Hi All, I've managed to get an FSDP configured on RHEL6 running netatalk, and that seems to work great for AFP. The problem is, I can't get https connectivity working. Clients just get 403's according to the web logs. The documentation for configuring the HTTP(S) portion of the FSDP is pretty minimal from what I've found, and focuses almost entirely on doing it on a Mac. What's required to get this working? I'm not currently using webdav on the system... is that required? I figured it just had to have the direct link, and while it is indeed passing that, it's getting a 403 (forbidden). Thanks!

A new Mac Pro arrived, fated to be a server, which we do not manage with Jamf Pro. However, it feel into the default DEP group and was enrolled on startup inadvertently, getting the FileVault settings for faculty computers. Unenrolling it from Jamf and undoing the initial policy effects was fairly straightforward, and it now reports having no configuration profiles installed, as expected. However, the machine still prompts for a mandatory FileVault enrollment every time someone logs in with a directory based account. FileVault never succeeds, nor should it in this case. Anyone have suggestions on what prefs files to purge to get it to stop trying?

Hi all, Would love some help in making a Restricted Profile or other method for stopping my students from opening the Epic Games Launcher. I'm hoping to put an end to Fortnite on our school owned machines. Many thanks! Brenton

With the introduction of the new iMacs on Monday, Apple has removed all traces of its wired keyboard from the consumer and institutional/enterprise stores. Is there anyone else out there managing labs and clusters using bluetooth keyboards and mice already? I'm looking for strategies besides hoarding old wired keyboards and mice, though that may be the solution in the short term. Oddly they are still selling the wired mouse.

We've been adding the following to the web.xml to restrict access to the JSS WebApp <!-- Restrict Access to JSS via IP Address --> <filter> <filter-name>Custom-RemoteAddrFilter</filter-name> <filter-class>org.apache.catalina.filters.RemoteAddrFilter</filter-class> <init-param> <param-name>allow</param-name> <param-value>"REGEX_IP_VALUES"</param-value> </init-param> <init-param> <param-name>denyStatus</param-name> <param-value>404</param-value> </init-param> </filter> <filter-mapping> <filter-name>Custom-RemoteAddrFilter</filter-name> <servlet-name>PresentationLayerServlet</servlet-name> <servlet-name>FrontEndController</servlet-name> <servlet-name>FrontEndUploadController</servlet-name> <servlet-name>RestletServlet</servlet-name> </filter-mapping> B

Hi Jamf Nation, Is anyone using Jamf and Centrify, particularly leveraging Centrify GPOs to enforce Smart Card login on Macs 10.11 to 10.13? I've read that others have had their fair of issues with Centrify (UUID permissions and network login issues). Everybody seems happy to move away from Centrify to Jamf. Our ORG is currently on 10.12 & 10.11. Until the CIS 10.13 benchmark comes out, we can't upgrade to 10.13 to enforce Smart Card login. Plus, Centrify says that Multi-Factor Authentication for Macs is still in beta. Is anyone usin multi-factor login on Macs? Ideally, I'd like to wait for the CIS 10.13 benchmark, then upgrade our ORG and force Smart Card login that way. But I've been given a quick deadline now to make it happen. Can anybody share their experience with Jamf and Centrify? I'm a bit worried about an admin applying their GPOs and other weirdness. To get Centrify to work, I'd have to unbind and re-bind using Centrify's tool. I saw some scripts and I know Jamf

It is very strange how suddenly the xpath GET stopped printing the data correct, for this line: id=`/usr/bin/curl -k -u $user:$pass "$jssurl/JSSResource/computers/udid/$uuid" -X GET | xpath //computer/general/id | cut -f2 -d ">" | cut -f1 -d "<"` Getting this output with ALL the data from JSS on that specific computer: % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37386 100 37386 0 0 43174 0 --:--:-- --:--:-- --:--:-- 43170 not well-formed (invalid token) at line 1, column 0, byte 0: {"computer":{"general":{"id":1992,"name": ..... .... [ALL THE DATA] .... ^ at /System/Library/Perl/Extras/5.18/darwin-thread-multi-2level/XML/Parser.pm line 187. It displayed computer id before and now all data raw... I wonder why it stopped working like that, any ideas?

We have 300+ Macs in our environment and have found that they are reporting in other tools like McAfee and Ivanti that they are Windows machines because they are pulling an IP address that a Windows machine previously had. Looking through the Landesk forums, the only thing besides editing the host file I haven't tried is setting the "DHCP client ID". If your DHCP Server supports it you can go into System Preferences -> Network -> Select your adaptor on the left -> click the Advanced button -> Set the "DHCP client ID" to your hostname. I have verified that the Macs have the computer name set correctly by using Jamf and another script to set the computer name. I also have "Use a dynamic global hostname" unchecked in the network preferences. Does anyone know of a way to script the DHCP client ID to the current hostname of the Mac?

Is anyone else seeing this issue? We're deploying High Sierra 10.13.6 and every time a new user logs in, this dialog appears: "iCloud Drive may not work properly. Please check the iCloud preference pane. Couldn't communicate with helper application." We're disabling the iCloud setup assistant which is working fine, but all of a sudden on our most recent builds, this message shows up every time. The dialog eventually disappears without user interaction, but I'd like to prevent it from displaying at all. Thanks!

One of the companies we support has an internal app that is not installed through App Store. Searched for a bit, but not found documentation on deploying. Anyone have that handy?Thanks!

I'm working on a way to build Smart Groups based on a machine's OU in ADS. I've put together a Bash script to create an Extension Attribute reporting the DN, but it doesn't update the field in the Inventory for computers. I'm not sure why, because I verified the script is working. Anyone had any success with this? It's sort of imperative I get this functionality for RBAC for my sites and such. #!/bin/bash compName=$(/usr/sbin/scutil --get ComputerName) ou=$(dscl '/Active Directory/<DOMAIN>/All Domains' -read /Computers/$compName$ distinguishedName | grep 'CN' | awk '{$1=$1;print}') echo "<result>$ou</result>"

trying to get my scripting correct to be able to update an extension attribute for an ipad using rest api. even through the Try It Out feature on the uapi/docs i receive an error 500 so something isnt correct. All examples are in XML but uapi is in JSON which i prefer (as im using powershell) as the example in the uapi docs isnt working, i know the request isnt correct.....but what am i missing? is the documentation correct? I noticed in the model schema it mentions "extensionAttributes": [ { "id": 0, "name": "string", "type": "STRING", "value": "string" } but in the bodies Model Schema it has "updatedExtensionAttributes": [ { "id": 0, "name": "string", "type": "STRING", "value": "string" } ] here is the generated example which fails with error 500. the attribute exists, correctly as far as i know. curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization

We just upgraded last night and I noticed the "Computers", "Devices" and "Users" tabs missing in the top left-hand corner in Chrome on my Mac (2 different ones actually). I logged on to a Windows VM and launched Chrome and logged in, and they were there. Never had this issue on 10.3.0. Mac/Chrome: Windows/Chrome:

As we got JSS updated to 9.73, Casper Imaging stopped working. After choosing the Configuration and providing my JSS account credentials I get the error message:"Unable to create the invitation. Check to make sure you have permission to create an invitation"I have administrator-privilege account with everything checked on JSS User Accounts & Groups side. Please help. Thanks!

JAMF Nation, Like many others I am tasked with CIS Benchmark deployment. I need to enable Secure Keyboard in Terminal.app. It can be done via script but the user can de-select the option after the script runs, allowing their current session to be disabled and thus not enforcing the benchmark how we need it enforced. A .plist file pushed via Configuration Profile would be the best way to enforce the setting. In a test I have pushed a .plist file with the Secure Keyboard "key" set to "True" and it works but it also sets every default option in the Terminal so none of it can be changed. My question: How can I push a .plist file via config profile that ONLY forces the Secure Keyboard key to "true"?

I have a computer enrolled into my JSS using DEP. The pre-enrollment ran correctly and all I had to do was select my country and the computer did the rest. My question is, how do you scope computers to policies that used pre-stage enrollment and not computers that are already enrolled in the JSS? For example, now I have this computer which I can log into with no packages or settings installed. I want install all my new programs and scripts on it, but I want to ensure I'm not messing with existing computers in my JSS.

Hi, One of our users has found a way to bypass the restrictions payload we use to prevent access to certain preference panes in System Preferences. The way they're doing this is by going to View > Customise, hiding panes and then using the Search box to find them. This allows them to get into the pane without the configuration profile blocking it. It's not the end of the world since these users aren't admins and they're limited in what they can do, but there's still a few things they can do that we don't want them modifying. Previously it seems you could have stopped this by changing the permissions of the individual panes you don't want users accessing, but now SIP stops you from doing this even as root. MyMac:~ root# chmod 750 /System/Library/PreferencePanes/Sound.prefPane/ chmod: Unable to change file mode on /System/Library/PreferencePanes/Sound.prefPane/: Operation not permitted I've seen from another thread on here that "Apple

Hi All, Is it possible to give 2 policies the same custom trigger name ? that are scoped differently I need to remove some software from our Macs. The script to do this is the same no matter what version of the OS it is running.I then want to immediately install the new software. This is slightly different for OSX10.11 and lower machines than it is for OSX10.12 and up machines.So I have a policy made for each of the installs. If I scope one with a smart group for "10.11 and down" machines and one to "10.12 and up" machines , if I give them the same custom trigger name, when the first policy finishes will it call both policies, but due to the scope will it only run the policy for that machine ? Andrew

Hello all, I've been working with JAMF support to figure out why the latest batch of iMacs won't boot from a fresh image of 10.13.6 even though they do netboot into this version. Older iMacs image just fine. There was speculation that this could be because of a possible difference between the App Store build and the build that ships with the iMacs, but there is no evidence of that. The OS X build number for both is 17G65. Is anybody else seeing this with the latest hardware?

Hey all,I'm trying to find a way to do some clean up either once a week or once a month with our AD networked users. When logging in to a machine it creates a local user folder (but not a system user) from AD and I was wondering if there is an easy way to delete these user folders from time to time to reduce clutter. Any ideas? Gabe ShackneyInstructional Technology SpecialistPrinceton Public Schools

Hi All I am running 10.5.0-t1527689731 on windows 2012 R2 in a clustered environment I am wondering if you can help, I know this topic has came up a few times but my understanding is still limited I am trying to Automate the install of user certs on bound Macs At the minute I have a .mobileconfig which sits is a shared folder and a script that runs that mobileconfig file./usr/bin/profiles -I -F /Users/Shared/VMUserCert/VMUserCert.mobileconfig The user still needs to input there user name and password and I would like this to be automatic. The user is logged in at this point, so my question is, can this information be passed Any help is greatly appreciated Thanks Michael

Hello, Does anyone have any experience in distributing Little Snitch registration info? We recently switched to a volume license and need to update every installation that we have to this new license. Thanks!

Trying to enroll some New iPads into DEP and Jamf using configuration but I keep getting this error msg. It only happens on the new iPads our older fleet are enrolling fine

Hi All,I always carry a bootable USB drive which has OS X 10.9.5 installed for my troubleshooting and quick reimaging job if I need to. Recently I received some iMacs which came with OS X 10.11. And I found when I connect my USB drive and tried to boot from it, it won't.Is there any new security feature in the iMac that's causing it?Thanks.

So I just started playing around in Patch Management. I see we have several computers with McAfee Endpoint Protection that are "Up to date" & lots that are not. Delving deeper, the "Up to date" ones are unmanaged/OLD machines not in use & the mass of "Unknown" are all McAfee Endpoint Security. Is there ANY good reason why McAfee Endpoint Security is NOT in Patch Management seeing it's been since OS 10.12.x?