I'd like to get into Shared Ipads for a couple of my classes but I'm not sure where to start. I've got a DEP device in a prestage that is supposed to set it as a shared Ipad, but after enrolling it never shows as shared. Ideas?

Hi, we need to implement a software restriction policy for the new MacOS prior to it being released Does anyone know the name of the installer .app to block or has that not been released yet ? Thanks as always in advance

Hi JAMF Nation, Hoping someone can help me out with this. We are using a Configuration Profile to blacklist and whitelist various applications for students, and for the most part it seems to be working without a problem. However I am running into this issue with Google Chrome and it's Automatic Updater. Whenever I launch Google Chrome, one of the two following messages appears. "You don't have permission to use the application 'GoogleSoftwareUpdateAgent'.""You don't have permission to use the application 'ksadmin'." I have been searching JAMF Nation for the past couple of days to try and resolve this and have tried various fixes. I have now added these two directories to the 'Allow Folders' white list, as from what I can gather they are the directories that these to files are attempting to run from. ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/Google Software Update.app/Content

5 years ago, we were updating all of our school's equipment to the latest OS by our Team hitting all machines in person and the last few years we've leveraged Self Service for our users to install OS updates themselves. After spending a lot of time the last few weeks trying to update all the associated polices and scripts, try new methods posted here on Jamf nation, I finally just decided to try updating a test machine to High Sierra via the App store. I'm thinking about just having our users update via the user initiated App Store method. Only obstacle would be getting getting the setup assistant to not run. What reason would I have to not use this method? If I go with this how can I skip the setup assistant on next reboot etc if the user updates via the app store? (previous just packaged up to run in the Self Service policy) Thx in advance for your thoughts.

Has anyone actually been able to disable auto updates in a chrome package? - I was Able to create a new mdm configuration profile and upload an edited com.google.Chrome.plist file with a few policy settings. this worked great. I followed the instructions here: https://support.google.com/installer/answer/147176?hl=en&ctx=go but I am still able to update chrome. as a matter of fact, - I even went as far as changing and even deleting the GoogleSoftwareUpdate folder under user/library/google - and it just builds a new one I know in windows, it's one reg key and you get "Updates are disabled by the administrator" can it really be this difficult?

We're imaging using a monolithic image and I'm having issues activating SMART Notebook on OS X. I'm trying to activate SMART Notebook automatically using their silent image command, but it isn't working. When I run the command in Terminal, it works fine. When I try to push the script or run it through Self Service I can see it run in the dock, but it has no effect. No errors, no activation, nothing. I've tried searching JMF Nation, but I haven't found a real solution. Any help here is appreciated!

Hi all, Any idea how to set a non-Apple app as a login item via a configuration profile or Casper MCX? I know i could do this via a LaunchAgent, but am trying to avoid that for now if possible.

Hi All, I'm wondering if anyone know if it's possible to mount SMB shares based on users being in a AD group if the Mac is not bound to AD, but has Jamf Connect (NoMAD) and a valid kerberos ticket? I current have all Macs bound to AD and use a Apple script created by macmule. He's an example of said script; -- Checks Group Membership for ADGroups contains user & if they -- are in the correct groups, mount shares. ---------if ADGroups contains "ADGROUP" then mount volume "smb://fileshare.full.path/SHARENAME"end if Maybe this can't be done... hopefully it can so that I can stop binding machines to AD. If anyone has advice on this I would appreciate it.

I am trying to write a script to report back an extension attribute on SecureToken status. Background - we push out a default admin account (aka "admin") during DEP enrollment. DEP prompts for creation of a user through the GUI and our frontline techs will often create a "localadmin" account, which they're supposed to delete later on. Well, things happen, and the account doesnt get deleted every time. I'm trying to make sure that if there's a local admin, it's got SecureToken, which ever account it has. I've got a script that works on one user, but won't work for more than one user returned. I've not really played with for;do statements, so this is my first go round. Can someone give me a pointer on where I may be going wrong? #!/bin/sh # # SecureToken for Admin.sh # # Get the Username of the local Admin account ADMINid=$( dscl . list /Users | grep -v ^_.* | grep dmin | grep -v JAMF ) # Get SecureTokenStaus status=$( d

I am in the process of deploying around 80 iPads for our school district. Is there any way I can push out Apple ID's to each iPad (and then lock them from being removed) instead of entering them manually? Thanks for any help.

Hi everyone, Today i have this error "This Apple ID cannot be used to make purchases" when installing vpp apps on few iPads. All apps are concerned.It's device based and iPads are on iOS 12 (fresh DFU recovered) with managed apple ids.Nothing relevant in logs. Any idea?

Hello EveryBody, First message, even if I read you all the time. I'm trying to modify a script created by Aaron Baumgarner. that script is to install VLC. Actually we have here a cloud based proxy. I would like to modify the script to cross that proxy when we are in the intranet and not if we are outside.here what I did: check= ping -c 1 InternalIpOfEquipment if [$check = 0 ]; then /usr/bin/curl -x ProxyIP:443 --output /tmp/vlc.dmg "$fileURL" else /usr/bin/curl --output /tmp/vlc.dmg "$fileURL" fi it seems not working. and don't find my error. Could you Help me?

Hello, We have changed out print management system and therefore I had to add a new printer to Casper Suite. The system is set up in AD using a .gpo and a printerpool. I did this simply by adding the new printerpool to a Mac and then added it in Casper Admin. While this works (the drivers are still the same), when the new printer has been added to a Mac through Casper, it will now say "Paused for authentication" whenever I try to use it.If I add the printer the conventional way to the Mac, it will send the print without issue and I use my card at the printer to retrieve it. Is there any way to get around this issue or atleast prompt for authentication details? Right now it just looks like the print job gets stuck in the queue and you have to "refresh" it manually to prompt for credentials. Thanks, J.

We just reimaged our student macbook pros with High Sierra in the summer. Now, when they leave the computer on and put it back in the cart at night, the next day, the students cannot log in because the time is off on the laptop. We didn't have this problem with Sierra or older versions. My understanding is that it will try to resync within 15 minutes but even after a reboot, it isn't trying to get an updated time right away. So, for the laptops that aren't powered down at night, they have to set them aside for a while to get a proper time sync. Anybody have a fix for this

Hi All, We are looking to change our company wallpaper on our Mac's, and in past we have done this by saving the image to a test Mac, and using composer to create a DMG of the folder location. We then push this folder out to users, and once pushed out, we changed the filename on a restrictions config profile. The problem we have now, is that we have a mixture of APFS and Mac OS Journaled devices, so the composer route seems to add a bit more complication. Can anybody advise on a better way of doing this? Thank you!

This request is to help us out with a symptom where users' "login" keychain and AD become out-of-sync. In a good handful of these cases I'm seeing that a user attempts to actually change their password from the local machine as they should, but they are unable to because their Mac times out before reaching our DC. The fix? If we un-bind and re-bind the computer to our domain, accessing network resources and password resets seem to work just fine. So, what I'd like to do is create something in Self Service where a user can kick off a policy/configuration and it will automatically unbind and rebind their machine to our domain. I know there are Policy attributes in the GUI that will bind a machine to a domain, and we utilize this in our OS configurations -- it works find for binding a computer to the domain. However, there isn't a GUI-option to remove it from the current bound-domain, so I was thinking of scripting. I am borrowing a script that Scott Bl

Goal: Only allow members of specific Active Directory (AD) groups to logon to certain computers. Why: We want to keep students from being able to logon to Faculty/Staff computers. We also need to keep Prep school students from using University computers. The Details of the problem: THIS WORKS: Manually going into System Preferences, Login Options, Allow network users to log in at login window (Options...), Only these network users. Entering in domain groups. THIS DOESN'T WORK: Creating a Configuration Profile within JSS where the Login Window contains a payload with the groups specified under the Access tab. This doesn't work if the group contains > 1500 users. Can anyone verify this? Any workarounds? This is a bugger.....

I've seen some discussions already dotted around but not much has helped so far. We have successfully used a script that will remove the SSID from a Mac but after a reboot, you are still left with the SSID details in Keychain. Is there a way (script?) to remove this? I want to test it using terminal first.

Hi, I'm wondering if anyone has run into the issue we've just started experiencing after upgrading JSS to 10.3.1. We have a configuration profile for handling screensavers and FileVault2 recovery keys. For some reason however this now also disabled camera devices. I can see in the profile at a client that under "Restrictions" it says "Disallow Camera Devices: True". And I know it takes this from the Security & Privacy setting in the configuration profile because if I remove that part all together, the restriction is no longer there. However I can't for the life of me see any Restrictions-tab for this configuration profile in the JSS. Does anyone have any idea on how to solve this issue? Thanks!

Is there anyway to have a multi-line message? I am trying to have a user click on a button in self service and display things like computer name / username / mac address / IP address for our service desk staff and I can get one line to show but no more. Really don't want them to have to click multiple self service buttons.

With 10.14 coming out and all devices getting support for APFS, I've started looking into ways to adjust our imaging setup. Right now, we're using Install macOS High Sierra drives to wipe and put in a base OS on a machine. This works, but now that 10.14 brings APFS to everything I think we can do better. I'm trying to find a way to basically put stuff into Self Service to make a one or two click process for wiping a machine. My idea so far is: VPP purchase & deploy the Install macOS Mojave app to the machine Once deployed, make a policy available in Self Service Self Service policy runs a script to flush the JSS logs for that machine Run the following command (adjusted for eventual macOS Mojave installer name) to wipe and image the machine "/Applications/Install macOS High Sierra.app/Contents/Resources/startosinstall" --eraseinstall --newvolumename "Macintosh HD" --agreetolicense & This would get us to a state where the machine is waiting at the Setup Wizard, has no lo

I'm experimenting with keeping our retired machines in the database by unmanaging them. This will let us keep their historical information around without using one of our Jamf licenses. But the machines still count against the total number of licenses in Licensed Software. Am I missing something? Should I make a feature request (because I don't have enough crushed dreams)?

We are currently running JSS 9.93 , Self service 9.93 and have only updated a handful of machines to Sierra (10.12). Immediately, there are all sorts of issues. Everything from profiles not getting installed, tons of "pending" commands, Apps fail to run (google drive specifically the worst), VPN fails, etc. Even self service is having issues checking in.. Is there something I'm missing as far as configuring JAMF for Sierra or vice versa??

My apologies, this is likely covered by NDA...moving to BETA forum. Jamf: any way to mask subject to avoid wrath of Apple? :D:D:D https://www.jamf.com/jamf-nation/discussions/24744/macos-high-sierra-10-13-introduces-a-new-feature-that-requires-user-approval-before-loading-newly-installed-third-party-kernel-extensions

Anyone else having issues with the Microsoft Autoupdate not working correctly. Currently the app says I have five apps that need updating to 16.17.18090901.The command line tool (which uses the app) says I only have four apps that need updating.I run the MSUpdateHelper4JamfPro script provided by macadmins.software site and nothing gets updated. I've seen similar things, like the command line tool not picking up the last Excel hotfixa. Facepalm.