I have a computer enrolled into my JSS using DEP. The pre-enrollment ran correctly and all I had to do was select my country and the computer did the rest. My question is, how do you scope computers to policies that used pre-stage enrollment and not computers that are already enrolled in the JSS? For example, now I have this computer which I can log into with no packages or settings installed. I want install all my new programs and scripts on it, but I want to ensure I'm not messing with existing computers in my JSS.

Hi, One of our users has found a way to bypass the restrictions payload we use to prevent access to certain preference panes in System Preferences. The way they're doing this is by going to View > Customise, hiding panes and then using the Search box to find them. This allows them to get into the pane without the configuration profile blocking it. It's not the end of the world since these users aren't admins and they're limited in what they can do, but there's still a few things they can do that we don't want them modifying. Previously it seems you could have stopped this by changing the permissions of the individual panes you don't want users accessing, but now SIP stops you from doing this even as root. MyMac:~ root# chmod 750 /System/Library/PreferencePanes/Sound.prefPane/ chmod: Unable to change file mode on /System/Library/PreferencePanes/Sound.prefPane/: Operation not permitted I've seen from another thread on here that "Apple

Hi All, Is it possible to give 2 policies the same custom trigger name ? that are scoped differently I need to remove some software from our Macs. The script to do this is the same no matter what version of the OS it is running.I then want to immediately install the new software. This is slightly different for OSX10.11 and lower machines than it is for OSX10.12 and up machines.So I have a policy made for each of the installs. If I scope one with a smart group for "10.11 and down" machines and one to "10.12 and up" machines , if I give them the same custom trigger name, when the first policy finishes will it call both policies, but due to the scope will it only run the policy for that machine ? Andrew

Hello all, I've been working with JAMF support to figure out why the latest batch of iMacs won't boot from a fresh image of 10.13.6 even though they do netboot into this version. Older iMacs image just fine. There was speculation that this could be because of a possible difference between the App Store build and the build that ships with the iMacs, but there is no evidence of that. The OS X build number for both is 17G65. Is anybody else seeing this with the latest hardware?

Hey all,I'm trying to find a way to do some clean up either once a week or once a month with our AD networked users. When logging in to a machine it creates a local user folder (but not a system user) from AD and I was wondering if there is an easy way to delete these user folders from time to time to reduce clutter. Any ideas? Gabe ShackneyInstructional Technology SpecialistPrinceton Public Schools

Hi All I am running 10.5.0-t1527689731 on windows 2012 R2 in a clustered environment I am wondering if you can help, I know this topic has came up a few times but my understanding is still limited I am trying to Automate the install of user certs on bound Macs At the minute I have a .mobileconfig which sits is a shared folder and a script that runs that mobileconfig file./usr/bin/profiles -I -F /Users/Shared/VMUserCert/VMUserCert.mobileconfig The user still needs to input there user name and password and I would like this to be automatic. The user is logged in at this point, so my question is, can this information be passed Any help is greatly appreciated Thanks Michael

Hello, Does anyone have any experience in distributing Little Snitch registration info? We recently switched to a volume license and need to update every installation that we have to this new license. Thanks!

Trying to enroll some New iPads into DEP and Jamf using configuration but I keep getting this error msg. It only happens on the new iPads our older fleet are enrolling fine

Hi All,I always carry a bootable USB drive which has OS X 10.9.5 installed for my troubleshooting and quick reimaging job if I need to. Recently I received some iMacs which came with OS X 10.11. And I found when I connect my USB drive and tried to boot from it, it won't.Is there any new security feature in the iMac that's causing it?Thanks.

So I just started playing around in Patch Management. I see we have several computers with McAfee Endpoint Protection that are "Up to date" & lots that are not. Delving deeper, the "Up to date" ones are unmanaged/OLD machines not in use & the mass of "Unknown" are all McAfee Endpoint Security. Is there ANY good reason why McAfee Endpoint Security is NOT in Patch Management seeing it's been since OS 10.12.x?

I have a script that runs and deletes the home directories of users userList=find /Users -type d -maxdepth 1 -mindepth 1 -not -name "." -not -name "admin" -not -name "testuser" -not -name "Shared" -not -name "Guest" -mtime +7 | awk -F'/' '{print $NF}' for a in $userList ; do rm -r /Users/"$a"; #delete the home directory echo "$a has been deleted" let counter=counter+1done it deletes the home directories correctly, but when i check the System Preferences --> Users & Groupsall the deleted users names are still listed here. How do I also get those user names cleared ?

We recently updated our environment from Casper Suite 9.97 to JAMF Pro 10.4. Since then I have seen that Self Service takes a longer to install when using Web Enrollment. On 9.97 Self Service installed almost immediately. Now it takes 10-15 minutes and some techs report over an hour. I currently have Self Service to install automatically.

Hey Jamf Admnis. Just searching for a way to push a policy on the changing stat of a EA. In detail i have a computername_individual extension attribute witch is set via jamf pro web gui by an admin. If this EA is set or changed i want to run a policy witchs checks the computername_induvidual EA of the client and rename it. I have build a script with jamf api commands that is checking the EA and renames the computer if needed so far. So i created a smard group with computername_individual is set and a policy with the script + smart group. If some is changing the EA again i have set the policy to ongoing once a week/once a day. Is there a way to push this policy to the clients instead of runnung it every day? Thank you for some tips.

I am trying to read a plist from the recovery partition on my lab machines specifically the ProductVersion Key value from com.apple.recovery.boot/SystemVersion.plist I have tried defaults read and all I get is plist does not exist. I am trying to create an extension attribute that reads that value but I am stuck without the defaults command I was thinking xmllint might work but I am having trouble with the syntax. Any and all help is appreciated!!

Hi all, This is more asking for information than having an issue that I need to solve. Are there any knowledge source or instructions available when it comes to packaging Mac Applications that requires a license? ie: When a user installs an application via self service, the application already has the companies volume license and therefore don't need to end-user to type in anything before they can start. I imagine there would be plenty of ways to achieve this, but some guidelines to get me started would be good. Giving me a URL to read up on would be great :)

I apologize if this has been asked already, but I am new to JAMF and wanted to see what you guys were doing. I would like my macs to enroll via DEP, get prompted for the user to enter the computer name, then bind to AD. The problem is I cannot figure out how to rename BEFORE it binds to AD. How are ya'll doing it? Also, if you can share your script to prompt the user to rename their computer that would be great! Thanks guys!

Hi Nation, Hoping some one can help me out. We use DFS in our organization and when ever we mount the a share at the DFS root we get odd finder windows. The window sill display but it seems as though there are no window preferences. The tool bar under view options will be disabled and navigating the network folders will open each folder in a new window. If i mount the share a little bit deeper from the DFS root they will display fine. This is at the DFS Root: This is if i mount the share a bit deeper in the DFS tree I should add I don't manage the DFS but our File Server guys are happy to help out if i can come up with a workable solution. ASh

Hi all, Do excuse me for being lazy, wondering if anyone within this Mac community have the same issue. Now that Macbook Pro 2018 models are out, our company have been purchasing them. Our company is full of docking stations running displaylink to external monitors. As such, we have been rolling out Macbooks with 10.13.3 only, as any later OS will stop displaylink from working.http://www.displaylink.com/downloads/macos Back to main topic, I tried to install/boot up the Macbook Pro 2018 with a macOS 10.13.3, it starts up with an error message "A software update is required to use this startup disk" So can anyone confirm that Macbook Pro 2018 model requires macOS 10.13.6 ? Thanks in advance.

Hey there, I'm just curious if someone could outline the pros/cons of running your JSS under TCP 8443 vs. 443? Is there a good reason why default installations use 8443 instead of 443?

I have users connecting to an internal update server that I'm taking offline and would like to point these users to apple's software updates server during this time. How can I accomplish this?

Hello all, I am trying to automate our VPN deployment, and so far I have got the software installing ok, adding the certificates correctly is a work in progress, although I can do it all via the command line with the user adding their password to allow access to their keychain. Next thing I need to try and work out is getting individual certificates onto each users machine, one way is individual pkg for each user, but this is a bit messy. While writing I have thought I could maybe script mounting a share and copying a file with $USERNAME maybe? Importing it then deleting it. Any ideas on how I could achieve this? We are using F5 ssl certificate authentication. Thanks Dave

I have added some iPads to DEP using Apple Configurator. The ipads have been enrolled to the JSS and i can see them when i sign into Apple School Manager. But when i create a PreStage Enrollement there are no devices in the scope?

Hi, I've got an EA that should return the encryption of a user certificate on a Mac. It works on all my test machines but appears to be broken on most of the machines out in the wild. The key line is : certalg=$(security find-certificate -a -c ${username} -p -Z | openssl x509 -text | grep "Signature Algorithm" | head -n1 | awk '{ print $3' ) I'm stumped trying to figure out how it goes wrong on the other machines. Anyone got any ideas? I'm sure $username is valid. // Tony

so i got to remove the SSID from the preferred list but it still is connected to that SSID, is there anyway i could shut down wifi and turn it back on real quick. that way they could connect to the actual wifi i want them too. ?

I can't seem to find clear instructions anywhere for doing an in place upgrade from MySQL 5.6 to 5.7. The community installer shows no upgrade from 5.6.35 to 5.7.x. Do I need to remove and install, or install in parallel, and then import the database from a backup? Am I missing some obvious steps somewhere?