Hey all,I just wanted to post my findings for those who didn't already know of the differences in the way you can license the Microsoft Apps for Mac and a big shout out to Paul Bowden for all his work and help understanding this. We had recently switched to O365 for our email but had been using a volume license for years. I kept reading about new features in Office 2016 that should have come out with various point upgrades, but I never actually saw some of the changes (the newest one was they added Microsoft Groups to the Mac Outlook Client). So after reaching out to @pbowden he illuminated us to the fact that if you have an O365 subscription, you are entitled to some extra features that don't come with the regular volume license. He also created a great Unlicence tool that has allowed me to make a policy for our staff to remove the Volume license and allow the user to login (to their 365 account) and have it enable the extra features (like groups in outlook). https://github.com/

Maybe not the best place to put this but i've seen some talented people here so let's give it a shot. We are looking into deploying LogMeIn on our PCs and Macs, and of course it works as intended on PC but not on Mac... For those familiar with LogMeIn they have this "host preference" that pre-defines the settings on the host computer.This doesn't work at all on Mac, and because of that I'm looking into setting the settings manually via scripts and so on. Long story short, they use this XML which contains the settings, and what I want/trying to do is to find the following line: <dword name="AllowLoopback">0x0</dword> When this is found, I want to add the following lines under this line: <dword name="AskForPermissionDefault">0x0</dword> <dword name="FullCtrlBypassUsrPerm">0x0</dword> <dword name="PermissionTimeout">0x1e</dword> <string name="PermissionText">Lots and lots of text</string> I have used sed before but I can't

This was asked during JNUC last year, and the response from Charles Edge at the time suggested it was possible. We haven't heard anything. Can we get an idea if Jamf is planning this?

I'm curious as to if there is a way to use the api inside of a plist to make an api call to get a users room number. I'm trying to automate our lanschool deployment a little more which uses a plist to configure the settings. We use the room number for each teacher's channel and instead of having to manually install it, it would be nice to have this automated in a config profile. If it isn't possible I can try doing it in a script with defaults write

Hello, I'm attempting to make a report in JSS to find the local users for all of our enrolled units. Any advice on the simplest way to get this done? Report Serial + Local User

I've added a restricted process for the App Store in the JSS so any user will find they're unable to launch it via /Applications or Spotlight (the process gets killed immediately). However, I find that they can still launch it via Apple Logo > App Store... or Apple Logo > Software Update... How can I prevent this? I want my users to use purely Self Service.

Hi JN, Trying here first before I open a support ticket. Basically, I am looking to find out if this is a known issue or undocumented feature. I have a policy in Self Service that installs a bunch of tools related to being a site Admin. It consists of the JAMF Suite, MacUserGenerator, Autopkgr, etc. One of my site Admins still has El Cap Macs in their labs and needs to package stuff for it. On her test fresh El Cap test machine, the policy fails with the following. On Sierra and High Sierra, the policy runs and everything is successful. I have tried it on fresh installs of both here at my desk on different machines and can reproduce the issue. The policy tries to mount the share a second time on the El Cap Mac for some reason. Any ideas? [STEP 1 of 11]Executing Policy WSM JAMF PRO & TOOLS[STEP 2 of 11]Mounting IT1xxxxxxVerifying package integrity...Installing AutoCasperNBI.dmg...Closing package...[STEP 3 of 11]Mounting IT1xxxxxxxVerifying package integrity...Installing Auto

Installed Composer 10.2.1 (by dragging to applications folder) on a fresh 10.11.6 systemdouble click to launch it. Asks for Password, press enter, launches new icon in doc. Then nothing.Go to composer file menu, then composer window pops up and says its taking a snap shot??If I click on new it opens the choose method window but has no icons to click on.Any idea what is going on?

Hi all, We are running about 1000 Macs, which are all bound to our AD.On top of this we are running NoMAD on all these machines, which is working wonderful, and we have also disabled the login notification by deploying this to all computers (after the AD bind is done): #!/bin/sh defaults write /Library/Preferences/com.apple.loginwindow PasswordExpirationDays 0 Now to the issue, a couple of months ago we went from the default 90 days to 180 days password expiration and the Macs don't want to understand this change.This means that when NoMAD comes down to 90 days, our Macs doesn't allow our users to login without changing the password. This change is set via custom user policies in the AD, meaning the system default is still 90 days. So, have anyone else encountered this and/or how did you solve this?I also don't need to point out that the PCs have no problem following this change :P

Hey guys, We have about 100 MBP laptops that are available for student use. They are AD bound with no mobile profiles and we are running into issues where the wifi on the laptops is turned off or changed to another network. ive used the restriction in the system preferences, but they can still click on the icon in the top bar and change anything. Id love to hear what you guys have done to work on this.

I have a maintenance process, let's call it, that could take awhile to execute. I want to use jamf policy to manage it. I'm trying to avoid creating a launchdaemon for this because it's temporary. It could take hours and part of the script has a hard cutoff after 10hours. I also want this to execute at 9-10pm at night during reoccurring checkin. At 10:01, I no long want this maintenance process to run. Would setting the client side limitation to not run between 10pm to 9pm work to accomplish this? Again, I want a maintenance process to run at 9-10 pm start time ONLY. Thanks in advance, you guys are the best.

We import our information from Infinite Campus to Apple School Manager, and then on to the JSS. My question is there any way to edit the classes that are imported from ASM. I need to add teachers locally to the classes as they aren't added in Infinite Campus. I tried to clone the class, but they to are unable to be edited since it came from ASM. Any ideas?

Does anyone know if it is possible to pass the default script parameters and/or the custom parameters to an applescript? It's easy enough to pass to a shell script, but I can't quite seem to figure out any syntax that will use the script parameters in an applescript. If you've managed to do this could you give a quick sample of the syntax you used to utilize the parameter as a variable?

In Patch Management logs the Date/Time entry shows NaN minutes ago. Anybody else having this problem? I remember that we never had a correct date time in Patch Management in previous Jamf Versions before. Since now no Jamf updates corrected this issue for us.JAMF 10.2.0

I've seen a lot of scripts managing Microsoft Autoupdate, but for years we have simply blocked the executable named Microsoft AutoUpdate found from the path here (and probably I went through the process of finding it's name through) ps -ef | grep AutoUpdate | grep -v grep 33849 3595 1 0 11:38AM ?? 0:00.42 /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft AutoUpdate 33849 3596 1 0 11:38AM ?? 0:00.17 /Library/Application Support/Microsoft/MAU2.0/Microsoft AutoUpdate.app/Contents/MacOS/Microsoft AU Daemon.app/Contents/MacOS/Microsoft AU Daemon But now with Office 2016, or MAU 3.x probably, the blocked executable doesn't work anymore. Did I miss some massive change that would be causing that? After realizing that, I went and started looking at this, and am also now blocking Microsoft AU Daemon since that was not being blocked, but that does not seem to kill the process either. Thoughts? Do I need to mo

Hey All, Wondering if anyone out there has: A) installed or worked with Digital Guardian DLP software for Mac?B) successfully created an extension attribute that reports the agent version installed?C) mastered the rare art form of text manipulation in the command line and can help me regardless of the software I'm reporting on? DG's command line binary, "dgctl" has an easy way to report on the currently installed version by typing the following into a Terminal window: "dgagent/dgctl --version" which outputs the following (excessively verbose in my opinion) info: 2017-03-03 16:55:14.968 dgctl[19465:70794] DGAgent for Mac OS X version 7.1.4.00042017-03-03 16:55:14.969 dgctl[19465:70794] OK I've tried piping into tools (and combinations thereof) using sed, grep, awk, cut etc. and no matter what I try, I just get a blank response and no output. I'm looking to cut out everything except the "7.1.4.0004" ideally, but getting frustrated that I can't seem to modify the text at all. Even

I recently took over the JAMF management at my organization and only recently have attempted to deploy paid VPP apps to iOS devices. I have experienced zero issues with free apps, but the paid apps will not deploy. I purchased 12 licenses of "The Wonder Weeks" through our VPP account with "managed distribution." The apps showed up in our Mobile Device Apps, but have Codes listed next to them. When trying to scope the app to mobile devices, it either gets stuck in pending or fails immediately. The management for the scoped devices says "Pending - Application is not available to install." I have attempted to install automatically, or make it available in Self Service. If I attempt to install it automatically, it never shows up on the device. If I make it available in Self Service, it shows up in Self Service, but spins endlessly when you hit install and never actually starts. I have made sure our VPP account and token are up to date, that the VPP account and app are assigned to the sa

what is a way to enroll a Windows computer ?

The most recent release of PrintNode has an incorrect CFBundleVersion value ("4.0.0"), but the app appears to work normally after using defaults write to update that value and add a CFBundleShortVersionString value: defaults write /Applications/PrintNode.app/Contents/Info.plist CFBundleVersion 4.17.14 defaults write /Applications/PrintNode.app/Contents/Info.plist CFBundleShortVersionString 4.17.14

I'm trying to determine if a Mac is On or Off the Corporate Network when scoping policies and a found @Rosko Joshua Roskos process on his git hub page https://github.com/jamfprofessionalservices/macNetworkLocation The Issue I have run into is the API user w/ the following permissions:Read & Update permission for Computer ObjectsRead permission for Computer Extension Attributes I found Computer Extension Attributes but not Computer Objects, there is Computers but if I give this Read & Update permission the script fails at "Sending network location to Jamf Pro..." If I give the API user full admin permission the script is successful, so just need to fins out what permissions the API account needs

Hi I have a 10.13.3 .nbi file which I use the same file on various Mac mini's in different offices for reinstalling macOS however on one particular mac seems to cause the clients to kernel panic or come up with the prohibited symbol when loading to it from the network. Has anyone come across this?Have replaced the .nbi file /restarted the Mac, turned off and on the service, recreated the NetBootSP0 folder however no go. Any ideas? Thanks in advance Simon

I was looking for a way to turn some of the power save features off through Casper and I was looking at the Energy saver section of Configuration Profiles. I see "put the computer to sleep after" and "put the display to sleep after", but the range is 1 minute to 3 hours. I was looking for a way to set both of those to never. Is there a way to do that?

when i enroll a computer running fresh installation of 10.13. using the quickadd.pkg i will check on the 'profile' in system preferences , the MDM profile has the yellow alert icon and the description says functionality may be limited until this profile is approved so i manually approve it. Has anyone else seen this ??

When deploying a Configuration Profile to request an Active Directory device Certificate from our Microsoft 2008 Certificate Authority, the profile installs successfully and the certificate appears in Keychain Access. When deploying a Configuration Profile to request an Active Directory device Certificate from our Microsoft 2012 Certificate Authority, the profile installs successfully but the certificate fails to appear in Keychain Access. We migrated all of the existing certificates, configurations, templates and settings from our Microsoft 2008 Certificate Authority to a separate Microsoft 2012 Certificate Authority, so I'm assured nothing has changed there. The only lead I have managed to locate may possibly be related to the enhanced security being enabled by default on Microsoft Server 2012 (http://technet.microsoft.com/en-us/library/hh831373.aspx#BKMK_Security). Has anyone else experienced this issue with Microsoft Server 2012 and ultimately what was the solution? We cou

I'm trying to set up an extension attribute to capture the version of the Printer Logic Client. The only location I can find the version is within a file that has no extension located within this folder, 'opt/PrinterInstallerClient/' titled 'VERSION' My attempts to simply read the contents are not succeeding given the lack of a file extension by default. I might be missing something simple, but does anyone have any thoughts on how I might be able to script this extension attribute?