Any chance someone has already done the work to write an EA that can detect if a system has a recovery partition?

I'm currently on 9.96 and unable to log into the JSS with either LDAP credentials or the local admin account. What happens is when I try to login, the page refreshes and the JSS URL redirects to https://jss.mycompany.com:8443/logout.html. This is happening on all browsers on multiple computers and multiple LDAP credentials. This did not occur yesterday at all. Any ideas on what I can do?

Hi Everyone I found a "product issue". If I run a script with Jamf Pro 10 with an exit code 1 the policy will have a failed status. #!/bin/sh exit 1 I f I run the same script with the Files and Processes > Execute Command option it will not recognise the exit output. For example /usr/local/bin/my-script.sh Any idea for a workaround?

Lately I've been encountering an issue when configuring new MacBook Pros. We're currently using a thin-imaging workflow that looks like this:1. NetBoot MacBook to Imaging Server2. Without erasing the drive, we install a small package (used to create smart groups), name the computer, and the computer restarts.3. After restarting, the computer begins to run policies to install and configure software. This process works flawlessly for iMacs, but the new MacBook Pros are never enrolled in JAMF, and therefore never complete configuration. The workaround is to boot into Internet Recovery, wipe the drive, and reinstall MacOS, then start from step 1. This works almost every time. To me, this defeats the purpose of thin imaging the computer in the first place, and creates extra work and confusion for our techs. Has anyone else come across this, and are there any easier solutions? I'll add that we're on JAMF 10.0.0, but will be updating to the newest version in the next 2 weeks.

I am testing mm2270's UpdateCoreApps script and am having trouble with a few parts of it. Some parts are working like VLC. However, I'm getting the following errors when I try to install/update: Firefox:[Stage 1]: Determining current version of Firefox...HTTP/1.1 200 OKstuff removedWe have internet access, but couldn't pull version information for Firefox. Java:[Stage 1]: Generating UserAgent string...[Stage 2]: Determining current version of Oracle Java...HTTP/1.1 200 OKstuff removedWe have internet access, but couldn't pull version information for Oracle Java. Silverlight:[Stage 1]: Determining current version of Flash Player...Error when getting the download information Do I need to update the download urls?

Is there a way I can turn off Netinstall service with a script?

Greetings. I'm trying to find the best way to configure smart group criteria to detect a MacBook that doesn't have their recovery key setup in the JSS.I have a workflow to send these folks whose key is missing, but the criteria to setup a smart group doesn't seem to pick them up. We do not use Institutional keys, only personal and I do have a key-redirection config profile in place. Anyone have a working smart group to pick up when recovery keys are "Not Configured" in Jamf Pro and wouldn't mind sharing the search criteria? I've tried multiple ways and when I do it and spot check a few machines, they actually have keys in the Jamf Pro server. Thanks.

Hi, So, this weekend crashed our virtual storage platform for al our VM's, like also our Jamf Pro environment.After a succesful reboot of the machine we have logging output shown belown, also some functions are not working properly like creating a smartgroup. 2018-03-05 19:09:25,565 [ERROR] [neralPool-4] [CRUDObjectHistory ] - Error inserting object history: java.sql.BatchUpdateException: Duplicate entry '5051134' for key 'PRIMARY' Query is: INSERT INTO object_history (object_type, object_id, username, details, timestamp_epoch, object_description) VALUES(?, ?, ?, ?, ?, ?) Query is: INSERT INTO object_history (object_type, object_id, username, details, timestamp_epoch, object_description) VALUES(?, ?, ?, ?, ?, ?) at org.mariadb.jdbc.MariaDbServerPreparedStatement.executeInternal(MariaDbServerPreparedStatement.java:378) at org.mariadb.jdbc.MariaDbServerPreparedStatement.execute(MariaDbServerPreparedStatement.java:342) at org.mariadb.jdbc.Mar

First some Basic Background We are beginning to Use Apple DEP for new MAC's, so when they come, fresh out of the box, the user gets no Options, the MAC immediately looks at DEP and gets pointed at out JamfPro Cloud. This is working great, we Have a Prestage Enrollment set up and working, so we just Add the new machine to the Scope and all is peachy. The problem is that as an out of the box machine, it will default to a generic name "iMAC" or "MacbookPro" or "Mac Mini", this is no good to me as we have a strict naming standard to follow. The Prestaging via DEP does not seem allow for assigning a name in advance on a per machine basis, and believe me, although it would be useful to simply get the users to enter the name at a prompt, it's a no go option, and we want to try and make this as automated as possible. So we are now looking like waiting for the machine to be plugged in, and as soon as it Enrolls we just manually update a field on its object and at next check in it will rena

This is for my Zero Touch deployment. After Enrollment, I apply a few "Enrollment Completed" policies, and then reboot.Immediately after reboot I have a Bunch of Startup Policies, but they wont run at boot until the first policy refresh. Is there some sort of standard delay or way I can ensure that the Check In Preferences have applied, or force them to apply before my reboot ??

I have been baking my noodle on this one for a while now to see if can come up with a Login script that will take the $3 variable from Jamf and compare it with the "fdesetup list" and if the user is not on it, to add them, and either pop up a second password box, or take the one they entered on login and automate it. Nobody but IT can create local users on our machines, so the idea is that when a new AD user logs in and gets their Mobile Account created, it instantly adds them to FV2. I just cannot get my head around structuring the output of fdesetup list so i can get if else check set up that will work, before i even get to using the data to add to the FV2 list. Thoughts anyone ?

I have a Policy that Enabled FileVault. The Issue is that contrary to Apple Documentation, on El Capitan it sits in Limbo until the next reboot !! This is the message we get. Recovery key = '(...)'FileVault is Off, but will be enabled after the next restart. FileVault reports in JAMF as Enabled and the Recovery Key is Stored, but the MAC itself wont do anything FileVault related, which very annoyingly includes doing an Authenticated Reboot. So when I am encrypting a MAC in another country, I have to ensure there is someone in front of the Machine that I can furnish with the Recovery Key or a password so on the first reboot they can unlock it. After that I can do authenticated reboots as often as i like. This majorly sucks, I am assuming there is something peculiar about how JAMF manages the initial Enablement of FileVault. Anyone have any ideas on how to work around this ? Or why this is different ?

For a while now I've been using the createinstallmedia tool built into Install OSX installer apps to build bootable OS installers from USB. However, I want to create either a NetInstall or NetRestore image such that I can boot machines to our Netboot server and only install the desired Mac OS so my colleagues can use this as well. Don't want this to have anything to do with the JSS (jamf pro). Thus far, my attempts to do this haven't worked. Here's what I've tried: Build NetInstall Image w/ System Image Utility1. Download OSX Installer app2. Make OSX Installer app the source in System Image Utility and leave default settings. (this successfully builds).3. Once built, I upload to /Library/Netboot on our Netboot server. Change the "Make available over" setting to NFS from HTTP (but I've tried both ways with same results below).4. Reboot and hold down option on test machine I want to install on and see the Netboot. As soon as I select the Netboot, however, instead of booting to the

Hello, Just wondering if anyone else has seen the following behaviour on any macOS High Sierra clients? We add the printers using a script within Casper, but we have seen the issue occur with adding the printer via System Preferences > Printers & Scanners GUI. In short the client's printer queue's do not clear out the job, and the printer object is paused, despite the job printing correctly. Client sends a print job. Print job appears in the printer's queue on the client. Print job appears in the printer's queue on the server* Print job remains in the client queue with a status of "Ready to Print" Additional jobs back up in the queue due to the paused state. Deleting the jobs in the client queue and resuming the printer allows a user to print, however the issue simply re-occurs. PrintServer is Windows Server 2016 Standard. Most client printer objects use their model-specific driver, with exception to a couple that use the "Generic PCL Laser Printer" driver. We have wi

It seems we are stuck in the middle of the Symantec ssl debarcle (rapidssl in our case) and our renewee Trustico. It seems trustico yesterday revoked our wildcard certificate by sending our private keys to Symantec causing a mandatory 24 hour revocation due to security. Apparently this happened to many many certificates. Both parties seem to be offering free renewal, leading me to believe this is trustico (or their suppliers) making a pass to grab business off the troubles Symantec, now DigiCert Back to the question: if I renew my exact same certificate through a different ca, but same details ( wildcard cert of *.school.com for example won’t change, just different root ca’s) will that cause my currently enrolled iOS devices to drop off and no longer be able to check in and communicate? Obviously if I change the server name, it breaks, but only changing the actual CA provider, not cert name, will that be fine?

Good morning!We are starting to have an increasing issue with activation lock on devices, that were previously "repaired" at a local Apple Store. When we get the refurbished device, i have no way of linking the old device serial number that would be in our proof of purchase to the new device. How do you get around this issue? When emailing the unlock team they ask for a proof of purchase, but since i dont technically have that, im in a bit of a bind. Thoughts?Regards,Dylan_YYC

The branded Self Service icon is not "sticking" on a lot of our clients. The icon works when the program is open, but as soon its closed it reverts back to Jamf standard Self Service icon. Both in dock and under /Applications. Is this a common issue? This creates some confusion amongst our users.

When I look at the status of my managed Macs for a specific software title in Patch Management, I see that each Mac shows as having checked in "NaN minutes ago". I saw this prior to Jamf Pro 10.2. Has anyone else seen this? If I click the link to the Mac, to go to its page in Jamf Pro, it looks normal. It shows a time for the last check-in. Attached is a screenshot of how my MacBook Pro shows up in the Patch Management policy for Google Chrome. All Macs show up this way

I have my Prestage for one of my sites to them to prefix-serial. For some reason this is not occurring though, they are just being named "iPad". I don't know what other settings I need to look at but what else should I be doing here?

Hi All, Having issues with Self Service for reasons unknown?! Looks like someone had edited the permissions which broke the share but this was fixed and put back to normal but no one can install packages. The share can be mounted manually and packages run. Please see attached my permissions and the error in jamf log which is no help at all. Top is windows server permissions second is what mac users see.

I have a site that has their own Admin team. They are new to JAMF and I am training them up. They have about 175 managed Macs in their Site. Recently (they are not sure exactly when), an Active Directory user will log into one of the Macs. The profile gets created in /Users/ just fine but the twist is that an additional profile is created in the root of the drive too. Nothing has changed that they can point to. I will include a screen grab from one of their test machines (ignore the PS Elements in the root, that is a training issue I have resolved). I have combed through their packages and I do not see anything that might cause this. Note the AD accounts: rdiddelbkimuramtevans This is a weird one, but I am reaching out to the JN to see if you have seen this before. TIA, /randy

Hello,All of the sudden we are seeing a lot of our Macs getting the error message of: No Self Service Items are availableNo Authorization I saw a prior post that mentioned checking the selfservice cache location, along with Safari cookie settings. I checked and cleared those areas on my Mac, but am still getting that error. We are still running JSS v9.6, but this just started up today. Our Self Service is configured to allow authentication, but not require it. I've tried rebooting our JSS, but still am getting that error message. Any thoughts on this? Tim

I'm often taking over new computers in my position, as I imagine many of you might. Sometimes it would be nice to enroll a new company or group of computers into the JSS but have then not immediately be managed in anyway. I suppose an inventory check would be the most of it. I suppose this would be considered an evaluation step. Allows me to analyze what is on the machines before doing anything to the machines. I have considered creating a second JSS just for this purpose but you can imagine how must more work that might be for this process. If there was a default site that I could enroll into that would not have any current policies applied to it for it's outside of all scopes. Call it a NULL assignment. In this assignment nothing can be done to the computer but gather inventory. Is this currently possible?

Running into a new one that I've not encountered before. We use Centrify to bind to AD. I have a fairly simple EA, which basically uses Centrify's "adquery" command to pull the computer's .ou and stick it into the computer record. This allows us to sort machines by their .ou in AD. When I run "sudo Jamf -recon", it seems to update perfectly, no issues. However, if I let it sit for more than a day or so, the values start to disappear. Right now, I only have a SINGLE computer still reflecting a value (we update inventory daily). Forcing an inventory update via Jamf Remote will re-populate the values, and then again, within a day or two, I see the fields start showing up blank again. thoughts? Any suggestions on where to even start? EA below for reference, although again, seems to work 100% when I run recon manually. #!/bin/bash Machine=$(hostname -f | cut -f1 -d".") OU=$(adquery user $Machine$ -C | cut -d"/" -f2) echo "<result>$OU</result>" exit 0

Hi, Apple just released macOS 10.13.3 Supplemental Update, so my client was already on 10.13.3 but got the update available. When not applied recon breaks, when applied recon works again. Try modifieng the .xml file when JSS breaks. Thijs.