This request is to help us out with a symptom where users' "login" keychain and AD become out-of-sync. In a good handful of these cases I'm seeing that a user attempts to actually change their password from the local machine as they should, but they are unable to because their Mac times out before reaching our DC. The fix? If we un-bind and re-bind the computer to our domain, accessing network resources and password resets seem to work just fine. So, what I'd like to do is create something in Self Service where a user can kick off a policy/configuration and it will automatically unbind and rebind their machine to our domain. I know there are Policy attributes in the GUI that will bind a machine to a domain, and we utilize this in our OS configurations -- it works find for binding a computer to the domain. However, there isn't a GUI-option to remove it from the current bound-domain, so I was thinking of scripting. I am borrowing a script that Scott Bl

Goal: Only allow members of specific Active Directory (AD) groups to logon to certain computers. Why: We want to keep students from being able to logon to Faculty/Staff computers. We also need to keep Prep school students from using University computers. The Details of the problem: THIS WORKS: Manually going into System Preferences, Login Options, Allow network users to log in at login window (Options...), Only these network users. Entering in domain groups. THIS DOESN'T WORK: Creating a Configuration Profile within JSS where the Login Window contains a payload with the groups specified under the Access tab. This doesn't work if the group contains > 1500 users. Can anyone verify this? Any workarounds? This is a bugger.....

I've seen some discussions already dotted around but not much has helped so far. We have successfully used a script that will remove the SSID from a Mac but after a reboot, you are still left with the SSID details in Keychain. Is there a way (script?) to remove this? I want to test it using terminal first.

Hi, I'm wondering if anyone has run into the issue we've just started experiencing after upgrading JSS to 10.3.1. We have a configuration profile for handling screensavers and FileVault2 recovery keys. For some reason however this now also disabled camera devices. I can see in the profile at a client that under "Restrictions" it says "Disallow Camera Devices: True". And I know it takes this from the Security & Privacy setting in the configuration profile because if I remove that part all together, the restriction is no longer there. However I can't for the life of me see any Restrictions-tab for this configuration profile in the JSS. Does anyone have any idea on how to solve this issue? Thanks!

Is there anyway to have a multi-line message? I am trying to have a user click on a button in self service and display things like computer name / username / mac address / IP address for our service desk staff and I can get one line to show but no more. Really don't want them to have to click multiple self service buttons.

With 10.14 coming out and all devices getting support for APFS, I've started looking into ways to adjust our imaging setup. Right now, we're using Install macOS High Sierra drives to wipe and put in a base OS on a machine. This works, but now that 10.14 brings APFS to everything I think we can do better. I'm trying to find a way to basically put stuff into Self Service to make a one or two click process for wiping a machine. My idea so far is: VPP purchase & deploy the Install macOS Mojave app to the machine Once deployed, make a policy available in Self Service Self Service policy runs a script to flush the JSS logs for that machine Run the following command (adjusted for eventual macOS Mojave installer name) to wipe and image the machine "/Applications/Install macOS High Sierra.app/Contents/Resources/startosinstall" --eraseinstall --newvolumename "Macintosh HD" --agreetolicense & This would get us to a state where the machine is waiting at the Setup Wizard, has no lo

I'm experimenting with keeping our retired machines in the database by unmanaging them. This will let us keep their historical information around without using one of our Jamf licenses. But the machines still count against the total number of licenses in Licensed Software. Am I missing something? Should I make a feature request (because I don't have enough crushed dreams)?

We are currently running JSS 9.93 , Self service 9.93 and have only updated a handful of machines to Sierra (10.12). Immediately, there are all sorts of issues. Everything from profiles not getting installed, tons of "pending" commands, Apps fail to run (google drive specifically the worst), VPN fails, etc. Even self service is having issues checking in.. Is there something I'm missing as far as configuring JAMF for Sierra or vice versa??

My apologies, this is likely covered by NDA...moving to BETA forum. Jamf: any way to mask subject to avoid wrath of Apple? :D:D:D https://www.jamf.com/jamf-nation/discussions/24744/macos-high-sierra-10-13-introduces-a-new-feature-that-requires-user-approval-before-loading-newly-installed-third-party-kernel-extensions

Anyone else having issues with the Microsoft Autoupdate not working correctly. Currently the app says I have five apps that need updating to 16.17.18090901.The command line tool (which uses the app) says I only have four apps that need updating.I run the MSUpdateHelper4JamfPro script provided by macadmins.software site and nothing gets updated. I've seen similar things, like the command line tool not picking up the last Excel hotfixa. Facepalm.

Hello, what is the best way if i want to disable sleep for 3 hours while installing on macs which have a configuration profile which sets sleep to 15 minutes. The profile is installed at enrollment after this i run a policy by custom trigger which runs a script with different custom triggers. Should i just use caffeinate at the beginning of the script?Should i make a new configuration profile with new sleep settings? Does it overwrite the old 15 minutes? I would like to do everything in the script and not to use an additional step in the jss.Is there another good way? Thanks in advanceMaurice Fiedler

In Patch Management, my Patch Policy looks like this: And my targets is a large Smart Computer Group of mostly 10.12 without Skype, no limitations, no exclusions. When I click on "View list of eligible computers.", it's empty (0-0). If "Patch Unknown Versions" is selected, shouldn't I see all the computers from the group in the eligible list?

I'm trying to pull the asset tag info from the JSS API and apply that to the Computer Info Field 1 on the device. I'm still learning scripting, and need help with my syntax. This is what I have so far... #!/bin/bash #Pull Asset Tag from the device asset_Tag=$ /usr/bin/awk -F'<asset_tag>|</asset_tag>' '{print $2}'; #Name the ARD field 1 with the asset tag pulled from JSS /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -configure -computerinfo -set1 -1 "$asset_Tag"

Hi Guys, We have noticed an issue this PM which shows our MDM Capability as "No" after imaging or enrolling via the URL. Does anybody know what I can check to see what might be causing this? 2 Machines have the same problem now. Thanks! EDIT 23/03/16 14:00PM GMT - It seems from comments below that this is an Apple issue, multiple users have reported this to Apple. JAMF have also had multiple reports. EDIT 24/03/16 11:30AM GMT - Fixed.

is anyone having issues dragging an application to the DOCK using High Sierra ?? I can't get an application added to the DOCK. Not sure if i'm doing anything wrong I have installed an application via policy with the dock item, and it didn't get placed. I added the dock item to Casper Admin manually file:///Applications/IBM/SPSS/applicationname.app/ afterwards i manually drag the application to the dock and it won't allow it. I even try to drag the mac Chess into the dock and it won't allow it.

Goal: A policy to force minor OS updates, then run a script alerting the end user twice that a reboot is required. The second alert is locked on screen. If the user does not interact with the script, the machine will reboot in 4 hours and successfully complete the policy. If the user force quits the second warning (cmd + q), the machine immediately reboots and successfully completes the policy. If the user manually reboots their machine, the policy is successfully completed. Script: #!/bin/sh jamf displayMessage -message "Minor OS updates have been installed and your machine will reboot in 4 hours. It is recommended that you save your work and reboot immediately to prevent loss of work." sleep 12600 /Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper -windowType utility -title "Reboot" -description "Your machine will reboot at $(date -v +30M). Please ensure all work is saved and restart within the next 30 minutes. Attempting to force quit (CMD + Q) wi

Hello, I've been instructed to make a local account on a small group of Macs that I manage, and have that account automatically login at startup. I'm aware of how to create the accounts using Casper Imaging or Casper Remote, however, I can't seem to figure out how to get the account to login automatically. Is this setting available to be configured through a managed preference or a terminal command that can be scripted. Thanks, ~Ted

I have a question about File Vault 2. The way my predecessor (who is no longer reachable) configured Jamf and our Onboarding process, a policy was created to Enable File Vault 2 – Once per computer (which makes sense so far) but he lost me creating the scope. We manually add each new (Specific) computer to the scope during our setup. I would like to make the policy's scope more Admin friendly and change it to All Computers. The question is – If I go into the policy and change the scope, which has already been applied to all computers on an individual basis to this point, will that screw things up and attempt to re-apply the policy, or re-run File Vault 2 encryption, on all computers within our environment?

Hello,Is there a way to check whether a DMG has been saved as a APFS image rather than HFS+? We mostly export PKG files from Composer, but sometimes someone here creates a DMG. We ran into the issue today where a DMG wouldn't install on any of our El Cap MacBooks because it was saved in APFS format. I went in and remade it (as a PKG since it didn't need to be a DMG) but now am hoping to have some sort of script to scan through our distribution site to see if there are any other APFS DMG files out there. Is this possible?Tim

I just updated my Jamf Pro Suite to version 10.6.2. Now, when I attempt to open Jamf Remote, an MBS Xojo error message appears. How can I go about reverting to an earlier version of the Jamf Pro Suite?

Hello Everyone, I requiere your help because we are implementing self service in order the users are able to install applications in their MACs. I am able to create a Policy for the selfservice but I'm not able to upload the application in the self service. Thanks in advance.

Because of some conflict with configuration policy we are not able to enable the guest account on student computers. I am trying to work around this by making a pseudo guest account wherein a template is created and after every logout the system deletes the folders are replaces it with the template. Does anyone have suggestions on how to accomplish this? I hear logout scripts are depreciated but it looks to be the only option. These computers are running Yosemite. My scripting knowledge is limited so detail explanations are helpful.

Hello JN, I attempted packing SPSS 23 about a year or so ago. I was successful in capturing a snapshot that worked great on the machine I built it on. But as explained here ftp://public.dhe.ibm.com/software/analytics/spss/documentation/statistics/24.0/en/client/InstallationDocuments/MacOS/Authorized_User_License_Installation_Instructions.pdf] the licensing bits are tied to hardware so once I deployed to another Mac, it was borked. SPSS packaging and installation information here on JN is sparse. Can someone share their workflow/methodology? Thanks in advance, /randy

Whenever I send a Device Lock command, the message I enter does not appear on the device. Is there some setting I need to set for this to work? The device locks immediately but lacks the message I enter

Hi - I'm experiencing a somewhat strange issue lately. We have a very Self Service-heavy environment where I work, and I've recently noticed a strange glitch with any self-service policy... Let's say I manually cancel a running policy ('X' button) for some reason (e.g., I'm binding to a directory service and it is failing for some reason and I want to stop it from running before it times-out on its own). I know, not the best practice, but again...let's just say "what if." Then, if I try to run that same policy again (even after restarting, recon-ing, enforcing mgmt. framework, resetting MDM, etc.) it says "Gathering Information" then the progress bar just zooms and completes and nothing has happened. The JSS has no record of the policy running and the jamf.log just says "running policy xxx..." I am able to easily reproduce the issue on my own system with just about any policy, script-based only or ones with package payloads. Is there some cache or something that I can clear ou