MrLudwig

Ah sorry, wrong terminology. Not the placeholders, I mean the Automated Device Enrollment entries. Although I think they may start out as placeholders when imported initially. Either way, editing the iPad's entry here rather than in the Inventory does the trick. Think I need a lie down now.

Haha, found it! It isn't related to return to service. Further testing shows it also happens when I erase the iPad via Jamf without using return to service, and when initiating the erase directly on the iPad itself. In both cases, when the iPad is back online and checks into Jamf, the group memberships revert to the previous set even though I'd removed the iPad from those groups prior to the erase. It turns out it's down to the placeholders for the iPads. These retain the original groups specified when the placeholders were set up (via a csv import). So when the iPads are erased and reconnect, the placeholder comes back into play and thus the iPad is put back into the groups set on that. Thinking about it, it does make perfect sense now. Many thanks.

Yep, that too.

These are all Static groups.

Hello, In Jamf School when I have iPads to repurpose/redeploy for different users etc I'll remove the device from groups it should no longer be in (for apps/settings), then use the erase command (ideally with the Return to service feature). However, the vast majority of the time, when the device reconnects to Jamf to check-in after the erase, existing group memberships (ones I wanted to keep) are either forgotten completely, or revert back to the previous memberships (ones I'd removed prior to erase). For example, I take an iPad that has been used as a student device and want to repurpose it as a staff device. I'll remove the iPad from our Student Apps & settings groups (and usually nudge it to hurry up the deferred deletion of apps that Jamf likes to do). I'll then tell Jamf to erase the device with return to service to get it back on our network automatically, and thus back talking to Jamf. However what tends to happen is once the iPad checks in, all the group memberships are either forgotten, or it reverts back to being in the student apps/settings groups and so starts deploying all the apps/settings linked to those groups. It isn't specific to any groups; I've tried it with several different ones. I've also tried waiting hours/days between changing the group memberships and issuing the erase command; thinking maybe Jamf needed time to sync the change at the backend somehow. But it doesn't make any difference. Any ideas why this is happening or how I can avoid it would be very helpful. Many thanks.

We’ve used KRCS for several years now. They are consistently best on price, and are an Apple specialist so know the ins & outs of things like ADE, Classroom etc. As a bonus, they’ve never cold-called us either wondering if we have anything in the works they can help with.

Hi Brimstone, Yes to all of those - The iPads are brand new devices and are enrolled in ADE. The apps are all volume purchased through Apple School Manager and the licenses are showing against the device in Jamf (under Content Licenses). The device owner has no licenses listed against their account. The setting to "Remove app when profile is removed" is ticked for each of the apps. Dan

Hello, We are in the process of moving MDM from LightSpeed to Jamf School. For the most part, Jamf has been a far better experience, but I'm still finding my way around to some degree. This year all new iPads have been assigned to Jamf via Apple School Manager and we have transferred sufficient app licenses away from LightSpeed to Jamf to cover these. All this has worked without a problem. I've set up Device Groups for our staff and students and deployed apps to those groups. I can add devices to the appropriate groups and they get the apps installed. The apps all show up under Managed Apps on that device in Jamf. So far so good. However if I remove a device from the group, only a few of the apps are then marked for removal from the device, and none of the licenses are revoked. There is no way I can see to remove an app or license other than by removing the device from the group, except it doesn't seem to be doing this for the majority of the apps installed. I've checked that the licenses are being assigned to the device and not the user, and gone as far as erasing a device completely, after which Jamf shows all the apps have now gone, but still has all the licenses assigned to that device. I'm a bit puzzled, unsure if I'm missing something here because I'm new to Jamf, or something isn't working as it is supposed to. Some of the apps we use are paid-for and we only have a limited number of licenses, so at some point the need to revoke them from devices is going to become a real problem if we can't find a way to do this. Any help would very much appreciated. Best regards, Dan

I’ve done this from 2016 to 2019 using a guide I found on PeteNetLve. I’m pretty sure it said the same procedure should work back to 2008R2. I’ll try and find the link to the PeteNetLive article when I’m back at my PC, but it’s probably searchable. If memory serves, it’s basically backup the AD CS config using the built in backup option in the AD CS management MMC, export the certsvr regkey (something like HKLM System CurrentControlSet Services CertSvr). Modify the server name value in the .reg file to the name of the new CS server. Remove the role from the old server. Add the AD CS role to the new server, and restore from the backup. Stop the service, merge the .reg file and restart the service. As I say this worked for me going from 2016 to 2019 and I’m pretty sure the article said it should be much the same process for 2008R2 as well. I did this recently and haven’t seen any problems so far. It all seems to have worked.

MS have a nice page detailing how to do this via the Start Menu XML layout file thimon mentioned above here https://docs.microsoft.com/en-us/windows/configuration/configure-windows-10-taskbar. It works pretty well and there is an option to replace the default pinned icons or add to them.

As I understand it, you get one level of folders but that’s it. So for example if you created folders in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Applications\Microsoft Office, any shortcuts in there or any other folders at that level or deeper would all appear listed together on the Start Menu in the Applications folder. You won’t see the Microsoft Office folder, but you would see any shortcuts it contains. The same applies to a redirected Start Menu. Also if a first level folder is empty, it won’t appear. Not sure what the Microsoft UI designers were smoking when they decided this was a good idea, but whatever it was, they should probably avoid it in future.

I did this on a Server 2016 domain at my last school without a problem. Only had 3 DC's so didn’t take very long. From what I remember it’s a fairly straightforward process.

Might be worth checking where it actually installed. I seem to remember Scratch v3 installed into the user profile for us, rather than somewhere that actually made sense like program files. Having said that, I think you can just move the folder onto a network share and run it directly from their.

Sorry Arcath, I can’t remember the specific file, plus I no longer work at the same school so don’t have access to the computer this was happening on to check.

Yeah ours still tries to do the dialout if it can't see the Meter Connect software via USB to a laptop, which is how I've been doing things up to now. Not sure sure what did it in the end but I have now got it to work again. I ended up using an old laptop that hasn't been turned on since August and so no Windows Updates since then. Also swapped the USB lead just in case. Plugged the Meter in and it detected it and connected back to PB first time. Will try again with the original laptop & USB the next time it needs an update/funds added and see how it goes. Then swap out one thing at a time to see what makes a difference. Thanks for the info and suggestions guys, much appreciated.