Skip to main content

Archiving Clients

One of the State options of FileWave is archiving clients.  Archived clients do not consume a FileWave licence.  Device records will continue to exist from the point of archive, but the device will no longer receive any communication with the FileWave Server.

Archived devices are known to be 'removed from the FileWave Model'.  Model Update changes will not apply.

Archived Clients are hidden from view by default, but there is the option to 'Show' them if desired:

image.png

Archiving, removes devices from the FileWave Model

A Model Update is required after making any state change.

 

Computer Clients

Once archived, computer clients will not be included in any model updates, nor will their inventory update with the server.  

At any point, the device may be removed back from archived using the Reinstate option.

Since the FileWave Client is not removed on archive, the device should continue to check back in as before, updating to the latest model.

Apple MDM enrolment is of concern when re-instating, as highlighted in the below section.

The following KB articles describe removing the FileWave Client.   If attempting to remove the client through FileWave, these Filesets should be pushed to devices prior to archiving:

Uninstall the FileWave Client on Windows

Uninstall the FileWave Client on macOS

Clearly, if the FileWave Client is removed from the device, a Reinstate will not cause the device to check back in.  The FileWave Client will requiring reinstalling.

Apple MDM

When archiving devices which are MDM enrolled, it is possible for the enrolment profile to be removed during the state change to archived.  Whether the enrolment profile removal is attempted is based upon either the type of enrolment or the FileWave Central Admin setting found in:

  • Preferences > Mobile

image.png

Devices will not be able to report success of the profile removal, since once the profile is removed, there is no longer a mechanism to report back success.

Archiving a device enrolled using Automated Device Enrolment (also know as DEP) will even attempt to remove enrolment profiles which are configured to be non-removable.  Indeed, Apple only supply two official options for removing an enrolment profile configured as non-removable: MDM command to remove (as triggered by archiving) and wiping the device.

See the troubleshooting section below for further information on removing a non-removable profile.

Troubleshooting

Since MDM enrolment profiles may be configured to be non-removable, how can this be addressed if for some reason the command to remove the profile is not received, since it is not possible to re-instate and try another archive.

If the reason the below is being attempted is due to a device no longer appearing to be MDM enrolled despite it originally being otherwise, recommendation would be to try the below option for re-enrolment, before using the extreme method of disabling SIP and editing the OS.

Apple's SIP (System Integrity Protection) prevents certain folders and files being altered, enrolment profile and related files included.  Therefore, to remove a non-removable profile without wiping the device, involves disabling SIP, removing the related files and then reinstating SIP for security.

The below methods are not supported by Apple or FileWave and any unexpected behaviour from attempting any of the following is the sole responsibility of those actioning the commands.

Disabling SIP
  • Boot into recovery (reboot the device and hold the two keys CMD and R when presented with the Apple Logo)
  • Use the menu to open Terminal
  • In Terminal, type the following:
# csrutil disable  && reboot

This should both disable SIP and cause the computer to reboot to finalise the process.

Removing Enrolment

Enrolment profile and matching files are found in the following directory:

# /var/db/ConfigurationProfiles/

Use the following commands to remove profiles and reinstate SIP:

# rm -rf /var/db/ConfigurationProfiles/Store/*
# csrutil clear
# reboot
Re-Enrolment

If it is deemed necessary to re-enrol the device, follow these final steps:

  • Reinstate the device in FileWave (you cannot re-enrol an archived device - A Model Update is required afterwards)
  • Log into the device with an Administrator account
  • Trigger the below command via Terminal:
  • # sudo profiles renew -type enrollment
  • A macOS notification should appear, which will need to be accepted by entering the Administrators Password
  • Another notification should appear, requesting the authentication (username and password) of the user to enrol the device

On completion the device should have re-enrolled.  Confirmation may be observed with the following command and similar output.  

Output may vary depending upon macOS version.  Server name will be the name of the server the device enrolled with.

# sudo profiles status -type enrollment
Enrolled via DEP: Yes
MDM enrollment: Yes (User Approved)
MDM server: https://demoserver.filewave.net:20443/ios/mdm

 

 

No Comments
Back to top