agent's jamf search matched the wrong laptop: serial vs asset tag collision

TL;DR

Serial numbers and asset tags live in different fields and can collide as strings, so search the exact field and confirm a second identifier. Query by serial number explicitly, show the asset tag and assigned user for confirmation, and require both to agree before wipe, lock, or push.

Steps

1. Change device lookup to query the serial number field specifically, not a free-text search. Expected: Results match on serial only.

2. Display the returned device's serial, asset tag, and assigned user together. Expected: The operator or agent sees all three identifiers.

3. Require the ticket's expected user or asset tag to match the returned record before acting. Expected: Mismatches abort the action.

4. Log all three identifiers with every remote command. Expected: The audit names the exact device targeted.

When to use

• The agent sends remote lock, wipe, or push commands via Jamf
• Asset tags and serials are both used as lookup keys
• A command once hit the wrong machine

When not to use

• Lookups are by Jamf's internal id from a prior verified step
• The agent only reads inventory, never acts
• A human confirms the device before each command

Why this happens

Free-text device search matches across serial, asset tag, hostname, and username, so a short asset tag can easily match part of a serial number. Remote actions do not ask twice, which turns a search ambiguity into a wipe of the wrong laptop.

Edge cases

• Reimaged machines can carry a new serial in Jamf while the asset tag stays, splitting the identity.
• Barcodes scanned from stickers sometimes include prefix characters that break exact matching.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst0L5Ml07DiPGydHl63wzPA