Students Removing Profiles - Jamf

[m_m]

We have a fleet of iPads which are supervised with Jamf. The iPads are locked to Safari with kiosk mode and the students are only allowed access to certain websites. Every so often though an iPad comes into our office which has been completely reset by a student. Profile removed and PIN added is the usual thing they do. How can they do this though when the iPad is managed and is in kiosk mode? We can't seem to replicate the issue. Almost seems like the kids are taking them home and resetting them although we have an activation lock to.

 

Anyone any ideas how the kids could be doing this?

[tmoon-mint]

Are the iPads added to Apple School Manager (previously known as DEP) and added to JAMF using automated device enrollment? If not this is why they can remove your MDM profile.

[m_m]

All iPads are in ASM.

[tmoon-mint]

Did you add them in yourself using AC2 or were they added in as soon as you purchased them? If you add them in manually the MDM profile is still removable for 30 days I believe.

[m_m]

They were added to ASM via our reseller. Have done a few with AC2 before and noticed profile was removeable but not the case with these iPads.

[tmoon-mint]

Strange I am at a loss then unfortunately. Maybe JAMF support might be able to explain whats going on? I dont use them myself but I hear the support is very good.

[Brimstone]

We have a fleet of iPads which are supervised with Jamf. The iPads are locked to Safari with kiosk mode and the students are only allowed access to certain websites. Every so often though an iPad comes into our office which has been completely reset by a student. Profile removed and PIN added is the usual thing they do. How can they do this though when the iPad is managed and is in kiosk mode? We can't seem to replicate the issue. Almost seems like the kids are taking them home and resetting them although we have an activation lock to.

 

Anyone any ideas how the kids could be doing this?

What Personal Apple ID is being used for Activation Lock?

 

Have you configured the DEP Enrolment Profile to be non removable? This still need to be checked in Jamf?

 

Are you using iOS Kiosk Mode or the Jamf Teacher App for this?

Edited April 4, 2022 by Brimstone

[m_m]

DEP profile is non removeable. Using iOS kiosk mode.

[Brimstone]

DEP profile is non removeable.

 

It is, wthout having access to software being used by countries such as North Korea and China, impossible to remove the iPad from DEP, this can only be done in ASM. I would triple chech that;

 

The iPad has been assigned correctly in ASM;

It is not an one of those iPads configured for ASM in AC2 or has been left for 30 days for the profile to be non removable.

 

Using iOS kiosk mode.

 

Guided access needs to have a password to stop this being removed, schools have in the past used AC2 on a Mac and put the iPads into DFU mode to reset it, so you also may want to ensure iPads do not have access to connect to another USB Device.