Afternoon Jamf Nation We are switching from Profile Manager to Jamf Pro in the coming months, and I have been tasked with this transition. One of the things that I am having trouble with is our Code Signing Certificate. It expires next month (which I'm not sure is beneficial or detrimental), and our higher ups want to continue to have that that nice green checkmark that says Verified when a device is manually enrolled. Problem is I didn't setup and implement our original Code Signing Certificate with Profile Manager, so this is my first time in that particular rodeo. As I am also not familiar with the inner workings of Jamf yet, I'm having some trouble figuring out where to start in this whole Code Signing Certificate endeavor. I know we will need to either renew or purchase a new Code Signing Certificate in order to get that green Verified checkmark, but I can't seem to find anything about steps that are needed after purchase to get it up and running Jamf. Any help, information, t

My bosses are about to implement a conference room booking system that may use iPads mounted at the entrances to rooms to display room status and allow for booking etc right on the iPad. I am told that we will need to manage these iPads especially to get them on our 802.1x network. I have never had a need to manage iOS devices until now. I don't even know where to begin - especially with the 802.1x. Am I going to need to get VPP working? Will I need to use Apple Configurator? Will I have to create AppleIDs for each iPad or can I use a single ID on them all? Is there a JAMF Pro "getting started" guide for iOS management? (DEP is out of the question here.)

Has anyone come up with a way to check the version of the currently installed DisplayLink drivers? There's no app and I can't find where the actual driver files are installed to query.

It appears that an installation of CarbonBlack (6.0.4.70328) crashes macOS High Sierra 10.13.2 and systems that are running CarbonBlack (6.0.4.70328) will not boot after an upgrade to macOS High Sierra 10.13.2. Removing CarbonBlack appears to heal all wounds.

Mac OS 10.11.6Casper/JSS version 9.9.6 On my first attempt at setting up automatic installation of VPP apps, I have run into a situation where only some of the apps will install automatically. I have six free VPP apps that I am trying to deploy via the automatic installation process within the Mac App Store Apps settings. Each time only three install on first login. TextWranglerNumbersPages The three remaining: Microsoft Remote Desktop, Keynote and xCode do not install unless I un-scope them from within Mac App Store Apps --> Application, then re-scope them. I have my configurations for all six apps the same. I have tried this with the apps scoped in a Smart Group/All Users or Single Client/All Users. In each instance it is the same apps that will install or not. Is there a limit as to how many apps I can automatically install with this process? Is this a known bug? Cheryl

We have some software that we want users specifically request by calling/mailing our helpdesk, and then our helpdesk can assign the software to the users computer. Is static groups the best route for this? For example a user wants SPSS 24. Sends a ticket to helpdesk, they log in and assign the computer to a static group called Install SPSS 24 that is scoped to a policy that installs SPSS 24. Any caveat with this or would you rather just add the computer directly to the policy instead?

I've been working on a script that validates if a Mac's binding to AD is still active or not. This is an issue that seems to be caused when the computer is off the corporate network at the time of kerberos key cycling, typically set to 14 days (see dsconfigad -show; setting it to 0 will stop this cycling, which I am currently testing to see if it stops bindings from breaking). This has been working fairly well, except for that we are getting some false failure reports when using the id command. Has anyone had to do this and found a more consistent way to see if a device binding is working or broken using the id, dscl or other commands? #!/bin/sh adserver="directory.contoso.com" testuser="_MacComputer" pass="AD Binding OK" fail="AD Binding Failed" offline="Not in range of DC" notbound="The Mac is not bound to contoso.com" # Check if we can ping the AD Domain Controller, if ping was successful check if we can query a UPN # If the ping was successful check if we can we query a UPN?

Hi folks, I've got a curious problem. My scripts, part of a configuration used at image time, seem to get cut off half way through. I think this is to do with the jamf.app doing an upgrade when the Mac boots for the first time (and seemingly while the script is running). The script works normally if called at any other time after imaging. JSS version 10.1.1-t1513360285However, the imaging.app simply shows as 101.1 - autocaspernbi reports a minor version difference, but is happy to build the nbi. There is no higher version available to me it seems. I assume that an older jamf binary is in this "older" imaging.app that nbi uses, which then gets upgraded as soon as the image is delivered and booted up for the first time. So, at least to troubleshoot this issue, can I somehow get the upgrade to be delayed? The upgrade is automatic so I'm assuming no? Should I create a quickpackage and add to the configuration? Or is there another imaging.app that I can download somewhere? For referenc

Ok. So, I have been all around JAMFnation and found the following article that is supposed to fix the exact issue that I am having: http://www.macos.utah.edu/documentation/administration/setup_netboot_service_on_mac_os_x_10.6.x_client.x_client/setup_netboot_service_on_mac_os_x_10.6.x_client-diskless_netboot.html The problem is that I can download the file, but not put it in the directory since it is a "read-only file structure." I have tried editing the file with the same results. I have tried making a copy of the NBI and editing it outside of the netboot directory and even enabled the root account and tried to edit it using that. Same error in terminal for those that are thinking it... I am unsure what to do now and where to go from here.Do I need to build a new MBI with the rc.netboot file built into it? Does anyone have a suggestion on how to get rid of the original error? System info:OS 10.10.4JSS 9.72 Any help would be appreciated,Dan

I have a few programs that gets installed when a computer first gets enrolled with the Enrollment Complete trigger: Office 2016, Acrobat Pro DC, Skype for Business and so on. Is there any neat way to skip installing the program IF the program is already installed? Say a user enroll a machine that already has Office 2016 installed via a user initiated enrollment - I don't want the policy to re-install Office 2016 since its already on the machine. Any tips?

Hey folks Sorry, another newb question here.Just starting to throw some Apple TVs into Jamf and I noticed that they're automagically being lumped into my Smart Groups that have no criteria set.Can anyone offer a suggestion for an easy way to tailor my smart groups so that the iPads and the Apple TVs stay separate? ThanksDeano

Hi. I was wondering if there's a script available that will allow me to trigger all of my policies in the order I desire. Uploaded my current script (not fully grasped the usage of scripts yet) I'd like it to be a manual trigger for all of my policies but ordered e.g. 10GoogleChrome,20IssueFilevaultkey etc Please help :D

Has anyone here successfully configured Securly to work in their OS X environment. We are testing it for a possible future purchase and have gotten it to work with the iPads and Chromebooks. I followed their instructions from a conference call, adding their DNS forwarders to our DNS server, editing their uswest_OSXDNS.sh script to add our DNS server address, creating a Configuration Profile with their self signed .der file, and a Policy to run their uswest_OSXDNS.sh script during startup, login, logout, network state change. The Configuration Profile installs, but the scrip policy fails. The error we get in the policy is: Our script consists of the following information (the IPs have been removed for security): !/bin/bash servers=“###.###.###.### ###.###.###.###"networksetup -listallnetworkservices | sed 1d $file | while read adapterdo networksetup -setdnsservers "$adapter" $servers networksetup -setv6off "$adapter"donedscacheutil -flushcacheexit 0 We are not getting a

Anyone else seeing an issue with 10.13.3 devices even after receiving the FV profile. End users are not being prompted to enter password? Within Jamf Pro 10.0 console. The device is not encrypted yet it still says the enduser is a FV user and FV has yet to be enabled. 10.13.2 and below not an issue.

I've been playing around with DEP and user creation when staging a computer for users. We have a 1:1 environment. I have ticked in Require Authentication and Skip Account Creation in our PreStage Enrollment, so a new user must authenticate with their LDAP credentials. So only a hidden management account and an extra admin account it created on the machine. Is there any way to create a local user on the machine with the credentials provided from LDAP in the DEP enrollment? Like, without binding the machine to AD, if it makes sense? Sorta like a one-way operation, users log in during DEP, and the computer creates a local account from the credentials. Does this makes sense?

Hi Everyone, I have been given a script by JAMF to help with adding users to the FileVault list at login via a policy, we have a epic amount of Freelancers and they are not always the type to bring the machine back to have themselves enabled, they will then go on a shoot/leave the building and cannot access the machine. Here is what I got from JAMF: #!/bin/bash ###################################################################################################### Copyright (c) 2013, JAMF Software, LLC. All rights reserved.## Redistribution and use in source and binary forms, with or without# modification, are permitted provided that the following conditions are met:# Redistributions of source code must retain the above copyright# notice, this list of conditions and the following disclaimer.# Redistributions in binary form must reproduce the above copyright# notice, this list of conditions and the following di

SOLVEDThe title is a bit confusing so here's a better explanation. We have an established policy that has been working great since we starting using Jamf earlier this summer. Lately, when I go to add a Mac to the policy(scoping to individual computers) sometimes the Mac will not take the policy. I'll set up another Mac and it will take just fine. I can seem to figure out why on some Macs the policy will take and others it just wont. Below is what I've tried thus far. Remove and re-add policy to ma Force check for policies with sudo jamf policy Unenroll, delete from Jamf Pro, enroll again Re-image Mac Removed MDM profile and re-enrolled Clone the policy and scoped to just the troubled Mac All of the above has not resolved the issue. However, if I create a brand new policy(without cloning) it works fine. At first I thought it might be an issue with replication of policy with Jamf Cloud but, that doesn't seem to be it since I can create a brand new policy and it takes and works im

Hello everyone, I am trying to find out how to enable a Chrome flag on the Chrome manifest. The flag I want enabled is SitePerProcess which is Strict Site Isolation, the reason I am doing this is because of all this new specter and meltdown issue. I have looked into the Policy List on Chromium : [http://www.chromium.org/administrators/policy-list-3#SitePerProcess](link URL) The problem I am having is I don't know which is the proper way to add this to the manifest. Does this look right ? This is just an example, any help will be greatly appreciated. <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>SitePerProcess</key><true/></dict> Let me know what you all think, thank you.

Is setting a firmware password just involve using the EFI Password Payload ? setting Security Level to 'command' ? and giving it a password ? I read this article https://jamfnation.jamfsoftware.com/article.html?id=58 does it still apply ?

Hello,I was wondering if anyone has tried using this to schedule and deploy OS upgrades/updates?We've tried setting up a combo update of 10.13.2 (from 10.13.1) through Self service and it looks to work (no real info from the UI telling us the %done or whats going on in side SS) and it reboots but doesn't actually update the OS.The JSS log for the policy didnt say anything.Local jamf log shows that it downloads the DMG successfully from the repo. The mac is a fresh 10.13.1 install so there should be no problems with functionality or corrupt files from usage from a user. Anyone else tried this yet and had more success? Below is the jamf.log from the mac. Wed Jan 17 15:09:03 macbook1 jamf[2497]: Checking for patch ID 1 Wed Jan 17 15:09:03 macbook1 jamf[2497]: Executing Patch Policy macOS Wed Jan 17 15:15:26 macbook1 jamf[2544]: Checking for policies triggered by "recurring check-in" for user "test"... Wed Jan 17 15:15:29 macbook1 jamf[2544]: Executing Policy Update Inventory Wed Jan 17

Anyone else seeing this?

Hey guys, is there a hidden button or anything else to force update the patch reporting software titles? A Flash update was released yesterday but the new version doesn't show up in our JSS. Michael

Is there a way to turn OFF parental controls using a command line. The target client is on Yosemite. I need to be able to find a way to disable that checkmark under SYstemPreferences -> Accounts -> user

So I have a restricted software to stop users from actually installing High Sierra. But when they are at home and on their own networks, they get the notification that High Sierra is out and if they want to download it. Some of our users have been downloading it, and trying to install it. Thankfully we've blocked the installer. Is there a way to stop the notifications from Apple telling them about High Sierra. I vaguely remember there was something to stop Sierra ones when they came out.

Hi all, Did something stupid... I used sudo firmwarepasswd -setpasswd to change the firmware password I got the following feedback, so I thought the password change was successful "Enter new password:Re-enter new password:Setting Firmware PasswordPassword changedNOTE: Must restart before changes will take effect" But when I type in the new Firmware password at the recovery screen (Command+R), I am padlock locked and can't get in. I tried the command again to see if I can change it back, but I get an error:"ERROR | setPasswdFromCommandLine | Unable to verify passwordERROR | main | Exiting with error: 4" This really is my Macbook, it's not stolen. Anyone know how I can reset the firmware password?