I have been baking my noodle on this one for a while now to see if can come up with a Login script that will take the $3 variable from Jamf and compare it with the "fdesetup list" and if the user is not on it, to add them, and either pop up a second password box, or take the one they entered on login and automate it. Nobody but IT can create local users on our machines, so the idea is that when a new AD user logs in and gets their Mobile Account created, it instantly adds them to FV2. I just cannot get my head around structuring the output of fdesetup list so i can get if else check set up that will work, before i even get to using the data to add to the FV2 list. Thoughts anyone ?

I have a Policy that Enabled FileVault. The Issue is that contrary to Apple Documentation, on El Capitan it sits in Limbo until the next reboot !! This is the message we get. Recovery key = '(...)'FileVault is Off, but will be enabled after the next restart. FileVault reports in JAMF as Enabled and the Recovery Key is Stored, but the MAC itself wont do anything FileVault related, which very annoyingly includes doing an Authenticated Reboot. So when I am encrypting a MAC in another country, I have to ensure there is someone in front of the Machine that I can furnish with the Recovery Key or a password so on the first reboot they can unlock it. After that I can do authenticated reboots as often as i like. This majorly sucks, I am assuming there is something peculiar about how JAMF manages the initial Enablement of FileVault. Anyone have any ideas on how to work around this ? Or why this is different ?

For a while now I've been using the createinstallmedia tool built into Install OSX installer apps to build bootable OS installers from USB. However, I want to create either a NetInstall or NetRestore image such that I can boot machines to our Netboot server and only install the desired Mac OS so my colleagues can use this as well. Don't want this to have anything to do with the JSS (jamf pro). Thus far, my attempts to do this haven't worked. Here's what I've tried: Build NetInstall Image w/ System Image Utility1. Download OSX Installer app2. Make OSX Installer app the source in System Image Utility and leave default settings. (this successfully builds).3. Once built, I upload to /Library/Netboot on our Netboot server. Change the "Make available over" setting to NFS from HTTP (but I've tried both ways with same results below).4. Reboot and hold down option on test machine I want to install on and see the Netboot. As soon as I select the Netboot, however, instead of booting to the

Hello, Just wondering if anyone else has seen the following behaviour on any macOS High Sierra clients? We add the printers using a script within Casper, but we have seen the issue occur with adding the printer via System Preferences > Printers & Scanners GUI. In short the client's printer queue's do not clear out the job, and the printer object is paused, despite the job printing correctly. Client sends a print job. Print job appears in the printer's queue on the client. Print job appears in the printer's queue on the server* Print job remains in the client queue with a status of "Ready to Print" Additional jobs back up in the queue due to the paused state. Deleting the jobs in the client queue and resuming the printer allows a user to print, however the issue simply re-occurs. PrintServer is Windows Server 2016 Standard. Most client printer objects use their model-specific driver, with exception to a couple that use the "Generic PCL Laser Printer" driver. We have wi

It seems we are stuck in the middle of the Symantec ssl debarcle (rapidssl in our case) and our renewee Trustico. It seems trustico yesterday revoked our wildcard certificate by sending our private keys to Symantec causing a mandatory 24 hour revocation due to security. Apparently this happened to many many certificates. Both parties seem to be offering free renewal, leading me to believe this is trustico (or their suppliers) making a pass to grab business off the troubles Symantec, now DigiCert Back to the question: if I renew my exact same certificate through a different ca, but same details ( wildcard cert of *.school.com for example won’t change, just different root ca’s) will that cause my currently enrolled iOS devices to drop off and no longer be able to check in and communicate? Obviously if I change the server name, it breaks, but only changing the actual CA provider, not cert name, will that be fine?

Good morning!We are starting to have an increasing issue with activation lock on devices, that were previously "repaired" at a local Apple Store. When we get the refurbished device, i have no way of linking the old device serial number that would be in our proof of purchase to the new device. How do you get around this issue? When emailing the unlock team they ask for a proof of purchase, but since i dont technically have that, im in a bit of a bind. Thoughts?Regards,Dylan_YYC

The branded Self Service icon is not "sticking" on a lot of our clients. The icon works when the program is open, but as soon its closed it reverts back to Jamf standard Self Service icon. Both in dock and under /Applications. Is this a common issue? This creates some confusion amongst our users.

When I look at the status of my managed Macs for a specific software title in Patch Management, I see that each Mac shows as having checked in "NaN minutes ago". I saw this prior to Jamf Pro 10.2. Has anyone else seen this? If I click the link to the Mac, to go to its page in Jamf Pro, it looks normal. It shows a time for the last check-in. Attached is a screenshot of how my MacBook Pro shows up in the Patch Management policy for Google Chrome. All Macs show up this way

I have my Prestage for one of my sites to them to prefix-serial. For some reason this is not occurring though, they are just being named "iPad". I don't know what other settings I need to look at but what else should I be doing here?

Hi All, Having issues with Self Service for reasons unknown?! Looks like someone had edited the permissions which broke the share but this was fixed and put back to normal but no one can install packages. The share can be mounted manually and packages run. Please see attached my permissions and the error in jamf log which is no help at all. Top is windows server permissions second is what mac users see.

I have a site that has their own Admin team. They are new to JAMF and I am training them up. They have about 175 managed Macs in their Site. Recently (they are not sure exactly when), an Active Directory user will log into one of the Macs. The profile gets created in /Users/ just fine but the twist is that an additional profile is created in the root of the drive too. Nothing has changed that they can point to. I will include a screen grab from one of their test machines (ignore the PS Elements in the root, that is a training issue I have resolved). I have combed through their packages and I do not see anything that might cause this. Note the AD accounts: rdiddelbkimuramtevans This is a weird one, but I am reaching out to the JN to see if you have seen this before. TIA, /randy

Hello,All of the sudden we are seeing a lot of our Macs getting the error message of: No Self Service Items are availableNo Authorization I saw a prior post that mentioned checking the selfservice cache location, along with Safari cookie settings. I checked and cleared those areas on my Mac, but am still getting that error. We are still running JSS v9.6, but this just started up today. Our Self Service is configured to allow authentication, but not require it. I've tried rebooting our JSS, but still am getting that error message. Any thoughts on this? Tim

I'm often taking over new computers in my position, as I imagine many of you might. Sometimes it would be nice to enroll a new company or group of computers into the JSS but have then not immediately be managed in anyway. I suppose an inventory check would be the most of it. I suppose this would be considered an evaluation step. Allows me to analyze what is on the machines before doing anything to the machines. I have considered creating a second JSS just for this purpose but you can imagine how must more work that might be for this process. If there was a default site that I could enroll into that would not have any current policies applied to it for it's outside of all scopes. Call it a NULL assignment. In this assignment nothing can be done to the computer but gather inventory. Is this currently possible?

Running into a new one that I've not encountered before. We use Centrify to bind to AD. I have a fairly simple EA, which basically uses Centrify's "adquery" command to pull the computer's .ou and stick it into the computer record. This allows us to sort machines by their .ou in AD. When I run "sudo Jamf -recon", it seems to update perfectly, no issues. However, if I let it sit for more than a day or so, the values start to disappear. Right now, I only have a SINGLE computer still reflecting a value (we update inventory daily). Forcing an inventory update via Jamf Remote will re-populate the values, and then again, within a day or two, I see the fields start showing up blank again. thoughts? Any suggestions on where to even start? EA below for reference, although again, seems to work 100% when I run recon manually. #!/bin/bash Machine=$(hostname -f | cut -f1 -d".") OU=$(adquery user $Machine$ -C | cut -d"/" -f2) echo "<result>$OU</result>" exit 0

Hi, Apple just released macOS 10.13.3 Supplemental Update, so my client was already on 10.13.3 but got the update available. When not applied recon breaks, when applied recon works again. Try modifieng the .xml file when JSS breaks. Thijs.

I set up my macbook using a public wifi and jamf was installed. I took it to apple and they couldn't do anything i did some digging and found this software on my macbook. I want it removed asap. I just bought it and can't do anything. It's preventing me from having any rights whatsoever.

Hello All, I get the following error on all newly deployed iOS devices with self service app installed. Error - The required managed settings where not recieved. Any ideas?

Hi All, We have different software configurations that we apply depending on where the machine is going. I'll go ahead and mention that due to legal reasons well above my pay grade we can't use DEP. I'm trying to setup policies in self service that will install the software for a specific configuration by calling a custom trigger. So I can offer the applications through self service individually, or I can have a user select a configuration "bundle" and it will install all the applications tagged with that specific event trigger. The way I'm trying to go about this is by essentially stacking policies. For instance, I have a base policy that all it does is run the command 'jamf policy -event baseInstall' that installs basic software every machine should have (Chrome, Office, etc) Then I have another policy (let's say Workstation) that will execute a script that runs the command 'jamf policy -event workstationInstall' that installs workstation specific software and then runs the command

We have an odd behavior effecting DEP enrollment on Jamf Pro 10.1.1. These Macs complete the Setup Assistant as expected based on our PreStage Enrollment settings, however the Jamf agent fails to install. We get the following in jamf.log Enrolling computer... Wed Feb 07 13:54:01 MacBook Pro jamf[619]: Error Domain=com.jamf.jamfsecurity.error Code=-25300 "searchForItems:conversionBlock:error: : The specified item could not be found in the keychain." UserInfo={NSLocalizedDescription=searchForItems:conversionBlock:error: : The specified item could not be found in the keychain.} Wed Feb 07 13:54:01 MacBook Pro jamf[619]: Error submitting enrollment status to the JSS: Security Error - A security error has occurred. Wed Feb 07 13:54:01 MacBook Pro jamf[619]: There was an error. Error enrolling computer: Invalid Message - The message could not be parsed. The Mac has the MDM Profile installed but nothing else. Running "sudo jamf enroll -prompt" or downloading the quickadd.pkg from the

Running JSS 9.101.0-t1504998263. after updating any device to iOS 11, devices stop communication with the jamf server. tried to wipe a device and reconfigure, i get to the remote management page and it tells me " The configuration for your ipad could not be downloaded from....... Canceled." anyone else having this problem?

I have several iPads that we were managing (poorly) that we are trying to migrate from our old server into the new server of jamf. I am running into the issue where one device I have has been entered into DEP via deploy.apple.com and the device is displayed in our pre-stage enrollments. However, when walking through the setup process for this iPad, it never actually enrolls into our new jamf server. The device stays in unassigned in our pre-stage enrollment. Our new server of jamf is a cloud server. We have no issues with brand new devices being enrolled into our new jamf server. The iPad is on iOS 11.2.5.

I recently began testing a script that calls jamfHelper in full screen mode, this time as a Self Service policy. The script behaves normally except when executed from Self Service. The full screen window will not disappear, but I can manually dismiss it via Command+Q on the machine itself. Am I missing something here? I have tried killing jamfHelper every JAMF documented way, and also via kill -9 <pid> and killall -m jamfHelper. Nothing works except Command+Q. The script is a modified version of the Apple Software Update helper script created by lisacherie.

We are having with 10.11.x Casper Imaging. Our problem is that after the OS installs and restarts to install additional software, the machine boots to the Temp Adobe Admin account and remains on the desktop until the installation is complete. I have a ticket open with JAMF Support, but so far we haven't been able to establish a root cause. The problem follows to all El Cap versions, no matter how it is imaged, regardless if it is Netboot or target disk mode. Even just the installer from the Apple store with a just a single software pkg will produce the problem. We running 9.91. Is anyone else having this problem? Any help would be appreciated. Thanks!!

I wrote a script to rewrite the computer name. We're using Enterprise Connect, and I have a bash script that's deployed (pkg) to /Library/Scripts/ec, and then gets executed to write the computer name to /tmp/ecUser: #!/bin/bash echo $1 > /tmp/ecUser exit 0; Here's the script that gets executed, per policy: #!/bin/bash if [ ! -f /tmp/ecUser ]; then jamfUser=$( echo $3 | sed 's/./-/g' ) /usr/sbin/scutil --set ComputerName $jamfUser /usr/sbin/scutil --set LocalHostName $jamfUser /usr/sbin/scutil --set HostName $jamfUser echo $jamfUser else ecUser=$( cat /tmp/ecUser | sed 's/./-/g' ) /usr/sbin/scutil --set ComputerName $ecUser /usr/sbin/scutil --set LocalHostName $ecUser /usr/sbin/scutil --set HostName $ecUser echo $ecUser fi exit 0; Here is the result from the policy, in this case the username is coming from /tmp/ecUser, which is matt.marshall, rewritten to be matt-marshall: Executing Policy e Change Computer Name Running script Change Co

Has anyone been able to install CB Response via self service. I created a package with the following steps in composer: private mpCBResponsefilename.pkg post install script: #!/bin/sh ## postinstall sudo installer -pkg "/private/tmp/CBResponse/CBResponseClientSetup.pkg" -target / delay 60 sudo rm -r /private/tmp/CBResponse exit 0 ## Success exit 1 ## Failure Self service reports a successful installation but the computer doesn't show up as a sensor. If I run the pkg on a computer and go through the prompts it installs just fine.