JSS Restrictions Removal Tool

In our iPad deployment we use Casper as a management tool for restricting our student devices. When student devices come in needing troubleshooting or replacement we need to remove some restrictions from the device to regain access to certain restricted elements of iOS. Right now this required a subset of our staff to login to the JSS and add a device-based exclusion to the scope of our configuration profile. For our deployment we were looking at ways we could involve more people in device troubleshooting without granting access to the JSS with the plan being developing a support flowchart for each tier of our support.

As an example from our setup, we restrict the app store using Self-Service as our school “App Store”. From time to time we need to allow access to the App Store to agree to new iTunes Terms & Conditions on the device otherwise new applications do not install. This is a relatively simple task that we can delegate. I posted the idea to Twitter and Fred Cox (@FredCox3) shared some of the JSS API resources and idea of adding / removing a device to a group that is scoped as an exclusion to the config profile used for students.

Using that idea and a bunch of testing, I’ve put together an AppleScript (Shock, yes, it is still alive!) that:

  • Asks for a device serial number and confirms the information is correct.
  • Asks to remove or re-apply restrictions to the device.
  • Uses the API to add or remove the device from the scoped exclusion.

I’ve posted the code with directions on my github page

In the future I am hoping to convert this to a standalone OS X App.

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.