Is there a way to generate a report that will show all the system names and their escrowed FileVault 2 keys (we hold them in the JSS)? I’ve reviewed the advanced computer search criteria but can’t seem to find what I need.

Wondering if anyone has any insight into this. I wrote an EA and put it up in my environment. Watching some of the results come in, I made an error and corrected it. Now the results are correct, but for those few that ran the EA already and the output is incorrect, what's the best way to get them to run it again to pull the proper results? Will they automatically re-run it at a set time/interval, or is there something I can do? Thanks...

Hello'Objective: Create smart group to report on systems that users have administrative rights.I created the extension attribute via script. It is accurately reporting accounts that have administrative rights. The problem is when I create the logic for the smart group there is no way for me to differentiate/exclude from known admin accounts. There are three possible admin accounts that may exist on a given system. When I create the criteria logic I make an entry for each that "is not" admdsk, and/or "is not" mbadmin and finish with "is not" blank. tried every possible combination of and's an or's with and with out parentheeses to no avail. I'm pretty sure this will require a appended script that will exclude the known accounts before output. I'm guessing this is an issue because the script output is multiple account name separated by a space. Here is the existing script that makes the extension attribute output. !/bin/bash Scri

Hi All, We currently have extension attributes to pull McAfee EPM and EPO version numbers. We are looking for a way to pull the HotFix version number. Has anyone come across this yet? Thanks!

Does anyone know how to re-initate the first "whats new" pop-ups for office 2016?im doing some testing and i need the pop-ups to re-appear... do i just delete a plist or something?

I have a working Jamf Production server on prem but I've been asked to set up a mirrored Development server for testing. I only want to test scripts and basic user configurations to a single test Mac. No App Store Apps or imaging.Do I have to configure DEP and/or VPP on this dev server if I self-enroll this single test Mac?Thanks,Randy

Hello. I was hoping someone could point me in the right direction. I'm looking for a script/command to remove client side DNS entries which were manually configured. So say I configure my DNS for Wi-Fi as 1.1.1.1, I would like something in the background which would remove these entries. I've seen from apple docs that I can set DNS servers, but not delete them. networksetup -setdnsservers "Built-in Ethernet" 192.168.100.100 192.168.100.12

Hi, is there an easy way to prevent Zoom from automatically launching after installing? We want to push it out to a set of computers, but don't want it to automatically open.

I am looking to create a Smart Computer Group which targets all Mac laptops in my environment that are not encrypted. Specifically, I would like to isolate those which have Solid-State Drives (SSD) and EXCLUDE disk drive types that are using older, rotational hard disk drives (HDD). Additionally, I would like (if possible) to exclude any plugged in media like thumb drives and external drives that may be in use. This group should only target INTERNAL media only. However, I'm not sure if that is possible. Please review my current group criteria and let me know your thoughts. Thanks!

A few of the groups we support use FontAgent Pro 5 (server/client), so we're looking at packaging it for distribution. A quick peek at the Client for FAP Server.pkg raises no flags, it's actually a pretty clean package. So wrapping it shouldn't be a problem. Pushed to logged off computer without a problem. I'm fairly certain they'll ask us to package/deploy preconfigured to point to the FAP Server so I'm hoping someone here can enlighten us on what files (or commands?) need to be put into our wrapper so when we deploy it the users will not be prompted for the FAP Server address (FQDN). How is the serial number handled for client/server environments...or is it one of those "don't worry about it, the server is the only thing that needs to be licensed" jobbies? Also, is the Client for FAP Server.pkg intelligent enough to look for existing Creative Suite and QuarkXPress applications so it can install the required Plug-In or Xtension? The preu

Does anyone have any experience with packaging EndNote X7? We created a site installer which seems to work quite well (in the sense of retaining our licence and serial details), but I'm wondering how best to handle updates, and in particular how to disable end user update prompts. I've contacted Thomson Reuters support but if previous experience is anything to go by I'll get a standard not-very-helpful response.

Hi all, I've had a few issues where VPP applications would not install and after a fair while of investigation i found that the uername listed under MDM Capable Users is not the same as the login username, in most instances the AD account had been initially set up with an incorrect spelling and the JSS picked that up and kept it as the MDM Capable username. If i remove jamfframework and re-enroll it gets the correct username and the VPP applications install ok. I'd like to create an Attribute and smart group to compare the login username with the MDM Capable username and if there's a discrepancy i'll get notified. I can see MDM Capable username listed in the JSS but can't find a way to pull it into an Extension attribute to be compared with the login username, anyone know how to list MDM capable users from the command line ?

I have a wifi config profile that needs to be installed after the Mac binds with the AD. Currently, my users have to install it via self-service but I would like it to install automatically during the deployment automation. In order to connect to our WiFi, the Mac has to be bound with the AD first prior to being able to install the wifi profile. I need to automate when it runs because if it installs the network payload automatically if will fail due to it not being bound with AD yet. Is there a way to call a configuration profile with a custom trigger or script like you can do with policies?

Since iOS 11.3.1 was released, updates are not caching to the MacOS server app on 10.12.6 or on 10.13.4 is the caching service. This appears to be due to the url that the updates has changed domains from "appldnld.apple.com" to "updates-http.cdn-apple.com" and this is not whitelisted in the Server app. example from log 2018-04-26 17:23:07.431 #SudsCaLQ8/oL Request by "itunesstored/1.0" for http://192.168.74.155:49468/2018/ios/091-78097-20180419-1837C44A-4063-11E8-A17C-2CE0FBE594B0/com_apple_MobileAsset_SoftwareUpdate/348080d1ecd8fcb42ee21a48be506d66248db38a.zip?source=updates-http.cdn-apple.com denied because the source is not whitelisted2018-04-26 17:23:07.431 #SudsCaLQ8/oL Failed with status code 400, reason code 66 I have logged this with Enterprise Support case:100519636930 who have been able to replicate the issue also.

Hello - Short story: Endpoint 10.12.2JSS 9.93 Install log : Jan 6 13:57:54 MBP13 installd[326]: PackageKit: ----- Begin install ----- Jan 6 13:57:54 MBP13 installd[326]: PackageKit: Session UUID file exists - will not overwrite /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/PKInstallSandboxManager/FF15EA5B-2DC8-45A9-9589-1CEC8407B759.activeSandbox Jan 6 13:58:04 MBP13 installd[326]: PackageKit: Install Failed: Error Domain=PKInstallErrorDomain Code=112 "An error occurred while running scripts from the package “QuickAdd.pkg”." UserInfo={NSFilePath=postinstall, NSURL=file://localhost/Users/badmin/Desktop/QuickAdd.pkg, PKInstallPackageIdentifier=com.jamfsoftware.osxenrollment, NSLocalizedDescription=An error occurred while running scripts from the package “QuickAdd.pkg”.} { NSFilePath = postinstall; NSLocalizedDescription = "An error occurred while running scripts from the package U201cQuickAdd.pkgU201d."; NSURL = "file://localh

Hi, Just wondering if anyone is using Trend and having issues with navigating the kernel extension approval changes. I talked to Jamf support and as usual they have been more than great, their suggestion is to allow users to approve Kernel extensions via config profile, and enter the Team ID for Trend...However, Trend does not want to give me their Team ID and they state that Apple no longer allows their software to be pushed via "Third Party tool". If anyone is also going through this, or has a solution, I would love to hear from you.

Hey, Patch Reporting is currently looking for a non-existent Java 8 Build 152. They are only on Build 151. Is there anyway to fix this?

We are unable to search in the VPP portal. Every search comes up with no items found. This is happening across multiple portals and even hen not logged in. Apple System Status shows no problems at this time

Hello, I've been asked to push a script to select Macs that causes them to automatically login to the guest account. I've got a working script (below) to write to the necessary keys. However I've run into a really weird case where System Preferences shows the guest account is enabled and selected for auto login, however when I reboot I land at the login screen. I'm testing on a MacBook Air 13" that I internet recover between tests. Any Ideas? printf "$appName $(date): Enabling guest account... " sudo defaults write /Library/Preferences/com.apple.AppleFileServer guestAccess -bool true sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server AllowGuestAccess -bool true printf "$appName $(date): Done. " printf "$appName $(date): Setting Guest account to auto-login " defaults write "/Library/Preferences/com.apple.loginwindow" GuestEnabled -bool true defaults write "/Library/Preferences/c

Using JAMF's handy documentation, I am attempting to cache and then install cached using two policies to get macOS Sierra on eligible test clients. The caching works great (as it has in the past with other OS X versions) but I am now receiving errors within Self Service on various test computers. Each post the following errors. Our JSS is running v9.92. Any thoughts? Thu Sep 22 13:44:07 it-14648 jamf[3834]: Checking for policy ID 768... Thu Sep 22 13:44:08 it-14648 jamf[3834]: Executing Policy Install macOS Sierra Thu Sep 22 13:44:08 it-14648 jamf[3834]: Installing Install macOS Sierra... Thu Sep 22 13:44:11 it-14648 jamf[3834]: Preparing for in-place OS upgrade... Thu Sep 22 13:44:14 it-14648 jamf[3834]: Converting /dev/disk0s2 to CoreStorage before upgrading. Thu Sep 22 13:44:43 it-14648 jamf[3834]: Unable to find brtool. Unable to find brtool in /Volumes/OS X Base System: (null) Thu Sep 22 13:45:30 it-14648 jamf[3834]: Blessing in-place OS upgrade directory... Thu Sep 22 13:45:30 i

Hello,We have AD bound Macs and are using Office 365 (So the email address is first.last@university.edu and NOT UniversityID@universitu.edu) I've been trying to use : https://github.com/talkingmoose/Outlook-Exchange-Setup-5 by @talkingmoose But it doesn't seem to do anything except bypass the initial Outlook start up. Has anyone had any experience with the script? I usually image the machine with a stock 10.13.3 then I join it to Jamf using quick add.pkg which then installs our volume licensed Office 2016 package then I compiled a .PKG as per the wiki. Was my mistake installing office first or could it be somewhere else?

Are there instructions on how to add VPP to Jamf from Apple School Manager? In specific If I create a new content manager in ASM linked to a new location in ASM what do I need to do to add that content manager's VPP token to Jamf? If there are steps I need to do in ASM first those would be appreciated as well.

Since upgrading to 10.4.0 came out, I've now been getting notifications about "0 computer removed from DEP Wifi". Dep wifi is a config profile, but it's now every day at around 1am that these are coming through. Anybody else see this?

Hi Everyone, I'm working on an EA to check for the presence of a particular cert in the user's Login keychain.: #!/bin/bash currentUser=`stat -f '%Su' /dev/console` echo "Current username is $currentUser" fullName=$(dscl . read /Users/`whoami` RealName | grep -v RealName | cut -c 2-) echo "Full Name is: $fullName" firstName=$(echo $fullName | awk '{print $1;}') echo "First Name is: $firstName" CERTNAME=$firstName echo "Cert Name is $CERTNAME" if [[ `security find-certificate -c $CERTNAME /Users/$currentUser/Library/Keychains/login.keychain` ]]; then echo "<result>Installed</result>" else echo "<result>Not Installed</result>" fi exit 0 Basically, the certificate we're looking for always has the user's first name. The script returns the proper result (Installed) when I run the script locally on my Mac, but always returns "Not Installed" when deployed as an EA. Has anyone else ran in to this behavior before? At first I thought it was the "currentUser" v

Hi Folks, Just a quick one, I have created a configuration profile that promts users to change their passwords as this needed to be done. However, when I have then went to log into the management account on a users machine it seems that the password has changed. Does anyone know if the Management account password changes when pushing this config profile? I was under the impression that it shouldn't make changes to the management account.