We have quite a few AD Domain controllers. I recently was investigating logon delays so one thing I was looking at was whether all the Domain Controllers could be reached. Each of the following in terminal returned the same list of servers from DNS: host -t SRV _ldap._tcp.my.domain.namehost -t SRV _kerberos._tcp.my.domain.namehost -t SRV _kpasswd._tcp.my.domain.namehost -t SRV _gc._tcp.my.domain.name I then attempted to connect to each of the machines using telnet to each of the ports for ldap, kerberos, kpasswd and gc - 389, 88, 464 and 3268The results quite quickly showed that something was blocking access to some Domain Controllers (DC's) on the subnet I was trying to sort out. Even though the DC's could be pinged. Our friendly Firewall Guy helped and found that 3 of the 9 DC's were not in the rule allowing access. What I am wondering is whether anyone has worked out a way to automate this sort of check - see if each of the DC's listed in DNS is responding

I am struggling to use this EA to determine if there is an iLock on the computer. I can run a command similar to this in ARD but that does not help me as I want to create a Smart Group scoped to iLocks installed.

Hello,I want deploy "Microsoft Teams" app to our mac clients. But i could not success.. Could someone help to me about this ?the app can deploy if i request from self service. But otherwise i could not deploy remotely to client mac computers.I added 3 picture.3rd picture about = I installed from self service. 62 computers just holding on "pending"... How can i deploy to them ( not using self service ) Thank you.

For several years we've been using script to scan Macs and submit hardware and software info into our ServiceDesk Inventory. It works fine on MacOS 10.10 to 10.14, but fails in 10.15. Here is a log: Running script Service Desk Express Inventory... Script exit code: 1 Script result: ##### Scanning Started ##### /Library/Application Support/JAMF/tmp/Service Desk Express Inventory: line 21: SPE-R23-MT.xml: Read-only file system /Library/Application Support/JAMF/tmp/Service Desk Express Inventory: line 62: SPE-R23-MT.xml: Read-only file system /Library/Application Support/JAMF/tmp/Service Desk Express Inventory: line 63: SPE-R23-MT.xml: Read-only file system Error running script: return code was 1. I think it's due to system volume being read-only in Catalina. Please help to modify the script to change the location of OUTPUTFILE.I contacted ServiceDesk support, but they have no clue.Here is the entire script: #!/bin/sh ############ Server details ############ h

Looking for an EA that can distinguish between Firefox (mainline) and Firefox ESR. Google Chrome provides a key that tells you if user has Google Chrome installed or Google Chrome For Work installed. Located in /Applications/Google Chrome.app/Contents/Info.plist: We know ESR has its own release cycle, and unique versioning philosophy. But there doesn't seem to be a difference in Info.plist. I plan to submit a feature request, to ask for a key to be used, similar to what Google is doing. In the mean time, wondered how folks here telling whether user has Firefox ESR or not? PS, already have EA to tell if config files are in the Firefox.app bundle, but that won't help us if someone is running mainline release with config files. Don

hi to all... banging my head on this... Netsus was working fine with all computers from 10.12 to 10.14. Now with 10.15, with HTTP catalog address not finding any updates... So decided to change to HTTPS. Now message on 10.15 Macs while looking for my Netsus server saying that certificate to access the server is not valid. So I guess because the certificat by default on NETsus is self signed and not secure. So trying to create another on through GUI on Netsus webadmin console.... BANG... nothing works... having difficulties to create it. Ik have all the parts but at the end the console gives me the error : Chain verify error 18 at 0 depth lookup:self signed certificate. 1- anybody with a solution without changing the cert in Netsus ?2- anybody with detailed instruction for the Netsus cert replacement ? anything else ?

I've been running into an issue with our DEP computers where when we unbox a brand new computer that is enrolled in DEP, it won't display the DEP/MDM screen during the initial account setup. I was able to determine the issue and have taken the steps to resolve it (if you're interested in the cause and resolution, let me know) but the only way to fix the issue for some of the computers is to run an internet restore (possibly a local restore). Anyway, my question is this... Once the initial setup of a computer gets completed, a file is written to the drive to bypass the setup screen for all future startups. /var/db/.AppleSetupDone Is there a similar file for the DEP/MDM screen that appears in the Account Setup process? Thanks for any help that can be provided! Ross

Now that the schedules tab is removed from Outlook's preferences... has anyone figure out a way to apply a self configuration script like this one? https://github.com/talkingmoose/Outlook-Exchange-Setup Our users really enjoyed everything being automagically configured.

@talkingmoose Hope you're doing well! Pardon the intrusion for including you directly on this discussion from the get go…wondering if you can help or point me on the right direction with the following: Our Outlook account profiles are currently setup using an e-mail address format = jsmith@testco.com (1st initial + last name) We will soon be changing users e-mail addresses with the first name.last name format, john.smith@testco.com. what would be the best non-manual process to change the Outlook account profile information on the E-mail address field… From: jsmith@testco.com To: john.smith@testco.com Thank you for your input. If anyone else has gone through the same process and has implemented a solution, I would too appreciate your input. Thank you.

I'm getting ready for the first year that I'm not doing re-imaging. I've deleted our old student / mobile accounts, so the computers are a clean slate. All I want to do is run updates on each of our laptop carts. But I can't. At least, not through Jamf. If I view the computer list, then select to Send Remote Command, then Update OS, I get "The remote command failed to send." If I click on the computer, then go to Management, the buttons to Update OS are missing. This appears to be affecting all my computers. All the computers are enrolled, managed, etc. I tried re-enrolling the computer, but to no affect. Any suggestions?

I don't want to install every PPPC & System Extensions profile on every machine for all apps that need them. I work for a large organization and with the number of apps we have, doing that just seems messy. What I am considering is having a Smart Group configured for every app and scoping the individual config profiles to its respective smart group. Perhaps I am overthinking this (which is not unheard of), but I am curious to know what other people are doing to control adding PPPC & System Extensions config profiles to endpoints.

I am just starting to use DEP in our environment and I need a good test setup. Right now I have one mac that our vendor setup for me to go into our DEP environment. After I enroll this test device do I have to wipe it clean before re-enrolling an testing? I want to test polices, preferences, self-service etc.. and to keep testing until its ready for production. How do you do it? Thanks

Hey folks,We're looking for a way to populate as many fields in JAMF using our OKTA-LDAP integration (already set up). Currently we're populating the email, username and full name fields.1. Is there a place that lists the values that need to be filled out in the JAMF LDAP Mappings?2. Is there a 3rd party application, or any utility that can enable more advanced capabilities of the LDAP integration? Appreciate whatever thoughts can be given on this.

Im trying to figure out a way to disable Content Caching from computers enrolled in our JAMF instance but there's no obvious way to do that in JAMF. The Content Caching tab doesnt seem to have a feature to "Disable" only ways to manage the content caching. I want it OFF. Any help would be most appreciate, this is driving me crazy.

Is there a way to allow a FV approved user to unlock the disk but NOT automatically log them in using their AD Credentials? the reason I ask is because i have some of our MBP configured so that the login credentials supplied at login page are used to initiate the wireless connection and THEN sign them in with their AD credentials , however FV just logs them in and therefore they are not connected to the wireless and then have to initiate the connection or else they have to then log out and sign in to connect the wireless then the AD logon. how can i get the users to unlock the disk but NOT log them into the OS ?

We have an in house application that runs via a LaunchAgent that we are looking to deploy. I've successfully packaged up the app along with the plist for the agent, and ensure permissions are correct on everything. The preinstall script is set to check if the service is running under either the current user (via a defined variable) or under root (which it shouldnt be so this is a safety check) and if either is found to unload the plist as the necessary user (sudo -u $CurrentUser launchctl unload or sudo launchctl unload). The postinstall script is set to then reload the agent plist as the current user (sudo -u $CurrentUser launchctl load). Similarly I have an uninstall script that is basically the same as the preinstall script but with the addition of a few rm lines to delete the installed payload. Both the installer and the uninstaller work fine when run locally on the Mac. As soon as they are put into the Casper and run, the load/unload commands all seem to fail statin

I am looking for a way to query the API for the username of the Mac's assigned user in Jamf Pro.

Does anyone have any idea how to disable the "Office Intelligence Services" checkbox in the Office apps "Privacy" preference? I was able to do so for the Diagnostic Data checkbox. Thanks, -- M

Hi all, Somewhat silly question, but I'll ask it here anyway. Within our JAMF Pro, we have may policies that are check-in daily to see if a process is running. Eg: McAfee. Because they are daily checks, there would be thousands of logs generated because we manage thousands of Macbooks. Is there a way to clean up these logs entry so that it keeps only entries for the last month or so? When going into a policy, there is only Flush All or Flush All Errors. I don't particularly want to Flush All, I do want to wait for a few days before seeing a logs populating again. Thanks in advance.

I'm attempting to purge all of my deprecated updates from our NetSUS server (just upgraded to 3.0.2). Navigating to /var/lib/reposado and executing the following: repoutil --purge-product all-deprecated I get: repoutil: command not found I can see the command listed in the directory. I've tried running as root as well. Thoughts?

Is there a way to collect System Report information through Casper? Our MBAs are getting to the age where the batteries are starting to fail and are showing Service Battery under the battery health info. Even when asked to inform me when this issue surfaces, many of our students will ignore my emails. AppleCare on these computers will be ending soon and I want to get new batteries in the ones that need them, without having to touch each computer. I would like to be able to set up a smart group where the computer will enter if the Service Battery condition is present. Thanks.

Good day, I have been out of the loop for a while when it comes to Apple management. I'm trying to grok Apple Business Manager... I had a discussion with a former associate who said that you can upload your older machine serial numbers via CSV to ABM in order to add them. From my testing, this does not seem to be the case. Upon import, I recieve the following error "INVALID INPUT" Can someone please set me straight on this... can I or can I not retroactively add devices to ABM that were not originally purchased with DEP/ABM? Thanks,Ken

Looking to stop check in for one machine for a few days/week. Is this possible? Im not sure where to start this

I have a fairly simple package that I created with Composer to install a VPN configuration profile and some additional settings that can't be done with the profile. I'm doing this for machines that aren't managed but I'd like to get this working to sign QuickAdd packages too. We are at a University and I have a Developer account in a Team subscription. When I use the certificate I created and installed into my KeyChain, I get an error message when I try and create a Package: productsign: error: Could not find appropriate signing identity for “Apple Development: David London ... . An installer signing identity (not an application signing identity) is required for signing flat-style products. I can't see an Installer signing Identity when I look at the choices in Apple Developer - Application signing. Is there possibly some other level other than just a Developer that gives me more than these three options? Apple DevelopmentSign development versions of your iOS, macOS, tvOS, and w

I started leveraging JAMF to patch Zoom.us which is working great so far. It installs in /Applications, but I am finding many users have it installed in their ~/Applications folder, leaving the older version in place. I need to remove it from their ~/Applications, but running into challenges. I am new at bash, but I tried running the script rm -rf ~/Applications/zoom.us.app , but it's not pulling it from logged in user's directory. I tried, sudo -u $(ls -l /dev/console | awk '{print $3}') rm -rf ~/Applications/zoom.us.app , but these are standard users and getting permission denied messages. Our mac's are not shared so doing it in currently logged in or all users' ~/Applications directories are fine. Any help is appreciated, thanks.