Home > AutoPkg, Jamf Pro, JSSImporter > Phantom groups, MySQL queries and Jamf Pro 10.7

Phantom groups, MySQL queries and Jamf Pro 10.7

On September 13th, Jamf released a new KBase article for Jamf Pro customers who hosted Jamf Pro themselves instead of hosting in Jamf Cloud:

On-Prem Jamf Pro Customers Upgrading to 10.7.0: https://www.jamf.com/jamf-nation/articles/552/on-prem-jamf-pro-customers-upgrading-to-10-7-0

In the KBase article, Jamf provides a couple of MySQL commands to run:

select computer_group_id,criteria,criteria_display from smart_computer_group_criteria where criteria not in (select computer_group_name from computer_groups) and search_field="Computer Group";
select computer_group_id,criteria,criteria_display from smart_computer_group_criteria where binary criteria not in (select binary computer_group_name from computer_groups) and search_field="Computer Group";

If either query returned data, the KBase directs you to contact Jamf Support. This was my output:

What had happened? For more details, please see below the jump.

When I looked at the list, the fact that all of the results returned Testing rang a bell. I’m using JSSImporter, which uses .jss AutoPkg recipes to upload software to my Jamf Pro server. By default, most .jss AutoPkg recipes create smart groups which include the following criteria:

Computer Group: Member of: Testing

Jssimporter created smart group

However, there is not a static or smart group named Testing on my Jamf Pro server, so that meant the smart groups generated by my .jss AutoPkg recipes contain Computer Group criteria which isn’t valid. This is the issue that Jamf Pro 10.7 has difficulty with and what the MySQL queries were meant to find.

So the fix is to do one of two things:

  • Identify the relevant smart groups and either remove or update the criteria.
  • Delete the relevant smart groups.

In my case, I’m not actually using the smart groups generated by JSSImporter and my .jss recipes. My own fix for this issue was to do the following:

A. Update the .jss recipes used with my Jamf Pro server to remove the section which creates smart groups.

Screen Shot 2018 09 18 at 6 08 49 PM

B. Delete the existing smart groups from my Jamf Pro server.

C. Run a complete AutoPkg run to verify the following:

i. My JSSImporter-created policies now showed no scoping (previously, they were scoped to the smart groups)
ii. The smart groups were not recreated on my Jamf Pro server.

Screen Shot 2018 09 18 at 6 20 04 PM

Once I did that and deleted the JSSImporter-created smart groups from my Jamf Pro server, I re-ran the MySQL commands and received the following results back:

I confirmed with Jamf Support that the output above indicated that the problem was fixed.

Note: I have not edited my publicly-available .jss AutoPkg recipes to remove the section which creates smart groups. If you’re using my .jss recipes and want to remove the section which creates smart groups, please do the following:

1. Make copies of the .jss recipes in question.
2. Assign the copies a new and unique AutoPkg recipe identifier
3. Remove the following section of the .jss recipe:

Screen Shot 2018 09 18 at 6 08 49 PM

Categories: AutoPkg, Jamf Pro, JSSImporter
  1. Graham
    September 19, 2018 at 11:33 am

    Hi Rich, I’m curious as to your workflow if you are not creating/scoping groups as part of a JSSImporter workflow.

    Are you perhaps making trigger-only policies, or manually scoping after import (or adding scope using a separate automation tool)?

    Cheers,
    Graham

    • September 19, 2018 at 11:50 am

      We’re using JSSImporter as a way to get the packages uploaded, then we’re using our own tools and processes to assign the packages to separate policies created outside of JSSImporter-created policies.

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: