Devices enrolled in Jamf Pro regularly submit inventory information about their installed
apps, operating system, hardware, and much more.
Most of this data is updated automatically when they submit inventory reports, and many
fields can be configured manually by administrators.
From these records, we can issue remote commands to accomplish tasks like lock, unmanage, wipe,
or clear device passcodes.
This is Nate, welcome to Device Inventory and Remote Commands.
From the Jamf Pro Dashboard, select the Devices tab and search for a device with the field
near the top - I'm going to look for Pump Up the Jamf, press return, and select the
result to view its inventory record.
Along the top are three tabs - Inventory, Management, and History.
To the left is a list of categories - General, Hardware, User and Location, and so forth.
The General category contains the Mobile Device Name, Device ID, whether the device is Managed,
Supervised, and much more.
Most of this information is updated automatically when the device submits inventory, but with
this small Edit button at the top right we can also manage some of this data manually.
We can Enforce Mobile Device Name for supervised devices, which, if a user changes the name
of their device, it will revert to the value entered here when it submits inventory.
We can also enter asset tag information.
If you do change any of these values, make sure to select the small Save button in the
top right.
The Hardware category contains storage information, serial number, UDID, and model data.
The User and Location category indicates to whom and where the device belongs.
Unless that information is specified during enrollment, these fields will be blank, but
we can provide information with the Edit button in the top right.
This allows us to provide a username—or search for existing users—full name, email
address, phone number, position, and assign a building and department.
Once that's configured click Save in the top right.
We can also view purchasing information which can, again, be populated manually, or populated
automatically if your server is integrated with Apple's Global Service Exchange; security,
which outlines passcode, activation lock, and jailbreak status; which apps and profiles
are installed; and we can even add attachments like pictures or documents to an inventory
record.
Next, let's select the Management tab where we can issue remote commands.
The remote commands available will depend on whether the device is supervised, enrolled
with a PreStage Enrollment, or both.
Because this iPhone meets both criteria, we have access to every remote command available.
We can manually update the inventory record, clear passcodes, wipe the device to remove
all data and bring it back to the Setup Assistant, set a custom wallpaper, and more.
For detailed information on remote command device requirements, let's check out the Jamf
Pro Administrator's guide.
Navigate to docs.jamf.com/jamf-pro, search for Remote Commands for Mobile Devices, select
the result, and we're provided a list of possible commands.
Notice Update Inventory has no iOS Device Requirements (besides being managed), however
to issue a Set Wallpaper command the device needs to be supervised with iOS 7 or later
and to Update OS Version the device needs to be supervised and enrolled with a PreStage
Enrollment with iOS 9 or later installed.
These commands leverage the Apple Push Notification service, or APNs, meaning when we send one
it will resolve very quickly on the target device - provided it is connected to a network
- so make sure you exercise caution and be deliberate when issuing commands.
Let's close this tab, return to Jamf Pro, and try one of these.
Suppose a user loses or has their phone stolen.
We can enable Lost Mode to lock their device and display a message until it's returned
to its rightful owner.
Select Enable Lost Mode and we have the option display a message, phone number, or both on
the missing device; something like, "This phone is property of Jamf, please return to
1234 East St.", phone number, "555 555 5555".
Selecting Always enforce Lost Mode will enable lost mode after an enrollment event even if
the device is wiped.
Because this iPhone is part of an PreStage Enrollment, it must enroll before proceeding
with the Setup Assistant, meaning it will never leave Lost Mode until we intend it to.
Lost Mode Sound will play a chime to help users locate it if it's close by.
Selecting Enable Lost Mode will accomplish a few things.
On our iPhone, it will lock and display the message we set.
We cannot access its contents until we disable Lost Mode from Jamf Pro.
Back in our server, we can check the status of a command by selecting the History tab.
It looks like Lost Mode was enabled about a minute ago.
In addition, device information was submitted, the device's location was submitted, and PlayLostModeSound
was issued to the device.
Navigating to the Inventory tab, selecting Security, scrolling down to Approximate Location,
and selecting the GPS coordinates will reveal the device's last known location.
We can also update that location or play the Lost Mode sound with the buttons at the bottom
of this pane.
Once the device is found, we can navigate back to Management and disable Lost Mode with
the newly available remote command.
Commands issued from an inventory record are great if we want to affect one device, but
what if we want to, for example, set the wallpaper for many devices at once?
We can also issue remote commands through mass actions to any list of search results
or groups.
For example, I've created an advanced search called "iPads and iPhones in US Field".
If you haven't already, check out our video called "Advanced Mobile Device Searches" for
more information.
Selecting this advanced search, clicking the View button at the bottom, and Action in the
bottom right provides a bunch of management options for these devices, including a radio
button to send remote commands.
Let's select that and click Next in the bottom right.
We have access to many of the remote commands available to us from inventory records.
For example, we can set the wallpaper on all these devices at once.
Notice, however, supervision is required to accomplish this.
Scrolling down, we have the option to set the wallpaper for the lock screen, home screen,
or both.
I'm going to leave this at Lock Screen, select Upload Wallpaper Image, and find a suitable
wallpaper in Finder.
Select Choose and Upload, then Next to deploy the command, and as we see in this case it
failed to deploy to a few devices - this is because they are not supervised, and therefore
ineligible.
Our supervised iPhone however, now boasts a snazzy new wallpaper.
Mass actions are issuable from simple searches as well, so searching for Minneapolis also
results in an action button in the bottom right.
In addition, we can issue them from smart groups and static groups.
Remote commands are a convenient and quick way to issue management tasks.
They can be issued individually from inventory records, or en masse from searches and groups.
That's all for our inventory and remote commands video, thanks for watching.