Hi jamf nation :) Is it possible to put a Policy or script or something to the Self Service?That would be important so the Helpdesk can tell the User that they triggered a software for reinstallation or activated some software for them and they can press a button to speed up the installation. (not get the software magically installed in the background) Thank youBRDaniel

Does anyone know if there is a way to restrict iCloud usage on devices with Jamf (or Windows) to only allow a corporate domain to log into a device's iCloud? For example, I work for www.cool.com...and I have a macbookpro, but I can only log into iCloud with a userABC@cool.com email address. I cannot log into iCloud with my personal coolguy@gmail.com address. I tried to search this topic, but I only saw references to VPP and I didn't see anything there that described this.

Maybe I'm going crazy, but I don't remember the JSS default MDM profile created when the Mac is enrolled in Casper as being removable. Now it is in Macs enrolled in our JSS (v9.72).. I can't seem to find any setting that specifies removable or not.

I tried to find something on this and came up empty. I am surprised that we have not been asked this yet, but is there anything that anyone has done to show the clients when an active Remote session is in place? When it terminates?I know some of our clients at some point will bring this up, and I thought I'd ask before I get asked. Scott

Hi Folks, I'm trying to create an extension attribute to get the MAU status. By the script is working fine: But using the same code to create an Extension Attribute is not working. Does anyone has a tip to solve this? Thanks in advance,

There are a few threads on here regarding this (some started by me) but I'm having a heck of a time consistently disabling Spaces on client machines for Smarter Balanced testing in a few weeks. To disable manually, you go to System Preferences-Keyboard-Shortcuts and uncheck these boxes. This screenshot is from my machine running 10.10.2 but the same boxes exist in other OS versions. Unchecking these boxes modifies the ~/Library/Preferences/com.apple.symbolichotkeys.plist. Last year with version 6.3 of the browser I created a custom configuration profile with this plist as the payload set to the computer level. Worked great. Now with version 7 of the browser, not so much. Even after deploying a config profile, checking that the boxes are unchecked, the SBAC browser still thinks Spaces is enabled. If I manually check and uncheck the boxes, the browser launches fine. So there is something that is finalizing the update to that plist that is only getting done by manually mak

Our school district is piloting the Smarter Balance assessment this spring. One requirement of the testing is that Mission Control/Spaces is disabled. Through the GUI, you do this by going to System Preferences-Keyboard-Shortcuts and unchecking the box for Mission Control. It appears unchecking this box modifies the com.apple.symbolichotkeys (amongst others) preference file. The problem I'm having is that this is a user-level preference and most tips I find online are for local users, not AD users. Anybody have a fairly painless way to do this rather than touching each machine?

Hi All, We're currently in the phase of moving away from Centrify to Casper and use a script that basically, removes the AD object from the machine, with a service account. Then utilises the Centrify Uninstall script and force uninstalls centrify with no interaction, after the uninstallation is finished we install Casper via the QuickAdd.pkg created in recon and a couple of custom written prompts to re-name the machine to a new naming convention then update the Inventory database. The Mac is rebound to the domain via an enrollment policy based on the naming convention smart group. So the machine side for us is fine. My question comes now when migrating the users profile what is the best way to migrate the users profile and keep the data and preferences in tact, what i've been doing is playing with the following command: sudo chown -R firstname.lastname:'DomainDomain Users' /Users/firstname.lastname The user then logs into the Mac for the first time after being bound with Casper, on

I'm having an issue with a client installing McAfee 10.6.2 on macOS 10.14.5.I have a custom install, following McAfee's method that only installs threat prevention.When the install is finished McAfee is running but TP is not enabled. Using the McAfees preferences it can be switched on with no errors or warnings.using the same install on 10.14.3 works as expected with TP enabled. Doing testing using a full install, i.e. not customised at all, has the same end result. TP not enabled but the other two services are.According to McAfee the kexts for this version are notarised and the kext profile is deployed and correct for the version.using kextutil, above, shows that the FileCore kext loads with no errors but trying to load AVKext it can't find Filecore kext. anyone else getting this issue?

I'm running the following script by hand in Terminal which works successfully to mount our user's homedrive: filteredLDAP=$(ldapsearch -LLL -x -h our.domain -b "OU=People,DC=mds,DC=ad,DC=dur,DC=ac,DC=uk" "(sAMAccountName=$USER)" homeDirectory | sed 's/[^:]*: //;2q;d' | sed 's////g')connTYPE=$"smb:"connCONCAT=$"$connTYPE$filteredLDAP"open $connCONCAT When I add the script to self-service, nothing happens - I think it's because the script is being run as root and not the current user. Is that the case, and if so, how can I amend to run successfully? Thanks.

I was building an dmg in Composer and selected APFS, I must have check remember the selection because now I am not being prompted to choose between HFS+ or APFS. Is there a way to clear that?

Kinda weird issue that I just started noticing but it seems the "eject" option is not showing up with external media on 10.10.2. If you right click, eject is not an option. If you drag to the trash, the eject icon shows up but does not eject the media. If you use the dockutil command in terminal, it does eject the media but that is obviously not ideal. Apple's recommendation/instructions are to log out. restart and/or shut down and remove the media before restarting. Also not ideal. Has anyone else seen or encountered this yet? And if so, what solution have you implemented? Any feedback would be appreciated.

Hi everyone, I've recently inherited a JSS, and they have configuration profiles and policies go to certain smart groups. The criteria for these smart groups is based on if the machine has a specific plug-in. I need to create a new plug-in, but I'm not sure if I'm doing it the right way (I'm doing a touch command to write the plug-in to /Library/Internet Plug-Ins/nameofiplugin.plugin. I can successfully create a zero kb plugin file, however I can't get it to appear as a criteria option in the JSS. The previously created ones are under that however...

I've been able to identify the agent installed and process running. My problem is that I cannot figure out how to detect the version number of those. Awesome community has lots of Extension Attributes for other security agents, but I didn't have any luck with these two.

Hi All, I am working on the workflow for deploying 10.14.5 to our machines and while testing the desktop workflow, keep getting this I searched earlier and found the solution of adding a custom config profile with com.apple.MCX as the domain and "<key>cachedaccounts.askForSecureTokenAuthBypass</key> <true/>" as the main entry in the plist. However, after trying this twice, it still prompts me for a secure token for each user that logs in. Am I missing something? Thanks

Hello JAMF Nation, I could really use some assistance in FORCING the 10.14.5 update to my mac users, the problem is that I gave them the option in the first place to download it and install it. I opened the door for these users to never update despite my efforts. Now, I want to force it to install but being extremely new to JAMF and not knowing how to really write scripts was wondering if anyone had any workflows I could use that would do this very thing. And being so new a quick visual would go a long way as am a hands on visual learner. I have tried to push it out via a smartgroups and command actions but it does not work. I also tried creating a policy and adding the .dmg as a package for installation. I added my test machine to the scope and it says it installed restarts the computer as part of the payload but never really installs. My Guess is since it's a .dmg and needs to be mounted I have to have a script to get this done. Thanks In Advance.

Howdy, I am testing the process for updating the computers to Mojave for my end users, but I'm running into an issue. No one seems to be talking about it, so hopefully it is an easy fix. I've been following this process: https://github.com/kc9wwh/macOSUpgrade Which I remember working fine for High Sierra, but when I run the process now, it only works for users that have admin rights. For non-admin users, it gets to the fullscreen splash and gives a prompt asking for admin rights. I've tried a few things, but I can't get around this issue. The issue was also raised on the Github page, but I was hoping one of yall would be able to help me out, or at least show me an alternative update method that I can push down to non-admin users.

With the new Outlook app being the security nightmare it is... I find myself wanting to block it. Seems like this isn't possible in Casper... is that a correct assumption? I've never needed to block an iOS app before. Would a config profile "poisoning" the app's settings somehow work?

Hi Guys, Just wondering if you are packaging and deploying un-notarized apps still in your environment. I'm not sure whether we should still be allowing and packaging these apps since this will make upgrading to catalina much more difficult...since they won't run in catalina. lemme know!

After kicking off the imaging process and when everything is done I sign into one of the computers and get "The imaging process is finishing installing software" and then restart. I know this is normal but our computers are continuing to do that after every restart and sign in. We have imaged using this method and image before and have not had this issue. The computers we are imaging are located in another building but we have distribution points here that have also recently been replicated. Any ideas on what could be causing the issue?

Trying to get my Webclips into the dock in a configuration profile on iOS 10 using JSS 9.96. I can push the web clips with the Web Clip tab in the configuration profile...but when I try to arrange it into the dock it doesn't seem to work. Any thoughts? Gabe ShackneyPrinceton Public Schools

Hello everyone, I am reaching out to the community to ask if anyone has tried to add a single user account from AD to ssh access on the Mac? I have tried the following Created a policy to run a single terminal command: dseditgroup -o edit -a “(networkid)” -t group com.apple.access_ssh Also I have tried scripting this out in case the com.apple.access_ssh group is not there. !/bin/bash/ dseditgroup -o create -q com.apple.access_ssh dseditgroup -o edit -a "DOMAIN(networkid)" -t com.apple.access_ssh Does anyone have any thoughts or have gotten this to work for them.

I am having an issue with our laptops that need to login to AD profiles.Before our network update, I had a Configuration Profile with the Network settings and the Certificate for the 802.1x network.Since the renewal, our issuer has changed and AD logins no longer work. I thought it would be as simple as putting the new cert in the configuration profile and be done with it. Sadly that wasn't the case, and I believe it is because the certificate roots are from a different CA. That CA is also not included in the System Keychain by default (not sure if this is relevant?) I have tried deleting the old certificates relating to our expired 802.1x cert and the CA certs as well as pushing all the new certs in a configuration profile. No dice.It seems that when I get AD logins working, 802.1x WiFi doesn't, and when I get 802.1x WiFi working, AD logins don't. If anyone has experienced a similar issue or can point me the right way, that would be appreciated.

Ever since I've started upgrading Macs running High Sierra, I have noticed that each and every one of them is extremely reluctant to shut down or restart. I get as far as the black screen with the spinning gear and that's it. I end up forcing the computer to power off after several minutes. In some cases I've let it sit there for an hour and a half and the computers never shut off. This is causing serious issues with laptops because users throw them in their bag and go home in this state. Meanwhile the computer is still "Running" and the fans spin up and the battery drains. Has anyone else seen this problem since upgrading to High Sierra? These are all in-place upgrades from 10.12.6 to 10.13.1, 10.13.4, or 10.13.6 (I've been seeing this problem for a long time)

We received some new machines that are setup for DEP, and whenever I am going into the PreStage Enrollment page to click the box to make them active, it will not allow me to save changes. Basically, the "Save" button is "greyed" out and won't allow me to add those machines in to be DEP Enrolled. This is a new behavior that I haven't experienced before. I was able to save these changes as recently as a month ago, but now it's non-functional. Also, and it might be related, in the DEP breakdown, it's naming a bunch of Mac Models as iMac 21.5" when the Description is clearly not the same type (see attachment, Macbooks and Mac Minis are showing as "iMacs"). Could this be causing the save issues since there's a mismatch? Does anyone know why this might be occurring? Thanks! ~ JYH