Profile Manager Devices/Groups Missing?

I am trying to set up Profile Manager but all I see listed under the library heading on the left hand side of the page is Apps, Books, Users and Groups. Earlier today I had Devices, Device Groups and some other stuff like the create enrollment button. Any idea how I can get these back or why they went missing? I have attached a screen shot showing what I am talking about.

It looks like "Device Management" somehow got reset. You need to enable it from the Profile Manager pane in Server.app.

Similar Messages

Profile Manager - Device Group member of Device Group

Hi Everyone,
I have an iPad which is a member of a group on Profile Manager. This device group is in another device group...
EG.
Staff iPads (setting a generic profile of security etc.)
> Site One iPads (setup to use a certain SSID etc. etc.)
> Site Two iPads (setup to use another SSID etc. etc.)
Am I right in saying the profiles should be applied much like group policy - so the top level profile is applied then ones lower down the tree?
If so, anyone got any idea why ours arent?
Cheers
John Rickard

We have device groups, once the device have been enrolled we then move to a pre-configured profile which sets up items such as wifi, e-mail and passcpde etc all in one go, this has had mixed results, I've now setup profile groups for each item to give us more control over only given the user what they need instead on forcing everything, this resolved my item above but more testing is needed, the main issue has been trying to pass a pre-owned device to a new user as it seems to remember the pervious user in some cases, this is why I asked about if it was possible to delete device history.

Profile Manager Device Enrollmet

So, I've been using PM since it's introduction. No iOS devices are managed only MacPro's. Problem developed after upgrading the server and clients to 10.7.4. Enrolling a device now shows up as already enrolled under an existing entry for another device. steps to recreate the problem:
1. Verify that PM is active.
2. check the list of devices already enrolled.
3. log in from a workstation via Web Access (/Profilemanager/Mydevices)
4. Install the Trust Certificate
5. Install the Manage Certificate.
6. Enable "Manage This Device"
7. Log in from another workstation and attempt to repeat step 3.
8. The device list is showing that this device is already enrolled with the serial number from the machine that enrolled in step 6.
I tried everything I could think of, remove profiles from the client machine, delete all certificated in Keychain and reboot. Problem is repeating predictably and reliably.
Any suggestion will be appreciated.

We have device groups, once the device have been enrolled we then move to a pre-configured profile which sets up items such as wifi, e-mail and passcpde etc all in one go, this has had mixed results, I've now setup profile groups for each item to give us more control over only given the user what they need instead on forcing everything, this resolved my item above but more testing is needed, the main issue has been trying to pass a pre-owned device to a new user as it seems to remember the pervious user in some cases, this is why I asked about if it was possible to delete device history.

Profile Manager Device limit?

I'm in the process of testing some ipad deployments and have started by setting up profile manager on my 10.7.2 lion server but is there a device limititation? I have heard that there maybe due to the postgreSQL that may limit it? Any info would be great.....

We have device groups, once the device have been enrolled we then move to a pre-configured profile which sets up items such as wifi, e-mail and passcpde etc all in one go, this has had mixed results, I've now setup profile groups for each item to give us more control over only given the user what they need instead on forcing everything, this resolved my item above but more testing is needed, the main issue has been trying to pass a pre-owned device to a new user as it seems to remember the pervious user in some cases, this is why I asked about if it was possible to delete device history.

Profile Manager Device Pending

Hello. I am new to OS X Server and have come up against a problem with profile manager. I can enroll devices into profile manager but when I try and do anything (e.g. move them into a device group or update info) the task sits in active tasks as pending.
I am not sure where to even start debugging this. I am running OS X Server 3.1.2 and OS X 10.9.4.
Any help would be great.
Richard

We could solve this by opening the firewall for some ports (443, 1640, 2195, 2196, 5223, ) and ip addresses (17.0.0.0/8). Have a look at
OS X Server: Ports used by Profile Manager
Start Profile Manager

Profile manager device management disabled

I had a working profile manager but had to move to a new sever which then broke profile manager so i have performed a full wipe of the database ect and then tried to recreate a new one however i go through the configuration setup fine but under settings device management is says Disabled and i cant see any obvious way to turn this on?
Thanks in Advance

I would try demoting your Open Directory server from Master to Standalone in the Server Admin app - there's an assistant in Server Admin > Open Directory > Settings > General > click the change button.
Once it's demoted to a standalone, restart.
From there, don't create an OD Master again - go to Profile Manager in Server.app and run through the wizard again. In the process, it will create an OD Master for you.
Hope that helps,
Chris

HT204074 Manage devices link missing

I'm in iTunes, I've signed in, I've gone to manage my account but there is no device management link. Anywhere. Does this article need updating?

iPhone was, of course, connected before I tried. It shouldn't need to be connected to manage the list of devices associated with one's Apple ID in my opinion, but still, there is currently no manage devices link within the iTunes account information page.

Profile Manager: Devices won't Update Info in Server 2.2.2

When I go to a device and click "Update Info", it moves to the next screen but hangs at the Update Info like this screenshot below:
Instead of moving foward to the next prompt, allowing me to select it again and then it moving to the active tasks. Has anyone seen this problem before?
Thank you,
Mikel

When I go to a device and click "Update Info", it moves to the next screen but hangs at the Update Info like this screenshot below:
Instead of moving foward to the next prompt, allowing me to select it again and then it moving to the active tasks. Has anyone seen this problem before?
Thank you,
Mikel

Name clash in profile manager after NetRestore

Hi there,
New to the Apple world (Hi ) and struggling with profile manager.
I have used NetRestore to get an image onto 2 iMacs and I'm just going through the process of adding them to our network.
Post build I'm trying to enroll both iMacs but they are somehow clashing or linked. If I enroll MU112MAC, MU111MAC suddenly shows as enrolled (from the http://macserver/mydevices page). I've checked to make sure they have the correct computer name/host name but for some reason as soon as I enroll 1 they both show as enrolled (though only 1 device shows in profile manager devices).
Coming from a Windows background I thought this might be due to lack of a sysprep (or equivalent) beign run pre-capture but from some searching there doesn't seem to be a sysprep as such but rather guides on cleaning up cache and creating default user profile. I have a feeling the device was enrolled pre-capture so wondering if that's where the problem has arisen?
Any pointers/suggestions gratefully received.

Hi there,
New to the Apple world (Hi ) and struggling with profile manager.
I have used NetRestore to get an image onto 2 iMacs and I'm just going through the process of adding them to our network.
Post build I'm trying to enroll both iMacs but they are somehow clashing or linked. If I enroll MU112MAC, MU111MAC suddenly shows as enrolled (from the http://macserver/mydevices page). I've checked to make sure they have the correct computer name/host name but for some reason as soon as I enroll 1 they both show as enrolled (though only 1 device shows in profile manager devices).
Coming from a Windows background I thought this might be due to lack of a sysprep (or equivalent) beign run pre-capture but from some searching there doesn't seem to be a sysprep as such but rather guides on cleaning up cache and creating default user profile. I have a feeling the device was enrolled pre-capture so wondering if that's where the problem has arisen?
Any pointers/suggestions gratefully received.

In Profile Manager, Can I assign users to ONLY a specific Device Group?

In profile Manager (Lion Server 10.7.3) I created DEVICE GROUPS per Lab, and each Lab has a manager. I want to give each manager permissions to see and manage ONLY their devices. Is this possible?

I'm not sure this was ever designed to be user friendly as typically only Admins or those with elevated permissions would see these groups. There isn't as far as I can see, any way to add this step within a Wokflow too, unless you're able to install
some third party steps.
Steven Andrews
SharePoint Business Analyst: LiveNation Entertainment
Blog: baron72.wordpress.com
Twitter: Follow @backpackerd00d
My Wiki Articles:
CodePlex Corner Series
Please remember to mark your question as "answered" if this solves (or helps) your problem.

How to deploy settings in Profile Manager through Device Groups

When I go to the Profile Manager web page and create a device group and configure the payload settings it doesn't seem to send the profile settings to the Mac devices that are in the group. How do I go about getting this to work so when I get a new device that is enrolled all I have to do is throw it in the group so it will automatically push out the correct payload settings that I configured?

What you're asking should work. You should be able to create a Device Group and adjust the setting for that group. Then when you add a device to that group, the settings will be pushed to the device automatically. So, it leaves me with a few questions for you:
Why don't you think it sends the payload? When you look under "Activity" do you see tasks in the "Active" area or in the "Completed" area... or something else?
What are you trying to change? Setting up email accounts on iPhones will appear right away, but there are other changes (especially on computers) that don't take affect until it restarts (or the user at least logs out and back in).
Are you sure you have devices in your device group? Sorry, probably a really silly question, but under your device group, do you see the devices under the "Members" section?
Are your devices "trusting" your server? Did you add the trust profile to the device when you enrolled it?
Sorry I can't be more help... but I can tell you that you can do what you are asking. We have it set up in our office, and it works really well. We just add the new device to the device group and it does the rest.

The Ultimate Guide to Resolving Profile and Device Manager Issues

The following article also applies to issues after re-setting the severs' hostname. It also applies to situations where re-setting the Code Signing Certifictateas described by Apple has not resolved the issue.
Hello,
I have been plagued with Profile Manager and Device Manager issues since day one.
I would like to share my experience and to suggest a way how to resolve issues such as device cannot be enrolled or Code Signing Certificate not accepted.
I shall try to be as brief as possible, just giving an overview of the steps that resolved my issues. The individual steps have been described elsewhere in this forum. For users who have purchased commercial SSL certs the following may not apply.
In my view many of these issues are caused by missing or faulty certificates. So let us first touch on the very complex matter of certificates.
Certificates come in many flavours such as CA (Certificate Authority), Code Signing Certificate, S/MIME and Server Identification.
(Mountain?) Lion Server creates a so-called Intermediate CA certificate (IntermediateCA_hostname_1") and Server Identification Certificate ("hostname") when it installs first. This is critical for the operation of many server functionalities, including Open Direcory. These certs together with the private/public keys can be found in your Keychain. Profile and Device Manager may need a Code Signing Certificate.
The most straightforward way to resolve the Profile Manaher issues is in my view to reset the server created certicates.
The bad news is that this procedure involves quite a few steps and at least 2 hours of your precious time because it means creating a fresh Direcory Master.
I hope that I have not forgotten to mention an important step. Readers' comments and addenda are welcome.
I shall outline a sensible strategy:
1. Clone your dysfunctional server to an external harddrive (SuperDuper does a reliable job)
2. Start the server fom the clone and shut down ALL services.
3. It may be sensible to set up a root user access.
4. Back-up all user data such as addess book, calendar and other data that you *may* need to set up your server.
5. Open Workgroup Manager and export all user and workgroup accounts to the drive that you using to re-build your server (it may cause problems if you back-up to an external drive).
6. Just in case you may also want to back-up the Profile Manager database and erase user profiles:
In Terminal (this applies to Lion Server - paths may be diferent in Mountain Lion !)
Backup: sudo pg_dump -U _postgres -c device_management > $HOME/device_management.sql
Erase database:
sudo /usr/share/devicemgr/backend/wipeDB.sh
7. Note your Directory (diradmin) password for later if you want to re-use it.
8. Open Open Server Admin and demote OD Master to Standalone Directory.
9. In Terminal delete the old Certificate Authority
sudo rm -R /var/root/Library/Application\ Support/Certificate\ Authority/
This step is crucial because else re-building you OD Master will fail.
9. Go back to Server Admin and promote the Standalone Directory to OD Master. You may want to use the same hostname.
10. When the OD Master is ready click on Overview and check that the LDAP and Keberos Realm reflect your server's hostname.
11. Go back to Workgroup Manager and re-import users and groups.
NOTE: passwords are not being exported. I do not know how to salvage user passwords. (Maybe passwords can be recovered by re-mporting an OD archive - comments welcome! ).
12. Go to Server App and reset passwords and (not to forget) user homefolder locations, in particular if you want to login from a network account!
If the home directory has not been defined you cannot login from a network account.
13. You may now want to restore Profile Manager user profiles in Terminal. Issue the following commands:
sudo serveradmin stop devicemgr
sudo serveradmin start postgres
sudo psql -U _postgres -d device_management -f $HOME/device_management.sql
sudo serveradmin start devicemgr
14. You can now switch back on your services, including Profile Manager.
In Profile Manager you may have to configure Device Management. This creates a correct Code Signng Certicate.
15. Check the certificate settings in Server App -> Hadware -> Settings-> SSL Certificates.
16. Check that Apple Push Notifications are set.(you easily check if they are working later)
17. You may want to re-boot OS Server from the clone now.
18. After re-boot open Server App and check that your server is running well.
19. Delete all profiles in System Preferences -> Profiles.
19. Login to Profile Manager. You should have all users and profiles back. In my experience devices have to be re-enrolled before profiles can be pushed and/or devices be enrolled. You may just as well delete the displayed devices now.
20. Grab one of your (portable) Macs that you want to enrol and go to (yourhostname)/mydevices and install the server's trust profile. The profile's name should read "Trust Profile for...) and underneath in green font "Verified".
21. Re-enrol that device. At this stage keep your finger's crossed and take a deep breath.
22. If the device has been successfully enrolled you may at last want to test if pushing profiles really works. Login to Profile Manager as admin, select the newly enrolled device. Check that Automatic Push is enabled (-> Profile -> General). Create a harmless management profile such as defining the dock's position on the target machine. (Do not forget to click SAVE at the end - this is easily missed here). If all is well Profile Manager will display an active task (sending) and the dock's position on the target will have changed in a few seconds if you are on a LAN (Note: If sending seems to take forever: check on the server machine and/or on your router that the proper ports are open and that incoming data is not intercepted by Little Snitch or similar software).
Note: if you intend to enrol an Apple iPhone you may first need to install the proper Apple Configuration software.
Now enjoy Profile and Device Manager !
Regards,
Twistan

HI
1. In Action profiles, logon to system and recheck correcion are available in action definition as well in condition configuration and the schedule condition is also maintained. but the display is not coming(i.e in the worklist this action is not getting displayed).
You can check the schedule condition for the action and match the status values...or try recreating the action with schedule condition again....for customer specific ....copy the standard aciton with ur zname and make a schedule condition and check the same.
2, In suppport team of incident when i give individual processor it throwing a warning that u r not the processor. but when i give org unit it is working perfectly. Could anyone guide on this.
You need to have the empolyee role for BP ..goto BP and got here dropdown for ur bp and choose role Employee and then enter ur userid
also make sure that u have the message processing role
Hope it clarifies ur doubt and resolve ur prob
Regards
Prakhar

Can't log in to Profile Manager or My Devices with Active Directory logins

I have an OSX Lion 10.7.4 Server set up with Profile Manager and it is joined to AD.
I am able to see AD groups in the Profile Manager groups section.
I can also see and add AD users and groups using the server app.
I have enabled the "Can Enable Remote Management" check box for Domain Users through Profile Manager. I have also added Domain Admins to the Workgroup group in the Server app. I'm not sure that I want or need either of these options, but they were suggestions to try.
I am not able to log on to the Profile Manager or My Devices pages with AD logins.
I found these directions about nested groups in Workgroup Manager http://krypted.com/iphone/integrating-mac-os-x-lion-servers-profile-manager-with -active-directory/ but I don't have a com.apple.access_devicemanagement local group or any groups like are shown in the picture.
Any ideas what I'm missing?
Cheers,
Ian

I found the two pieces I was missing:
1) Install the Lion Server Admin Tools
Launch the Server Admin App
Click on the server name in the left pane
Click on the Access button in the upper part of the window
Click on Profile Manager
Either manually add specific groups to the list or if you're feeling brave choose the "Allow all users and groups" radio button
2) Run the command line steps on this page to change the authentication to plain text to support AD authentication:
http://support.apple.com/kb/HT4837
Voila!

Unable to push user profiles to AD groups with Profile Manager since upgrade to Server v3

Since upgrading our OS X Mac server from 10.8.5 to 10.9.1, and OS X Server app to v3 (now 3.0.2) I have been unable to push or modify user profiles to AD groups (or AD users) using Profile Manager. This was working fine on OS X 10.8.5. Pushing device profiles is still working OK after the upgrade.
From what I can see from the logs on the client side and server side, it seems related to a problem with the mdm authtoken.
In the client console I can see this entry:
27/01/14 14:30:15.844 mdmclient[38557]: *** ERROR *** [Agent:636102071] Unable to proceed with connection to: https://ourserver.ourdomain/devicemanagement/api/device/mdm_connect (com.apple.mdmconfig.mdm) because don't have valid MDM AuthToken
On the server, in the php.log I can see the corresponding attempt to authenticate:
1::Jan 27 14:29:50.930 [158] <192.168.28.171> {require_once (mdm_checkin.php:11)} vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv - PUT mdm_checkin
0::Jan 27 14:29:50.931 [158] <192.168.28.171> checkin: 'UserAuthenticate'
1::Jan 27 14:29:50.936 [158] <192.168.28.171> {Target_for_incoming_request (target.php:209)} Found target NETWORK LS: <User[156]@ourclientmachine>
0::Jan 27 14:29:50.937 [158] <192.168.28.171> {LabSession_validate_auth_token (mdm_checkin.php:22)} Failed auth for target NETWORK LS: <User[156]@Device[1697]>, incoming_request={
0::Jan 27 14:29:50.937 [158] <192.168.28.171>   'MessageType'=>'UserAuthenticate',
0::Jan 27 14:29:50.937 [158] <192.168.28.171>   'UDID'=>'17aff5c5a40f51acbbd78023d0028c80',
0::Jan 27 14:29:50.937 [158] <192.168.28.171>   'UserID'=>'A5EA25B7-7CCD-4EF4-B240-F23DED275EEC'
0::Jan 27 14:29:50.937 [158] <192.168.28.171> }
1::Jan 27 14:29:50.965 [158] <192.168.28.171> {SendFinalOutput (mdm_checkin.php:145)} Sent Final Output (407 bytes)
1::Jan 27 14:29:50.965 [158] <192.168.28.171> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - /devicemanagement/mdm/mdm_checkin
0::Jan 27 14:29:50.965 [158] <192.168.28.171> {SendFinalOutput (mdm_checkin.php:145)} Completed in 34ms | 200 OK [https://ourserver.ourdomain/devicemanagement/api/device/mdm_checkin]
So I can see there is a failure to authenticate, but don't really know how to troubleshoot this further. Or maybe this is just a bug in the new server app?
I have tried to remove and re-enroll clients in Profile Manager but no joy there.
In the client's Keychain I can see an MDM user AuthToken linked to the correct user account.
Thanks in advance for any help or suggestions

I just wanted to update my post, as this issue for me is resolved.
I uninstalled and reinstalled the Server.app on our Mac server, since then I've been able to push profiles to AD Users and Groups. I guess that in my case the Server app got into a bit of a mess when it was upgraded to v3.
Now the next headache I have is that my AD Groups which are displayed in Profile Manager are not syncing any recent changes. I think I'm probably seeing the same issue as described in this post
https://discussions.apple.com/message/25420919#25420919

Can't enroll devices with Profile Manager - invalid key

n my case I can install profiles on devices from Profile Manager page but I cannot enroll devices.
The certificate I download to enroll is reject by my MacBook Pro Lion: Says Invalid blablabla at the end:
Now I have done log research and I now exactly and understand why it doesn't work:
the scep_helper daemon is supposed to listen to port 1640 TCP (which you should forward to your server by the way, if you want to be able to enroll devices) and provide the requsting client the root CA that signed the certificate. In my case, it can't find the root CAT to provide the client with so it can finalize the cert validation process.
In my case, that's what I see in the log:
Jul 29 02:12:44 teknologism scep_helper[1638]: SCEP_HELPER: /SourceCache/RemoteDeviceManagement/RemoteDeviceManagement-701.70/scep_helper/m ain.m:727 'status = SCEPGetCACert(session, NULL, 0)' = -25300
Jul 29 02:12:44 teknologism scep_helper[1638]: SCEP_HELPER: /SourceCache/RemoteDeviceManagement/RemoteDeviceManagement-701.70/scep_helper/m ain.m:513 'SCEPGetCACert(session, NULL, 0)' = -25300
Jul 29 02:12:44 teknologism scep_helper[1638]: SCEP_HELPER: /SourceCache/RemoteDeviceManagement/RemoteDeviceManagement-701.70/scep_helper/m ain.m:819 'challenge = GetChallengeFromSCEP(password, guid, hostURL)' is NULL
Jul 29 02:12:44 teknologism ProfileManager[516]: Could not retrieve root certificate from open directory server.
No , as for the bad news: I have no idea on how to fix. Have dug into scep_helper, googled etc. Not a single clue on how to check it's configuration or even why it can't find the root CA. By the way everyhting else (I really mean everything, ical,cardav,web,wiki etc.) work great. And profile manager too, it's just the enroll thingy that doesn't work. And the root CA cert is in /etc/certificates. My server a legit Class 1 SSL cert signed by a system trsuted CA (Startfiel to name it)
I have tried with other certs etc... It's a no go.
Can anyone help ??
How can I add that missing CA Cert in opendirectory ?

Here is some more infos...
teknologism:root root# serveradmin settings devicemgr
devicemgr:SSLAuthorityChain = "/etc/certificates/trinity.teknologism.org.C1D19D55699B48C94A18787E4F53B4C3230E 91FE.chain.pem"
devicemgr:od_active = yes
devicemgr:ssl_active = yes
devicemgr:enableCodeSigning = yes
devicemgr:updated_at = 2011-07-28 16:04:52 +0000
devicemgr:email_delivery_method = ""
devicemgr:CodeSigningPrivateKey = "/etc/certificates/teknologism.org Code Signing Certificate.ED29CE4BD9D2926D64E60EF7A117EFDB2213F0CC.key.pem"
devicemgr:apns_active = yes
devicemgr:CodeSigningAuthorityChain = "/etc/certificates/teknologism.org Code Signing Certificate.ED29CE4BD9D2926D64E60EF7A117EFDB2213F0CC.chain.pem"
devicemgr:default_profile_created_at_least_once = yes
devicemgr:knob_sets_enabled:com.apple.mail.managed = yes
devicemgr:knob_sets_enabled:com.apple.vpn.managed = yes
devicemgr:knob_sets_enabled:com.apple.carddav.account = yes
devicemgr:knob_sets_enabled:com.apple.jabber.account = yes
devicemgr:knob_sets_enabled:com.apple.caldav.account = yes
devicemgr:email_authentication = ""
devicemgr:email_port = 25
devicemgr:email_username = ""
devicemgr:id = 1
devicemgr:last_modified_guid = ""
devicemgr:SSLPrivateKey = "/etc/certificates/trinity.teknologism.org.C1D19D55699B48C94A18787E4F53B4C3230E 91FE.key.pem"
devicemgr:od_master = "127.0.0.1"
devicemgr:apns_topic = ""
devicemgr:email_password = ""
devicemgr:mdm_acl = 2047
devicemgr:user_timeout = 43200
devicemgr:server_organization = ""
devicemgr:SSLCertificate = "/etc/certificates/trinity.teknologism.org.C1D19D55699B48C94A18787E4F53B4C3230E 91FE.cert.pem"
devicemgr:created_at = 2011-07-24 11:47:33 +0000
devicemgr:email_address = ""
devicemgr:email_domain = ""
devicemgr:CodeSigningCertificate = "/etc/certificates/teknologism.org Code Signing Certificate.ED29CE4BD9D2926D64E60EF7A117EFDB2213F0CC.cert.pem"
devicemgr:email_server_address = ""
devicemgr:admin_session = ""
The 3 CodeSigning certs/keys are in /etc/certificates and their permissions are correct.
Also, don't ask me why but my ProfileManager pane in Server.app is working again. It shows all the config...but can't modify anything....as soon as I try to modify it spins the waiting whell forever... I guess it's the same error as command line serveradmin...

Profile Manager Devices/Groups Missing?

Similar Messages

Maybe you are looking for