For a variety of reasons, MDM commands sent out from an MDM server can fail to run correctly on a Mac. Many times, these MDM commands will not be re-sent unless the failure is cleared. With the failure cleared, the MDM server will not have a record of sending the MDM command and should try again.
On Jamf Pro, there’s a couple of ways you can clear failed MDM commands. The first is a manual process which uses the Jamf Pro admin console. The second uses the Jamf Pro Classic API and can be automated. For more details, please see below the jump.
Clearing failed MDM commands using the Jamf Pro admin console
To clear failed MDM commands using the admin console, please use the procedure shown below.
1. Run a search for the computers you want to clear.
Note: If you search with no criteria, the search results will list all Macs enrolled with the Jamf Pro server.
2. Once you have the desired list, click the Action button.
3. Select Cancel Remote Commands and click the Next button.
4. Select Cancel All Failed Commands and click the Next button.
5. Once all failed commands have been cleared, click the Done button.
Clearing failed MDM commands using the Jamf Pro Classic API
You can also use the Jamf Pro Classic API to script an automatic clearing of failed MDM commands at whatever interval is desired. There’s numerous ways to make this work, with my approach being the following:
1. Write a script designed to run via a Jamf Pro policy on individual Macs to perform the following tasks:
a. Use the API and the Mac’s hardware UUID to identify the Mac’s computer ID in Jamf Pro.
b. Use the API and the Mac’s hardware UUID to download the list of failed MDM commands.
c. Use the API and the Mac’s Jamf Pro computer ID clear all failed MDM commands associated with that Jamf Pro computer ID.
Note: For those who haven’t used the Jamf Pro Classic API before, you will need to provide a username and password to the script. This is a security risk, so my recommendation is to carefully evaluate if the risk is worth it for your environment. If it’s not, don’t use this approach.
One way to mitigate this risk is to set up a dedicated account with the least privileges necessary to accomplish the task of clearing the failed MDM commands. This method does not eliminate the risk, but it may reduce it to one acceptable in your environment.
In my testing, the least privileges are the following:
In Jamf Pro Server Objects:
Computers: Read
In Jamf Pro Server Actions:
Flush MDM Commands
2. Set up a Jamf Pro computer policy with the following components:
Script: The script to clear failed MDM commands
Trigger: Recurring Check-In
Execution Frequency: Once every day
Note: Execution Frequency can be set as desired for a longer interval, like Once every week or Once every month.
The script is available from following address on GitHub: