Not getting actual key-value in the command_results table

[ashishmeher216]

Let's say I install a profile which blocks the screenshot using allowScreenShot as false. The profile is installed on the device successfully and is working as expected.

My profile is :

PayloadContent allowScreenShot PayloadIdentifier com.miniorange.mdm.restriction_payload_3 PayloadType com.apple.applicationaccess PayloadUUID 53bec1be-ffec-4f88-acbd-b02aee8f04a11 PayloadVersion 1 PayloadDisplayName Restrictions PayloadIdentifier com.miniorange.mdm.conf_profile_3 PayloadType Configuration PayloadUUID 6020206c-12c2-4ada-987a-dd4c560ca73c PayloadVersion 1 `

But when I query the device for ProfileList using the cmdr.py tool, I get the list of profiles but it does not mention anything about the allowScreenShot. It contained the Profile Payload though.

CommandUUID 3c62d4ab-d296-498a-afaf-1ab89083f49b ProfileList HasRemovalPasscode IsEncrypted IsManaged PayloadContent PayloadIdentifier com.miniorange.mdm.restriction_payload_3 PayloadType com.apple.applicationaccess PayloadUUID 53bec1be-ffec-4f88-acbd-b02aee8f04a11 PayloadVersion 1 PayloadDisplayName Restrictions PayloadIdentifier com.miniorange.mdm.conf_profile_3 PayloadRemovalDisallowed PayloadUUID 6020206c-12c2-4ada-987a-dd4c560ca73c PayloadVersion 1 HasRemovalPasscode IsEncrypted IsManaged PayloadContent PayloadIdentifier com.github.micromdm.scep PayloadType com.apple.security.scep PayloadUUID CB90E976-AD44-4B69-8108-8095E6260978 PayloadVersion 1 PayloadIdentifier com.github.micromdm.nanomdm.mdm PayloadType com.apple.mdm PayloadUUID 96B11019-B54C-49DC-9480-43525834DE7B PayloadVersion 1 PayloadDisplayName Enrollment Profile PayloadIdentifier com.github.micromdm.nanomdm PayloadRemovalDisallowed PayloadUUID F9760DD4-F2D1-4F29-8D2C-48D52DD0A9B3 PayloadVersion 1 Status Acknowledged UDID 00008110-001970203698401E

What am I missing?

[jessepeterson]

This is expected. As you can see in the ProfileList response payload Apple devices only return the top-level information on the payloads installed. You do not get the contents (i.e. the 'full' or 'raw' profiles) returned.

[ashishmeher216]

So, how do we get the actual restrictions applied on a device? We have to store the payload details of the profile on our end. Is there any other workaround?

[jessepeterson]

I'm confused. You send the profiles to the device. Presumably you know what you sent? :) Or am I misunderstanding?

I think typically MDMs have a store of profiles that are identified by profile UUID & identifier. You then query the device to see if that/those profiles are installed (by the UUID & id) and then install (or update) them if they are not current or not present. This is the workflow that the NanoCMD profile workflow takes, for example.

[ashishmeher216]

So, I have to store all the profiles. Let's say I have multiple profiles, one to disable screenshot only, one to prevent copy/paste from managed pasteboard, etc. I have to store all these profiles somewhere (maybe database). I can distribute them to multiple devices. And when I query about ProfileList in a particular device, I have to compare the PayloadIdentifier I get from Apple with my stored profiles and get the details of the profile from there.

Am I correct?

[jessepeterson]

Yeah, that sounds about right. :) Note you probably also want to compare the PayloadUUID as well. Depending on if you manage macOS or iOS/iPadOS/tvOS, etc. they have slightly different semantics.

You can dynamically generate them, too. But as you said you'll need to keep track of the PayloadIdentifier and PayloadUUID to understand which "version" of the profile was previously installed on the device.

[ashishmeher216]

However, storing one profile with different PayloadUUID for different devices will be an overhead I believe. What do you think about it?