I want to run a bash script that uses osascript display dialog to prompt the current user for with 3 options. Base on the user's choice I want the script to call on custom triggers I have set for jamf policies. Unfortunately, it doesn't execute the jamf -event command without an admin password. I looked into jamfhelper yet I need 3 button option. Is there a different approach I can use or would I need change the script? #!/bin/sh /usr/bin/osascript <<-EndOfScript tell application "Finder" activate display dialog "In order for the workflow to complete, please indicate who this device is being prepared for." buttons {"Red", "Blue", "Orange"} with icon stop with title "Important!" if button returned of result = "Red" then do shell script "/usr/local/bin/jamf policy -event redpolicy" else if button returned of result = "Blue" then do shell script "/usr/local/bin/jamf policy -event redpolicy; /usr/local/bin/jamf policy -event bluepolicy" else if butt

I have a working Mojave installer (verified by airdropping to the target devices and opening it) that becomes 'damaged' when packaged via Composer and pushed via JAMF. After packaging and deploying attempting to open the installer app from Applications results in "This copy of the install macOS Mojave application is damaged and can't be used to install macOS." error. The checksum on the installer is identical regardless of the method of transfer and is the same on my device and the target device. Does anyone have any idea what is causing the 'damage'?

Hello together, we just scoped a configuration profile to some Macs to grey out some tabs in the system preferences including profiles tab. To remove the configuration profile temporary we can go to configuration profiles and put the computer name in the exclusion tab (scope). This works most of the times, but not every time and it is a bit tedious. So I tried to remove the profile via terminal with the following command: sudo profiles -R -p 'identifier' But this does not work. I get the error message 101 - this profile couldn't get removed. Probably because I greyed out the profiles tab? So my question: Is there a way to delete the profile temporary via terminal?Would it be better not to grey out the profiles tab? But could the users not just remove the profiles by themselves? Maybe anyone has a completely different path? Best regardsMaurice

We are seeing several users with calendar item being off by one hour. I'm assuming this is being affected by the daylight savings time coming up. Majority of the users are not seeing this issue. Anyone noticed this happening in their environment? We have location services turned on with set dat and time automatically to apple's time server. Set time zone automatically using current location is enabled as well.

Hi All, I'm creating a button in Self Service that, once pressed it will remove certain files/folders. with the rm and rm -r (for folders) commands. This works as expected. However, if the folders are already removed and users would press that button again, then Self Service shows an error (obviously because it couldn't execute the command as there was nothing to delete). I'm not a huge terminal command guru, so could any of you clever clogs improve my 'script' so it never shows an error and stop my users from reporting "Self service is showing an error when I press the button"? I'm sure it is an easy fix...

I'm looking to create a policy that will combined multiple patch management policies to happen at the same time to create a better user experience. My current set up is that these individual policies are available in Self Service and have a trigger. Some of these policies require a reboot, and others do not. So the script will check the version of the various software and then if it is not the required version it will run the trigger. If I do #!/bin/sh jamf policy -trigger bluejeans jamf policy -trigger office jamf policy -trigger globalprotect jamf policy -trigger applesoftwareupdates and both the globalprotect and applesoftwareupdates policies require reboot. Is there way I can run all these policies and only reboot once without having to create separate policies for the triggers that do not reboot?

A policy and package (slack application) I had deployed through Self-Service for macOS users to install has been deleted but it still appears in the self service app. I have deleted both the policy and package from Jamf Pro (10.16.1) but it is still coming up after a few weeks. Any ideas?

I cannot seem to get tvOS apps to install. It appears to only be affecting Apple TV's, iPads are getting apps just fine. We are using Apple School Manager. All of our certificates are up-to-date. There are also enough available copies of the apps to be installed. JAMF is also up-to-date. All of our Apple TV's are the latest version on tvOS. The Apps they are trying to install (Netflix for example) are the most recent version showing in JAMF. Once a command is sent to install the app, it immediately returns an error of "The MDM request is invalid."

Was fighting a script that worked perfectly in our test environment but kept failing in production. Figured someone made a mistake copying and pasting the script, but that was not the case. The scripts were identical. Then only difference was the display name. In PRD, the display name for the script was changed to include a site prefix for a site that uses a "/" in its name. it's two diff departments that recently merged, so the site is named DeptA/DeptB. For POLICY names, this prefix has never a problem, but it appears that the presence of the "/" character will break script execution. Once we removed the "/" from the Display name of the script in production, it immediately started working properly whether called from Self Service or any other trigger. so the question is "why?" I thought all objects in the database were assigned a ID number--that the "Display Name" is just for the web front end....there's nothing

Almost every recipe gives this after I updated the components. Any ideas?

Has anyone figured out an automated way to add apps to the System Preferences -> Security & Privacy -> Privacy -> Accessibility section in Mojave to allow them to control the computer? We use Bomgar in my environment for remote support, and are running into a less than ideal interaction with Mojave. Users are prompted to allow the Bomgar app to control the computer, but users can only do that if they have administrative privileges, which not many people have in my environment. I contacted Bomgar about this, and they said it's expected due to security changes Apple made and there's no way around this with their software. I contacted Jamf as well and they told me they were unaware of a way to add an app to this section automatically. I've tried and it does not appear I can grant users the ability to modify this section of System Preferences if they don't have admin privileges, like I can other sections. I'm hoping someone else may have ideas on this.

We've been using the following trigger in a LaunchDaemon to spawn a script that disables Wifi: <key>WatchPaths</key> <array> <string>/Library/Preferences/SystemConfiguration</string> </array> <key>RunAtLoad</key> This has been working fine, but I've recently noticed in '/var/log/system.log' that the LaunchDaemon is being spawned multiple times in bursts every ~30 seconds: Oct 31 16:19:56 --- last message repeated 2 times --- Oct 31 16:19:56 MALKiosk-22462 com.apple.xpc.launchd[1] (com.mycompany.disable_wifi): Service only ran for 0 seconds. Pushing respawn out by 10 seconds. Oct 31 16:20:27 --- last message repeated 2 times --- Oct 31 16:20:27 MALKiosk-22462 com.apple.xpc.launchd[1] (com.mycompany.disable_wifi): Service only ran for 0 seconds. Pushing respawn out by 10 seconds. Oct 31 16:20:58 --- last message repeated 2 times --- Oct 31 16:20:58 MALKiosk-22462 com.apple.xpc.launchd[1] (com.mycompany.disable_wif

Hi there, I'm trying to figure out the "sudo jamf install -package" command and I'm having trouble figuring out the syntax. This command can be used for installing packages on the jamf server, not only on the local machine, correct?

New day, new challenge... Experiencing an issue installing Mojave. Some Macs model 2016-2017 we reimage by booting up from external drive, format and run "Install macOS Mojave", lates downloaded and saved version 14.6.06. From today, installer gives me an error: "This copy of the install macOS Mojave application is damaged, and can't be used to install macOS" Seems like Apple changes something blocking the installer... As enterprise, we are not ready to jump to Catalina right now, we have to stay with Mojave for a while. I'm looking for recommendations how to fix the issue, suggeestions how to be able reimagine with Mohave; maybe where/how to download latest Mojave installer. Mac admins, please advice :) Thanks!

I'm trying to enable this "check box" for Google Drive File Stream in System Prefs > Security & Privacy > Privacy > Accessibility. I've been working on a config profile in JAMF to enable this via the PPPC settings, but I'm not really sure what else I can do here and I'm not finding a whole lot of documentation regarding ticking these boxes in JAMF. Here is a screenshot of what my PPPC payload looks like for this. I've also tried this without validating the static code requirement as well as only having identifier "com.google.drivefs" and anchor apple generic as the code requirement. Am I missing something?

I have a command set to install the 'Install macos Catalina.app' application but where I am getting hung up is it is still asking for an administrator user name and password when trying to install on the system volume. Is there anyway that this can be an authenticated command so that it doesn't prompt the end-user for credentials they will not know? Setup: I've simply queued the app and ran an execute command "sudo open -a Install macos Catalina.app" But the minute it tries to install...BOOM "enter admin user name and password"... Please help!

I've seen that a lot of the documentation on this site explains to cache the downloader from the App Store. however when trying this method I'm given an error saying that this version cannot be downloaded on this Mac Mini(Mid 2011). In our environment we have a lot newer Macs (2017 and newer). are there any work arounds for this besides requesting a new Mac(lol) any help is much appreciated!

I'm working on a policy that calls a second policy: Policy1 - install X piece of Software (don't force restart)Policy2 - Force a restart using a Jamf helper script set with a 2.5 hour time limit. (management request) The script creates a custom window with logo and is using an adaption of Bill Smith's Countdown script. https://gist.github.com/talkingmoose/3d405eb9dc8ce99a48cda9d9f7609a4f Policy 1 ends with 'File and Processes' call to start the second policy. Has anyone found a way to handle the difference between Catalina and pre-Catalina? Pre-catalina: /usr/bin/local/jamf policy -event 'ForcedRestart'Catalina: /usr/bin/local/jamf/bin/jamf policy -event 'ForcedRestart' You may ask why I'm using the 2 policies instead of an after script. It seems that when set up with the ForcedRestart script - I wasn't getting the complete tag on policies... they stayed pending....

I am trying to figure a way to export all the user data from ASM. Our current SFTP file is not the same as one from previous import and I need to cross reference the data. I didn't see a simple solution on ASM to export, anyone have ideas?

Im trying to install a policy through SelfService and keep on getting the following error. Where am I supposed to add the option "-allowUntrusted"? (yes I am downloading it from the App store to rebuild the package new but I am just wondering if anyone knows where it is located, we may have to do this a couple more time)

So, here's an issue...I'm whitelisting KEXT's via config profiles. Run the following to find team ID and identifier via terminal.Which is good.Until I tried to find the bundle ID and Identifier for this little beauty " Legacy Developer : Hzsystems..As you can see, I can see th ebundle Id, but no team Identifier.... Thoughts????

Hey there! Probing this community to see if anyone else experienced this issue and how it was solved. We've got a few computers, that for an unknown reason, appear to have their Touch ID undoing itself from allowing computer unlock. The Configuration Profile is currently set to allow Touch ID unlock. This is intermittent across our organization, with a large portion of people who are unaffected. But those that are affected, the only step I've seen help is rebuilding the entire OS. Apple was unable to provide details on where this plist regarding TouchID is located, and I suspect an interference with SIP is why it's unable to reauthorize the new settings. I've blasted away /Library/Managed Preferences/, and I would like to know a solution other than reinstalling the OS, if anyone here was able to solve it in a cleaner manner!

I'm trying to push apps out to an iPad and they are all coming back with the error "Cannot connect to iTunes Store". I know I have licenses for all the apps. My DEP connection is current. All of my VPP Accounts connections are current. When I go into Global Management Settings there are exclamation points by GSX Connections (we never set this up), VPP Accounts, and Device Enrollment Program. I checked Apple's status site and everything related to those is green. My DEP says it synced a minute ago. We're running Jamf version 10.13.0-t1559772983 on a Windows 2008 Server VM. (We need to migrate to a new VM before we can upgrade jamf any further). Any thoughts?

i am testing Dock Master (http://errorfreeit.com.au/blog/2015/4/28/dock-master) and it created a mobile config from the site. When I create a new configuration profile in JSS how do I apply the mobile config? do I use the custom settings payload and upload the mobileconfig ? or should i just use the Dock payload in the configuration profile ? whether its the mobileconfig or the Dock payload being used I want all existing and NEW users to get this Dock or how can i use a current test users ~/Library/Preferences/com.apple.dock.plist and using Composer create a dmg out of this and apple it to FUT and FEU ?

Hello, we're currently using vpp.itunes.apple.com and I'm aware that this would end December 1, 2019. I'm just preparing all the pieces to migrate to Apps and Books in ASM. Deployment of apps, will it be different? What we're doing now is, buyer will buy apps in vpp.itunes.apple.com and Jamf admin will add this app in Jamf and would be able to push out to devices specific devices. Will this be pretty much the same process in Apple school manager via Apps & Books? Thanks