Groups in Jamf Pro are used to organize computers that share similar attributes, like their
model or operating system version.
Groups are used to scope management tasks, stay current on the state of managed devices,
and even notify administrators about their membership.
My name is Kyle- welcome to Computer Groups.
If you haven't checked out our video on Advanced Computer Inventory Searches, I'd recommend
starting there, where we explore logic that impacts both advanced searches and smart groups.
A big difference between searches and groups is groups may only contain managed devices,
whereas searches will return devices whether they are currently under management or not.
Computer groups come in two varieties - static groups and smart groups.
Both are used to scope management tasks like app deployment, remote commands, and policies.
Let's begin by creating a static group.
Static computer groups have fixed membership that must be configured and updated manually.
Common uses include groups for testing, business center computers, or computers located in
the same physical location.
For example, if we navigate to the Computers tab in Jamf Pro and select Static Computer
Groups, we can create a group of devices for testing.
First, click New and give this group a name, like "Test Computers".
Then click Assignments and it's as easy as selecting the checkbox next to the computer
name you want included in this group.
Once computers have been assigned click Save.
Now, this group of computers can be used as a target or exclusion when configuring scope.
If you're unfamiliar with the concept of scope, check out our video titled Computer Scope.
We can verify the participants of this group by clicking View.
Like static groups, smart groups are used to scope management tasks to computers.
Unlike static groups, smart group membership is dynamic.
Computers become eligible for smart group membership and are added or removed automatically
based on whether or not they meet the specified criteria.
Let's select Smart Computer Groups on the sidebar to the left.
Jamf Pro contains a few of these groups by default.
Let's select "All Managed Clients" and look at the criteria.
If we click Criteria we can see it contains "Operating System" with the "not like" Operator
chosen and a value of "server".
Additionally, we're looking for computers without an application containing "Server.app".
This criteria is intended to exclude computers whose purpose is to run some kind of management
server - a common practice for on-premise solutions.
If we click View at the bottom, we can see the computers who are not being used as servers,
everything from MacBooks to Mac Pros.
From here we can perform mass actions including remote commands, which are detailed in our
Computer Inventory and Remote Commands video.
If we were to install server.app onto one of these computers, the next time it submitted
inventory it would automatically leave this group - there would be no need for us to manually
configure anything on Jamf Pro's side.
Let's try creating a smart computer group of our own.
Navigate to Smart Computer Groups in the sidebar and click New.
When naming groups, it's helpful to use detailed and consistent naming conventions.
In this case, I'll name this, "Overdue Minneapolis Computers".
An option to be notified on group membership change is available below the group name - this
is great for groups that determine if a computer hasn't submitted inventory for many weeks.
Be careful with this option, because you'll receive an email for each computer entering
or leaving the group which, when many computers are involved, can potentially result in many
emails.
Next, select the Criteria tab, click Add and choose the "Last Inventory Update" criteria.
If "Last Inventory Update" does not appear in this list, you may need to select Show
Advanced Criteria.
Change the operator from "before..." to "more than x days ago", and enter a numeric value.
The purpose of this group is to notify us if and when computers fail to submit an inventory
report after a period of time.
The tolerance for this lack of communication will vary from organization to organization
- I typically like to know when a computer has not submitted inventory after 2 weeks
before trying to locate it and determine why it hasn't, so I'll enter 14 in the value field.
Let's add a second piece of criteria to narrow this group down.
Select Add to the right, choose "Building", and provide a value.
If the building name is difficult to spell like ours, using the Browse button can help.
Select that, and I'm going to choose Minneapolis.
The "and/or" value can stay at "and", because we want to group computers that have not submitted
inventory in 14 days and belong to the Minneapolis building.
Select Save, and we can view the computers who belong to this group already - it looks
like we have several.
From here, we could reach out to users directly, or send them an email with a Mass Action - which
we cover in the Device Inventory and Remote Commands video - to either locate or remind
them to turn on their computers.
Select Back in the browser, and we have a checkbox to Show in Jamf Pro Dashboard, which
allows monitoring this group at a glance when we log in.
Selecting Jamf Pro in the top left will return us to the dashboard, where we can view our
smart group.
Let's try one more.
Select Smart Computer Groups from the sidebar, New near the top, and provide a display name
- I'll call this OS Version < 10.15.
The purpose of this is to group computers whose operating systems are out of date so
later we can make an upgrade available to our users.
Select the Criteria tab along the top, Add to the right, and select Operating System
Version from the list - or from the advanced criteria list if it doesn't show up.
Change the operator from is to less than, and while I could use the browse button it's
not quite as helpful when we're configuring something like operating system version, so
let's just enter 10.15 in the text field.
Now, I want my users' computers to be up-to-date, but I don't care so much about the test computers
- they might be running older OS's deliberately, so let's click Add, Computer Group from the
list, leave and/or at and, change the operator to not a member of, and use the browse button
to find our "Test Computers" group.
This is something called nesting groups, where one group belongs to another and the logic
is applied to both.
Now, this group will contain any computers not running 10.15 that are not members of
the "Test Computers" group.
When we start deploying configuration profiles, apps, and policies, we can use the static
and smart groups we've created to scope to specific computers without needing to manually
keep track of which of our hundreds or thousands of computers need specific management.
This video touched on the very basics of smart groups, which can include many pieces of criteria
and take advantage of advanced logic with extension attributes and even regular expressions
- both are more advanced topics linked in the resources of this video.
That's all for our video on Device Groups.
Thanks for watching.