Machines losing connection with our JSS

[bbot]

Every month, we're seeing about 6-12 machines that lose their connection with our JSS.

I have a smart group that checks for machines not checked in for 30 days or more, then use a ping scanner tool to determine which machines are still active and online.

I then have to use recon to re-enroll them into the JSS.

Has anyone else seen this in their environment?

[ocla__09]

@bbot What ping scanner tool do you use?

[bbot]

@ocla&&09 It's a Window's tool called PingInfoView - http://www.nirsoft.net/utils/multiple_ping_tool.html

I export a list of the machines from the smart group, then copy and paste the entire list in there and see which machines are replying.

[TomDay]

@bbot Yes we have been seeing this for nearly a year now. Same symptom and same resolution as you every month or so. Sorry I can't offer more but just wanted to let you know, yes we are in the same boat. All I've really done so far is "put it on the list" to investigate further.

[bbot]

@TomDay Thanks for your input.

I also noticed that two machines are having issues re-enrolling. First time seeing this in the past 2 years. I can ping our jss from their machine, but doing a "checkjssconnection" says it can't connect due to some certificate error. I've tried re-enrolling using Recon tool and using jamf enroll -prompt locally on the machine..

[EliasG]

I as well run into the same issue and have to take a drive to the schools and re-enroll them again.

[ocla__09]

I have tried the Recon network scanner over the years and have never seen it be useful. All it does is re enroll machines already in inventory, even though theoretically those machines should not be re enrolled if you have "don't scan IP's already in the JSS" checked...

Have others had better results?

[bbot]

@olcikas_e I have the same experience with the Recon network scanner. It re-enrolls machines that were already enrolled. The overall process for us is too long since our network range from wifi and wired is over 15,000 addresses. I found it's easier for me to manually check my Smart Group that looks for inactive machines over 30 days, then manually re-enroll them once a month using Recon.

What would be cool is a way to remotely bulk enroll machines instead of entering them in 1 by 1.

[ocla__09]

How do you identify the IP's for machines that have fallen out of inventory? Search DNS?

[bbot]

@ocla&&09 I export the hostnames from the Smart Group, and pop them into http://www.nirsoft.net/utils/multiple_ping_tool.html (Windows tool). You can probably find a similar tool for Mac.

The tool tries to ping all the addresses, tells me which one has IP's in DNS, and tells me which ones are currently online.

Based on the ones online, I'll re-enroll them manually using Recon. (this is the painful and time consuming part)

[claudiogardini]

Casper Check by Rich Trouton might make your life easier. https://github.com/rtrouton/CasperCheck