Mobile Device Management

[Frank Garufi Jr.]

I'm currently running into an issue with Mobile Device Management in Lion Server with remotely managing the new 30 unit iPad cart our school just purchased. 

I'm able to attached the iPad's to the MDM server and the profile applies just fine. But I'm able to easily REMOVE the profile(s) from the iPad without the need for a password, even though I've configured one. 

Three profiles get applied. 1) The organization profile 2nd) The Remote Management profile 3rd) the iPad specific settings I've set. 

The 3rd profile has a password set so that removal requires me entering the password. But I'm able to remove profile 1 and 2 WITHOUT the need for a password and then profile 3 automatically removes along with it. 

Has anyone else run into this issue? According to Apple Care, this is by design. Maybe it is, but it seems like a HUGE design flaw in my opinion. 

[Troy Reynolds]

From my understanding, you can set up the device management system so that if the profiles are deleted then any internet access is deleted and the iPads don't right quite as they should. I think that this is done so that the devices can be monitored if students decide to try and change any of the setting on the device. It's not a perfect system, but then again, they weren't necessarily designed to be used in a cart system. We are running the same type of set up in our district. We have four mobile carts but we can't get our Lion Server up and running so we are trying to manage them as well as we can. We have the teachers assign the students with specific numbers, like checking out a book, and the student is always responsible for that particular iPad if anything is changed or damaged. The only way it works is if all staff are on board, and we have about 75% of the staff following the protocol.

[Smith, Jeffrey R]

We're using an mdm setup from Absolute software. We have about 500 ipads deployed between carts, 1:1 and staff. I built a policy that when it detects that one of profiles are removed, the ipad is locked down. The app store is gone as well as safari and mail. So when the student comes to me and says "my ipad doesn't work" my first question is "why did you delete X profile?"



Troy Reynolds said:

From my understanding, you can set up the device management system so that if the profiles are deleted then any internet access is deleted and the iPads don't right quite as they should. I think that this is done so that the devices can be monitored if students decide to try and change any of the setting on the device. It's not a perfect system, but then again, they weren't necessarily designed to be used in a cart system. We are running the same type of set up in our district. We have four mobile carts but we can't get our Lion Server up and running so we are trying to manage them as well as we can. We have the teachers assign the students with specific numbers, like checking out a book, and the student is always responsible for that particular iPad if anything is changed or damaged. The only way it works is if all staff are on board, and we have about 75% of the staff following the protocol.