Hey Guys, I'm unsure if this is a defect. We have a restricted software setup in our JSS where the installation of OSX 10.11 is blocked for computers that falls under two different smart groups. We see no issues with this. But when a computer was part of these smart group previously and now moved out of the group, the Restricted software should no longer be applicable for the machine. But when the user tries to install OSX 10.11.3 is still says its blocked. Even if I manually exclude the machine from this restricted Software and run a recon it still says its blocked. Any idea what is going on here? Please let me know. Thanks, Ravi

Does anyone have an updated method for disabling or suppressing the Keyboard Setup Assistant in macOS Sierra? The JAMF provided script no longer works (I get an "Operation not permitted" error). We're using third party wired keyboards as Apple removed the ability for resellers to supply wired keyboards with new Macs. Thanks,Dan Jackson (Lead ITServices Technician).Long Road Sixth Form CollegeCambridge, UK.

I’m getting installation errors from the Jamf push and trying to install the pkg manually. The admin machine I created the pkg on and my target laptop are on the same OS 10.14.6. I am using Jamf Admin and Composer 10.11.0. The application I’m trying to package is Cisco Anyconnect VPN with only Umbrella enabled, the rest of the modules are left disabled. Along with a json sheet that needs to be placed in opt/cisco/Anyconnect/umbrella folder for the Umbrella profile. On the target machine I get the same results no matter if a previous version of Cisco anyconnect is already installed or not. I have tried both ways with a direct install, cache first then install, cache then install at start up. I get the same errors each time. I have tried to use different Cisco Anyconnect version. The newest I have is 4.8.02042 and I also tried with 4.5.05030. Again with the same errors. On the target machine the Jamf log is similar to the message in the Jamf portal with a generic error. With

So I assigned a Mac via the Apple School Manager to our Jamf MDM server. In Jamf PreStage Enrollments I now see this newly assigned device. However, when I try to add this Mac to a Static Computer group I cannot see it. Our hope is that as we assign newly arriving Macs via the Apple School Manager they will show up in PreStage Enrollments and then we will add to a Static Group that has all the policies that we want to apply including AD binding. Of note, this newly assigned computer has not run through the setup assistant yet (for the purposes of this discussion let's say it is still in the box and never turned on) What are we doing wrong? Thanks.

Hi all, I'm curious to know if anyone ever successfully configured Outlook 2019/365 with G-Suite Email, Calendar, and Notes? Reason being, I am able to sign in (my institution uses SSO for authentication) which for some odd reason constantly requires me to authenticate repeatedly. I tried 365 support, and got nowhere with this. Hoping someone in the community has had better luck?

I'm having a problem where jobs sent to a printer on a Windows print server show "casperread" as the owner. This happens to be the username for my Casper File Share read only account. If I manually add a printer to a Mac, the owner displays correctly, but if I push the printer out through JAMF, the owner is casperread. I inherited this system and this has probably been going on for years, but it's suddenly a problem now that we're implementing Follow Me Printing from PaperCut. Any ideas why this is happening or where it's coming from? I assume the push from JAMF is somehow associating the read-only user name (used to retrieve the driver package) but I have no idea where that setting would be. JAMFPro 10.13.0MacOS 10.12-10.14Windows Print server 2008 R2

Does anyone have any experience managing the forticlient preferences? I've had success modifying the plist but the values are replaced. The plist is also stored non traditionally and is just called vpn.plist and I'm not sure if I can use a config profile to force it keep the values. On top of this the config profile will show the values being set like server ip, user, and password which I would like to keep hidden for obvious reasons.

Hi Everyone, I am looking to create a custom attribute to display "Citrix Files" version and was able to get the version by typing the following command: "mdls -name kMDItemVersion /Applications/'Citrix Files.app'" Any good documentation on how to display this to a custom attribute? My end goal is to create a smart group to show which computers has older versions of "citrix files"

Hello everyone! We recently deployed 250 iPads to students for distance education with another 600 coming down the pipeline in the next few weeks. As we handed out devices we made note of who picked them up by name / domain email address. Is it possible to convert this to a csv and upload it to JAMF alongside the corresponding device serial numbers? Also: How can we unassign users from an iPad in bulk? Right now our workflow is to click into each individual device, select User and Location on the left sidebar, then remove the 3 populated fields.

When I install an app via Self Service, I like to put a line in the 'Files and Processes' section to open that App after its installed. I was using 'open /Applications/Utilities/thouleapps/MyGreatApp.app' However, That app launches, but can't request admin rights - I suspect because it was no launched by the current GUI user, but launched by Casper. If I quit the app, then launch via double-click, then it works great. I've also tried osascript yada yada with no success. How do you guys open an application for the user via Casper?

I've been trying to adapt our computer naming script to wait for input from the user by cobbling together information fromhere and here and probably a few others, I can't seem to get it to work. I just can't seem to figure out what I'm doing wrong, maybe there's an easier way? Can someone take a crack at it? Original script that works (however if someone's not staring at the screen and they miss the prompts, then the names get messed up) Also, if you can happen to fix the part at the top I commented out that looked at the machine type (laptop/desktop) and automatically puts in the correct type - that would be awesome :). identifying data in script removed due to internal security requirements - but scrubbed version below retains the syntax and just made generic #!/bin/bash set -x # jamf recon loggedInUser=$(stat -f%Su /dev/console) loggedInUID=$(id -u $loggedInUser) if [[ "$loggedInUser" != "root" ]] && [[ "$logge

Hi Guys! I've been reading material, and watching the "Don't Forget Your Bade! | JNUC 2018" video, and I see the speaker did Attribute Mapping with this file: /etc/SmartcardLogin.plist Basically I'm trying to figure out how to get this information below into Jamf to deploy to systems... /usr/sbin/sc_auth identities | awk '/PIV/ {print $1}' | tr '[:upper:]' '[:lower:]' | sed 's/.{8}/& /g' | sed 's/.$//g' /usr/sbin/system_profiler SPSmartCardsDataType | grep -A5 "$hash" | awk '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/ {print; count++; if (count==3) exit}' | fold -w67 > /tmp/temp.pem UPN="$(/usr/bin/openssl asn1parse -i -dump -in /tmp/temp.pem -strparse $(/usr/bin/openssl asn1parse -i -dump -in /tmp/temp.pem | awk -F ':' '/X509v3 Subject Alternative Name/ {getline; print $1}') | awk -F ':' '/UTF8STRING/{print $4}')" /bin/cat > "/etc/SmartcardLogin.plist" << 'Attr_Mapping' <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-/

I'm looking for suggestions or workflows on deploying network profiles before or after our enrollment process. Our setup:• Jamf Cloud• ADCS connector• DEPNotify We don't currently have a provisioning network yet but is in process, so we use dmz/external-facing network connections for enrollment but the network could switch during the enrollment if the profiles deployed during the enrollment or depnotify process and potentially cause an issue. I tried to find a way to trigger the config profile after depnotify but did not see a way to do using smart group criteria. any suggestions or ideas? Thank you!

Tell me if this is silly, but I use one machine (a Mac Pro) as my "master" machine to create packages (pkg and dmg) for use on my labs. This machine is getting a little conjested so I'd like to somehow backup all the items in Composer and move them to either another machine or wipe this machine and reinstall them back down. Am I crazy for having captured these packages this way or is there a way to "move" them? I'd really not like to have to re-package all of these tiny apps.

Hey Guys, We did our Jumpstart last week, and really happy with things thus far. We'd like to now try and do some logins against Active Directory, but are unsure on how to do this. We use on-premises Active Directory with smartcards for our Windows machines. In summary trying to accomplish the following:1) Login to Mac using AD credentials.2) Eventually do this with Smartcards. Any info or direction would help. Thanks!

Is it possible to mount SMB shares on to the dock using Dock items in Version 9.3 ? We have mapped them as a file so smb://URL/Folder but they never apply they're SMB due to our NetApp appliance being SMB only. If not does anyone have a better suggestion on how to do this effectively Thanks

Hi all, I'm looking for a way to find Microsoft Office 2016 application version numbers through terminal. I will be using this in a script to push updates. I'm thinking of having 4 scripts (one for each Office product - excel, word, ppt, outlook), and 4 Policies that have triggers to install each program. Ideally, the script will look for Application versions, if the version found is outdated, it'll trigger the JSS Policy to install the office pkg. Currently, we use smart groups that search for outdated version numbers and sort by departments, and it's a pain to change 50+ smart groups (due to the large amount of departments we have) when a new version comes out. We want to retain the option of doing by deploying by department.

Greetings,I'm trying to populate an EA by reading a string of text from the hidden .identity file (located in /Library/Application Support/CrashPlan) that is created when CrashPlan is installed and configured for a user. From what I can see, the user account that is configured is in the last line of the file. I need to get some of that string in an EA. The string looks something like this: "username=johnsmith@domain.edu". I only need the "johnsmith" part of the text. I believe this can be done using the cat, grep, or sed command(s) but I am not sure where to start. Any help would be much appreciated.

JAMF newbie here. This is my first post ever on JN...yay! Been using Munki for years, changed jobs and now I am becoming a JAMF guy. Ha. Anyway......... Has anyone used the jamf-migrator tool? (https://github.com/jamfprofessionalservices/JamfMigrator) When doing a migration, is the migrated data removed from the source server when it is moved to the destination? Thanks!Scott

I have the macOS Sierra GM installed on a VM and any time I run the command: sudo jamf fixPermissions -verbose I get an error: Fixing Permissions... verbose: Error executing command: ( "/usr/libexec/repair_packages", "--repair", "--standard-pkgs", "--volume", "/" ) I'm currently on JSS 9.96.1472575603.c and running that same command works on 10.11

For JSS 8.x-- Has anyone already developed EA's to collect ethernet adapter MAC addresses? I'm not convinced all my client and support staff are giving me this information so that I can add them to the removable address list.

Has anyone ran into this message before?"PTUpdate wants to make changes. Type your password to allow this"Couldn't find anything via Google for OS X.

Hey All,I have been tasked with creating a smart group to see if an application is installed. The security application is FireEye. FireEye does have an application but it doesnt show in the applications as it is not suppose to. So I was going to create an extension attribute that will check the machine and see if it has the correct FireEye directory which should be /Library/FireEye/xagt/xagt.app . When doing so it does not pick up any machines. This is what I have so far: !/bin/bash ############################################################ A script to collect information on if FireEye is currently installed If FireEye is not installed then "Not Installed" will return back ############################################################ RE$ULT="Not Installed" if [ -f "/Library/FireEye/xagt" ] ; then RE$ULT=$( /bin/defaults read "/Library/FireEye/xagt/xagt.app/Contents/info.plist" CFBundleName)fi echo "<result>$RE$ULT</result>"

I am sure there are other methods to uninstall Symantec Anti-virus from a mac via Casper Policy, but this one works for my environment. I just thought I would share. On your source computer (by source computer, I mean the computer that you use to build all your scripts/pkgs/dmgs)1. Download the Symantec Removal Tool from Symantec. OLD LINK[ftp://ftp.symantec.com/misc/tools/mactools/RemoveSymantecMacFiles.zip](ftp://ftp.symantec.com/misc/tools/mactools/RemoveSymantecMacFiles.zip) Extract the "SymantecRemovalTool.command" file and save it into a folder where you might keep all your scripts on the local computer. In my environment - All my computers have a folder called JAMF-CustomApps within /Library/Application Support/ NOTE: The file cannot be changed to a .sh script, when I tried I got errors. Now open Composer and drag 'n drop the "SymantecRemovalTool.command" from /Library/Application Support/JAMF-CustomApps/ into Composer window. Now create a PKG file with Composer, calle

Just wondering that for how long the cached package is going to stay in Waiting Room folder. Does it get deleted right after the cached package installation or it stays forever until we run a query to delete all cached packages from the client macs.