So, I have 2 .mobileconfig files I wish to deploy, one is for the dock that I created and another to change the Desktop Wallpaper, how will i upload these to casper and deploy them through configuration profiles? Only need to go to 15 machines but want to get them pushed out asap! Any ideas? ThanksSimon

I'm extremely new to Jamf, mostly dabbling where other people have already set up the environment. We were working on setting up the pre-stage enrollment for our DEP iPads. DEP is working, the LDAP SSL connector is working, but when we get to the Remote Management authentication screen on the iPad, is it not accepting some people's credentials. The error message is "Your credentials are either missing or wrong. Try again." I've tried logging in with both the format of username, and username@email.com. I've tried resetting/recovering the iPad by connecting it to a computer. Using me as an example, on any iPad I try to enroll with the pre-stage authentication with my credentials, I get the error. But on the same iPad, someone else is able to authenticate properly and have it register. In the Jamf console, the only way to see the device is under the "Automated Device Enrollment" section in Global Management. It has not yet been assigned a name, and does not appear under devices.

I start the getting the SCEP configuration profile to work within ourenvironment now. But I think it requires variable to generate thecertificate the way we want it. It seems to be a lack of info regards variables to automate this.For example:If I put the below in SubjectCN=%AD_ComputerID%.mydomain.com I get computername$.mydomain.com (in my case Mac called air, so I getair$.mydomain.com) in the certs Common Name section. Also if I put the below in Subject Alternative Name Valuehost/%AD_ComputerID%.mydomain.com I get host/computername$.mydomain.com (in my case Mac called air, so I gethost/air$.mydomain.com) in the DNS name section of the cert But I would like to get the name without $ sign at the end. Is there a variable for SCEP configurationprofile payload toachieve this? I hope I have explained it correctly. I know jSS uses variables with exchange config profile like $USERNAME and$EMAIL (screen grab). So I am hoping that maybe there is a variable to getthe Mac hostname? I have

Can someone explain why I can have some machines get this error and not others? I have a lab where the policy I use to deploy and update Firefox failed on almost the whole lab except for a system or two. Those that failed had this error in the logs. I then used Casper Remote to try updating the same lab and all but one machine worked fine. The one that failed gave the same error message. I pasted the full log below. Sending Wake On LAN command...Opening SSH Connection to 10.2.6.37...Authenticating...Successfully authenticated.Verifying Computer's Identity...The MAC Address has been verified.Checking Operating System Version...Running Mac OS X 10.10.5 (14F1713)Verifying /usr/local/jamf/bin/jamf.../usr/local/jamf/bin/jamf is current (9.82)Verifying /usr/sbin/jamf.../usr/sbin/jamf does not exist.Verifying /Library/Preferences/com.jamfsoftware.jamf.plist...Preparing Policy...Downloading https://mdm.parkland.edu/caspershare/Packages/Firefox-45.0.2.pkg...Downloading https://mdm.parkl

Office 2016 and 2019 both use the same 16.X.X versioning right now, so my previous Office 2016 Installed smart group includes both Office 2016 and 2019. This didn't really matter before since I was only putting 2019 on completely new machines on 10.14. Now that we're prepping for wider deployment, I need to be able to track which machines have Office 2016 and 2019 separately. Is there a good way to build a smart group that includes only Office 2019 installs?

I have about 35 Macs in a old Jamf cloud and will be moving them to a new Jamf cloud. I have access to both and wanted to see if I could write a script to unenroll them and then reenroll them info the new Jamf. Majority of them are not DEP only 3 are in DEP. I thought I could have a script remove the MDM profile and jamf framework. Then do a enrollment through the shell with a enrollment only account. Thoughts about if this will work or not.

Hello, First of all, I am new to JAMF and I'm learning as I go and I hope I am able to describe this correctly.I created a DMG from a software cd in Disk Utility and uploaded it into Casper Admin. I went into Self Service and created a new policy for this program. Initially I wanted it to be installed a start up so I didn't have to touch 20 computers and I couldn't get it to work. Do I need a script for that? Next, I just made it available in Self Service and downloaded it manually from there. It completes and everything is there and it works, but it doesn't get installed into the computers Application folder. I uploaded an image to describe what I'm talking about. It gets put just outside the Applications folder.eAny help? This isn't the first time this has happened to me either. It's done it for an Epson driver, Exam4, VLC, Scratch. Is it because I'm not doing a snapshot? I thought if the installer was a .dmg I didn't need to take a snapshot. Thank you,Nicholas

I know this has been asked about a thousand times, but I wanted to try asking to see if there is info out there that I don't have. I SPECIFICALLY would like to get chrome on mac to say "Updates are disabled by your administrator." I do not want it to error out, or anything weird like that. I want to know if there is a definitive way on Mac to mimic what I am able to do with Chrome on windows. I get this on Windows with 1 registry key. I would LOVE to see this exact message on Mac devices. Thanks,Tim

Hi Everyone, What is the best way to update a Computer's Building, Room, and Department? I have some prompts that I used to select/enter in the information, so I have the variables ready. But I am not sure how to update those fields. Is it the Computer endpoint being updated, or is it using the Building/Room/Department as the endpoint? Thanks for any help you can provide!

We have quite a few AD Domain controllers. I recently was investigating logon delays so one thing I was looking at was whether all the Domain Controllers could be reached. Each of the following in terminal returned the same list of servers from DNS: host -t SRV _ldap._tcp.my.domain.namehost -t SRV _kerberos._tcp.my.domain.namehost -t SRV _kpasswd._tcp.my.domain.namehost -t SRV _gc._tcp.my.domain.name I then attempted to connect to each of the machines using telnet to each of the ports for ldap, kerberos, kpasswd and gc - 389, 88, 464 and 3268The results quite quickly showed that something was blocking access to some Domain Controllers (DC's) on the subnet I was trying to sort out. Even though the DC's could be pinged. Our friendly Firewall Guy helped and found that 3 of the 9 DC's were not in the rule allowing access. What I am wondering is whether anyone has worked out a way to automate this sort of check - see if each of the DC's listed in DNS is responding

I am struggling to use this EA to determine if there is an iLock on the computer. I can run a command similar to this in ARD but that does not help me as I want to create a Smart Group scoped to iLocks installed.

Hello,I want deploy "Microsoft Teams" app to our mac clients. But i could not success.. Could someone help to me about this ?the app can deploy if i request from self service. But otherwise i could not deploy remotely to client mac computers.I added 3 picture.3rd picture about = I installed from self service. 62 computers just holding on "pending"... How can i deploy to them ( not using self service ) Thank you.

For several years we've been using script to scan Macs and submit hardware and software info into our ServiceDesk Inventory. It works fine on MacOS 10.10 to 10.14, but fails in 10.15. Here is a log: Running script Service Desk Express Inventory... Script exit code: 1 Script result: ##### Scanning Started ##### /Library/Application Support/JAMF/tmp/Service Desk Express Inventory: line 21: SPE-R23-MT.xml: Read-only file system /Library/Application Support/JAMF/tmp/Service Desk Express Inventory: line 62: SPE-R23-MT.xml: Read-only file system /Library/Application Support/JAMF/tmp/Service Desk Express Inventory: line 63: SPE-R23-MT.xml: Read-only file system Error running script: return code was 1. I think it's due to system volume being read-only in Catalina. Please help to modify the script to change the location of OUTPUTFILE.I contacted ServiceDesk support, but they have no clue.Here is the entire script: #!/bin/sh ############ Server details ############ h

Looking for an EA that can distinguish between Firefox (mainline) and Firefox ESR. Google Chrome provides a key that tells you if user has Google Chrome installed or Google Chrome For Work installed. Located in /Applications/Google Chrome.app/Contents/Info.plist: We know ESR has its own release cycle, and unique versioning philosophy. But there doesn't seem to be a difference in Info.plist. I plan to submit a feature request, to ask for a key to be used, similar to what Google is doing. In the mean time, wondered how folks here telling whether user has Firefox ESR or not? PS, already have EA to tell if config files are in the Firefox.app bundle, but that won't help us if someone is running mainline release with config files. Don

hi to all... banging my head on this... Netsus was working fine with all computers from 10.12 to 10.14. Now with 10.15, with HTTP catalog address not finding any updates... So decided to change to HTTPS. Now message on 10.15 Macs while looking for my Netsus server saying that certificate to access the server is not valid. So I guess because the certificat by default on NETsus is self signed and not secure. So trying to create another on through GUI on Netsus webadmin console.... BANG... nothing works... having difficulties to create it. Ik have all the parts but at the end the console gives me the error : Chain verify error 18 at 0 depth lookup:self signed certificate. 1- anybody with a solution without changing the cert in Netsus ?2- anybody with detailed instruction for the Netsus cert replacement ? anything else ?

I've been running into an issue with our DEP computers where when we unbox a brand new computer that is enrolled in DEP, it won't display the DEP/MDM screen during the initial account setup. I was able to determine the issue and have taken the steps to resolve it (if you're interested in the cause and resolution, let me know) but the only way to fix the issue for some of the computers is to run an internet restore (possibly a local restore). Anyway, my question is this... Once the initial setup of a computer gets completed, a file is written to the drive to bypass the setup screen for all future startups. /var/db/.AppleSetupDone Is there a similar file for the DEP/MDM screen that appears in the Account Setup process? Thanks for any help that can be provided! Ross

Now that the schedules tab is removed from Outlook's preferences... has anyone figure out a way to apply a self configuration script like this one? https://github.com/talkingmoose/Outlook-Exchange-Setup Our users really enjoyed everything being automagically configured.

@talkingmoose Hope you're doing well! Pardon the intrusion for including you directly on this discussion from the get go…wondering if you can help or point me on the right direction with the following: Our Outlook account profiles are currently setup using an e-mail address format = jsmith@testco.com (1st initial + last name) We will soon be changing users e-mail addresses with the first name.last name format, john.smith@testco.com. what would be the best non-manual process to change the Outlook account profile information on the E-mail address field… From: jsmith@testco.com To: john.smith@testco.com Thank you for your input. If anyone else has gone through the same process and has implemented a solution, I would too appreciate your input. Thank you.

I'm getting ready for the first year that I'm not doing re-imaging. I've deleted our old student / mobile accounts, so the computers are a clean slate. All I want to do is run updates on each of our laptop carts. But I can't. At least, not through Jamf. If I view the computer list, then select to Send Remote Command, then Update OS, I get "The remote command failed to send." If I click on the computer, then go to Management, the buttons to Update OS are missing. This appears to be affecting all my computers. All the computers are enrolled, managed, etc. I tried re-enrolling the computer, but to no affect. Any suggestions?

I don't want to install every PPPC & System Extensions profile on every machine for all apps that need them. I work for a large organization and with the number of apps we have, doing that just seems messy. What I am considering is having a Smart Group configured for every app and scoping the individual config profiles to its respective smart group. Perhaps I am overthinking this (which is not unheard of), but I am curious to know what other people are doing to control adding PPPC & System Extensions config profiles to endpoints.

I am just starting to use DEP in our environment and I need a good test setup. Right now I have one mac that our vendor setup for me to go into our DEP environment. After I enroll this test device do I have to wipe it clean before re-enrolling an testing? I want to test polices, preferences, self-service etc.. and to keep testing until its ready for production. How do you do it? Thanks

Hey folks,We're looking for a way to populate as many fields in JAMF using our OKTA-LDAP integration (already set up). Currently we're populating the email, username and full name fields.1. Is there a place that lists the values that need to be filled out in the JAMF LDAP Mappings?2. Is there a 3rd party application, or any utility that can enable more advanced capabilities of the LDAP integration? Appreciate whatever thoughts can be given on this.

Im trying to figure out a way to disable Content Caching from computers enrolled in our JAMF instance but there's no obvious way to do that in JAMF. The Content Caching tab doesnt seem to have a feature to "Disable" only ways to manage the content caching. I want it OFF. Any help would be most appreciate, this is driving me crazy.

Is there a way to allow a FV approved user to unlock the disk but NOT automatically log them in using their AD Credentials? the reason I ask is because i have some of our MBP configured so that the login credentials supplied at login page are used to initiate the wireless connection and THEN sign them in with their AD credentials , however FV just logs them in and therefore they are not connected to the wireless and then have to initiate the connection or else they have to then log out and sign in to connect the wireless then the AD logon. how can i get the users to unlock the disk but NOT log them into the OS ?

We have an in house application that runs via a LaunchAgent that we are looking to deploy. I've successfully packaged up the app along with the plist for the agent, and ensure permissions are correct on everything. The preinstall script is set to check if the service is running under either the current user (via a defined variable) or under root (which it shouldnt be so this is a safety check) and if either is found to unload the plist as the necessary user (sudo -u $CurrentUser launchctl unload or sudo launchctl unload). The postinstall script is set to then reload the agent plist as the current user (sudo -u $CurrentUser launchctl load). Similarly I have an uninstall script that is basically the same as the preinstall script but with the addition of a few rm lines to delete the installed payload. Both the installer and the uninstaller work fine when run locally on the Mac. As soon as they are put into the Casper and run, the load/unload commands all seem to fail statin