Issue Description
Insights/Compliance Baselines are additional status updates that Jamf Protect can collect from computers and report to administrators. When enabled, an insight monitors a specific setting and displays a compliance status for the computer in relation to the insight (for example, screen sharing being enabled).
This article provides resources and troubleshooting steps to assist with insight/compliance baseline issues, which can be complex due to the broad range of settings monitored by insights, diversity in how these settings can be configured, and the tendency for insight-related issues to involve multiple insights.
Troubleshooting Steps
Identify the specific Insight that is not appearing as compliant. Most of the time, when this happens, it is because the setting has been identified as "compliant" when checked via the macOS GUI, but is not compliant in Jamf Protect.
Identify the setting that Insight checks locally to determine compliance.
Check for the current insight setting on the computer and remediate. These steps will differ depending on if it is set in a plist or not.
PLIST Settings
If the setting can be set in a plist, check it manually on the device. There is a hierarchy to be aware of when checking local settings manually. The following can serve as a guide, from Highest priority to Lowest priority:
/Library/Managed Preferences/<username>/`enforced`.plist
/Library/Managed Preferences/`enforced`.plist
~/Library/Preferences/ByHost/`local`.<host-id>.plist (current user/current host)
~/Library/Preferences/`local`.plist (current user/any host)
/Library/Preferences/`local`.plist (any user/any host)
On a practical level, it is often very useful to figure out how the setting is being applied locally by running a couple of defaults read commands:
Check for computer level configuration profile:
defaults read /Library/Managed\ Preferences/com.example.plist
Check for user level configuration profile:
defaults read /Library/Managed\ Preferences/$USER/com.example.plist
Check for computer level locally configured settings: /Library/Preferences/com.example.plist
Check for user level locally configured settings:
~/Library/Preferences/com.example.plist
To get the device compliant, if possible, enable/disable the setting via configuration profile using MDM.
A lot of times, the solution comes down to deploying the desired settings via a configuration profile. This has a few key benefits:
Settings deployed via configuration profile (most often) cannot be overruled locally.
Jamf Protect gives priority to settings applied via configuration profile, so this is a good solution when the objective is simply to achieve compliance status.
NON-PLIST Settings
All of the above will work for ~85% of Insights, but there are a few that are not configured via PLIST. Reference the CIS Benchmarks PDF, as it includes both ways to check those settings locally and remediate locally.
The most common is passcode policy insights. To check for passcode policy insight settings run:
Get User Level settings: pwpolicy getaccountpolicies -u $USER
Get computer level settings: pwpolicy getaccountpolicies
Notes:
Just like with PLISTs, the User-Level settings take priority here, so make sure to run this command with the user that is logged in when receiving the non-compliant status.
Passcode policy configuration profiles do not write to /Library/Managed Preferences/! This may be the only preference domain that behaves this way.
Updating Your Compliance Baselines
Force the computer to check in and update compliance baselines by running the command below in Terminal on the computer with Jamf Protect installed that we want to update:
sudo /usr/local/bin/protectctl checkin --insights
More Resources
Download the PDF, which includes all CIS benchmarks.
Jamf Protect Documentation: