[JAMF School] - Erased iPads revert to old group memberships, or none at all.

[MrLudwig]

Hello,

 

In Jamf School when I have iPads to repurpose/redeploy for different users etc I'll remove the device from groups it should no longer be in (for apps/settings), then use the erase command (ideally with the Return to service feature). However, the vast majority of the time, when the device reconnects to Jamf to check-in after the erase, existing group memberships (ones I wanted to keep) are either forgotten completely, or revert back to the previous memberships (ones I'd removed prior to erase).

 

For example, I take an iPad that has been used as a student device and want to repurpose it as a staff device. I'll remove the iPad from our Student Apps & settings groups (and usually nudge it to hurry up the deferred deletion of apps that Jamf likes to do). I'll then tell Jamf to erase the device with return to service to get it back on our network automatically, and thus back talking to Jamf. However what tends to happen is once the iPad checks in, all the group memberships are either forgotten, or it reverts back to being in the student apps/settings groups and so starts deploying all the apps/settings linked to those groups.

 

It isn't specific to any groups; I've tried it with several different ones. I've also tried waiting hours/days between changing the group memberships and issuing the erase command; thinking maybe Jamf needed time to sync the change at the backend somehow. But it doesn't make any difference.

 

Any ideas why this is happening or how I can avoid it would be very helpful.

 

Many thanks.

[Brimstone]

Are your groups static or smart groups...?

 

I would guess you have Snart Groups and you have assigned previous profiles and apps to that group...?

Edited July 23, 2024 by Brimstone

[MrLudwig]

These are all Static groups.

[Brimstone]

These are all Static groups.

Is the network profile you are using assigned to a static group...?

[MrLudwig]

Yep, that too.

[Brimstone]

Yep, that too.

When you remove the device and "return to service" you must choose the network profile for the group you want this to go into.

 

https://learn.jamf.com/en-US/bundle/jamf-school-documentation/page/Return_Device_to_Service.html

[MrLudwig]

Haha, found it!

 

It isn't related to return to service. Further testing shows it also happens when I erase the iPad via Jamf without using return to service, and when initiating the erase directly on the iPad itself. In both cases, when the iPad is back online and checks into Jamf, the group memberships revert to the previous set even though I'd removed the iPad from those groups prior to the erase.

It turns out it's down to the placeholders for the iPads. These retain the original groups specified when the placeholders were set up (via a csv import). So when the iPads are erased and reconnect, the placeholder comes back into play and thus the iPad is put back into the groups set on that.

Thinking about it, it does make perfect sense now.

Many thanks.

[MrLudwig]

Haha, found it!

 

It isn't related to return to service. Further testing shows it also happens when I erase the iPad via Jamf without using return to service, and when initiating the erase directly on the iPad itself. In both cases, when the iPad is back online and checks into Jamf, the group memberships revert to the previous set even though I'd removed the iPad from those groups prior to the erase.

It turns out it's down to the placeholders for the iPads. These retain the original groups specified when the placeholders were set up (via a csv import). So when the iPads are erased and reconnect, the placeholder comes back into play and thus the iPad is put back into the groups set on that.

Thinking about it, it does make perfect sense now.

Many thanks.

Ah sorry, wrong terminology. Not the placeholders, I mean the Automated Device Enrollment entries. Although I think they may start out as placeholders when imported initially. Either way, editing the iPad's entry here rather than in the Inventory does the trick.

 

Think I need a lie down now.