

 

Profile manager help:

The certificate thing is fine, it always seems to moan about that.

Did you install any profiles 'manually' from the profiles tab or did it just run through them when you hit 'enrol'?

 

No idea about the time, it's usually fairly quick but I think parts of profile manager are a mysterious black hole.

Kill the task. Sounds like it's enrolled.

 

See if you can push out a setting.

Edited October 15, 2015 by furby

[Garacesh]

Okay, little bit more progress now.

 

I can manage a device and enrol it automatically through Configurator using the automatic setup (In Configurator.) The option to allow $Organisation to configure the device (in the iPad's initial setup) still doesn't work, however I can push down a profile (via Configurator) downloaded through Profile Manager that automatically puts them into the right Device Group (which then applies the settings of the group re: security, apps etc)

 

But! The iPad is showing up in Profile Manager, Profile Manager is putting it in the right group, and it thinks it's pushing down the settings, but it just sits there on Pending and no modifications are made to the iPad. I can still assign a passcode, change the device name, etc. So there seems to be a communication issue somewhere.

 

Turns out part of the problem was that I wasn't pushing Profile Manager's Trust Profile to the iPad.