Profile Editor Command Policy

What

The Command Policy in the Profile Editor is unique; the contents of a Command Policy is not a profile payload, but instead MDM commands.

When/Why

Some commands are available from the right click context menu, e.g. Wipe Device…. However, some commands would be unwieldy in this manner e.g. iOS Wallpaper. Imagine having hundreds or thousands of devices or if you wanted different Wallpaper based upon location, department, etc.

To provide this flexible working, some commands have been placed inside the Profile Editor and all these commands exist within the Command Policy view. This method allows the association of such commands based upon Smart Groups, for example, and allows easy association across many devices.

While a Command Policy remains assigned, FileWave normally resends its commands during MDM Verify, including the 24-hour verification cycle or a Model Update. The gated exceptions below still apply: wallpaper is limited to once per 24 hours per device, while Time Zone, Shared iPad and Accessibility settings are resent only when the relevant device settings differ.

Since these are commands and not Profile Payloads, there will be:
* No request type of ‘InstallProfile’ listed in the Command History
* These will not be listed in the ‘Installed Profiles’ view.
* There will be no Fileset Report for these Command Policies
* The Fileset Status will remain grey and only ever report Associated
For the wallpaper example below, Command History shows a request type of ‘Settings’ and a Wallpaper settings item. Check the actual request and response for the chosen command; do not use Installed Profiles or the grey Fileset status as proof that the setting failed.

Starting in FileWave 16.3.x, this distinction also matters in mixed DDM/MDM environments. Command Policy Filesets are not treated as DDM-installed Profiles. They are excluded from DDM installation and converted into the corresponding MDM commands during deployment.

Fileset Disassociation

Where a command instructs a device to enable a setting, for example: Remote Desktop, Idle Reboot, etc. there is a sub option.  This sub-option provides the option to disable the setting if the MDM Command Policy Fileset is disassociated.  If not set, the setting will remain enabled on disassociation.

Gated Exceptions

It is feasible, that some commands may change settings, but local users may override these settings.  Whilst the assignment of the MDM Command Policy Fileset is in place, with each new Verify, the command should be re-sent.  By default, MDM verification not only occurs every 24 hours, if a device has no other reason to check-in, but will occur with every Model Update.  This, though, can have consequences, where re-sending the command may not be desirable or should be less frequent.  As such, there is a gated exceptions list.

Wallpaper

MDM communication was designed for small configuration files to be sent, not large images.  Although Apple allowed the possibility of providing images through MDM commands, they can have a significant impact on server performance where lots of devices exist and frequent Model Updates are actioned.

For this reason, Wallpaper MDM Commands are limited to once every 24 hours per device, even if a manual Verify is triggered.

Time Zone

Since Time Zone information is available from devices, FileWave will not re-send the command, whilst the Time Zone of devices match the Time Zone of the MDM Command Policy.  Only if the two differ will the command be re-sent.

Shared iPad

As with Time Zone, Shared iPad commands will not be re-sent to devices with a Verify, unless the devices current setup does not match the Shared iPad configuration within the Command Policy.  Only if the two differ will the command be re-sent.

Accessibility Settings

Similar to Time Zone and Shared iPad commands, again the command will not be re-sent unless there is a difference between the device's settings and those in the Command Policy.  Unlike Time Zone and Shared iPad, only those items that differ will be re-sent, rather than the entire dictionary of Accessibility Settings.

Remote Desktop

Remote Desktop requires a mention here.  At this time, Remote Desktop is not gated.  There are issues unique to the Remote Desktop command.  Apple pre-determine certain settings, for example, when using the Remote Desktop command to enable Remote Desktop, configuration will enable Remote Desktop for all users, regardless of any prior configuration locally on the device.

Configuration could be altered, after the Command Policy to enable Remote Desktop has been received, but a re-send of the Remote Desktop command may overwrite this configuration.  A method of disassociation would be desirable to prevent this from occurring.  In this instance, ensure the option to disable the service is not set for disassociation.

If the desired Remote Desktop settings match those of Apple's defined settings, leaving the assignment of the Fileset with the device would be ideal, to ensure they are correct with each Verify.

How

• Open the Profile Editor
• Select Command Policy
• Edit as desired
• Save the Command Policy, then complete the pilot deployment and verification below before deploying across many devices

After saving the Command Policy, create a Deployment for a small set of MDM-enrolled test devices that meet the selected command’s platform and supervision requirements. Review pending administrator changes, then update the Model. Open the device’s Client Info > Command History and inspect the request status and any error details, using Apple MDM Command History. A device with only the macOS FileWave Client installed does not have this MDM command channel. Confirm the intended setting on the device before expanding the Deployment.

Example Command History view for a setting to alter the Wallpaper: