Hello all & Merry Christmas!!! We have SSO setup using ADFS and LDAP using the Jamf Infrastructure Manager with LDAP proxy set in our Jamf Cloud instance.I can search LDAP and bring a user in who can log in and access what they are allowed to access, equally I can add an LDAP group. What I would like to do is manage everything through Active Directory. So my theory is, bring in an LDAP group and members of that group can log in to Jamf and get what they are told they can get! So, I have brought in an LDAP group that I know contains a user, applied site access to that group and applied audit permissions. However, when the user attempts to log in, they are presented with Access Denied. I have tested the mappings, Jamf knows that the group exists in AD and the the user is a member of it. So, my question is once an LDAP group is imported, does it bring the user(s) with it?

In the environment that I work in, Kerberos was just enabled over the weekend on the Exchange servers. I currently have 250+ existing Mac Users with Outlook that currently are set to just use the User Name and Password. I would like to get these existing users flipped to Kerberos. It is a simple change to make but I am looking to automate just changing that one item. I am not that experienced in scripting but I would like to deploy this change via JAMF / JSS. Talking Moose's Outlook 2016 script is great for new users that are just logging onto a machine for the first time but when I run this on an existing user, it creates a second mailbox. I appreciate any guidance anyone can provide.

We're looking to move multiple VPP accounts into JSS and would like to allow those staff responsible for their sections access to JSS so they can manage the entire process from purchasing in Apple VPP through to deployment to their iPads. Can this be done?I'm not sure which privileges I should be giving to allow this without allowing access to everything. Is there a spreadsheet or something similar available that would help with this?

Whenever a new version of a browser comes out, I create and upload the pkg, and then upload it to the JSS and set it to Make available through Self service. What is the best practice for killing and (removing if necessary) the existing sessions and editions of say Chrome and Firefox? I've noticed after installing them, and then launching the browsers, they both seem to request a restart to update - which isn't ideal Do you put in a pre-installs script to remove the older version? If so, does this work without removing all of their bookmarks and extensions?

I have a bunch of policies that I dont want to run more than once per day, so curiously enough they are set to "Check In" and "Once Per Day" and are each scoped to a specific building. However, I have 1 particular set of circumstances that should only realistically happen once per machine, where a policy is triggered that intentionally changes a setting to a default value, I then need to trigger my "Once Per day" policy to immediately change them back to the site based one. Any thoughts

example: 2018-001 updates for Sierra, et all - short of user caching the software and doing a remote install (package receipt would be a good way to track deployment), how can we track it via natural installs of updates? i can go to system information > software > installations > and find the installer that im looking for, but how does that translate to a trackable table or extention in JSS?

Hello Jamf Community, I am looking for a script, to change the DNS "Search Domain" to .local on Wi-Fi and Thunderbolt Ethernet. I try a few comands but no one works... Hope everyone can help me. Many ThanksChristian

I forgot to enable screen sharing for new imaged Macs and now I can't use Casper Remote to remote to the devices. How can I enable screen sharing via a script or profile?

The Major point of what I am trying to achieve here is to force a full policy Refresh at boot. There is nothing in a policy that allows for this. I have a Startup Policy that runs a script that SHOULD achieve this but it does not work in this instance, in other areas though the script does work. The Heart of the script is basically the below command (plus the echo above it to make the logs easier to read) that chains the 10s pause and the policy refresh into a seperate windows that it does not wait for completion. Echo Pausing for 10 Seconds to let this script finish, then Re-Check for Policies sleep 10s && /usr/local/bin/jamf policy & Any Thoughts ?

Today I noticed that I can send a command from the JSS to remove local user accounts on Macs. It doesn't show up on all. I am trying to figure out the criteria to see this. I thought it may be High Sierra, some of my High Sierra Macs show this option, some do not so it doesn't seem like a versioning issue. Most of these Macs should have the same configs and policies. I am just trying to figure out if this is a new feature or maybe I turned something on and didn't realize it.

I've added a few applications to my VPP account which I can see in JSS but none of them appear to be Device assignable. Microsoft products in particular. I have to copy the URL from within App store and paste within VPP console. But even when I search using JSS I get the same thing. Assuming this is correct, can someone suggest a free App I could use for testing? If this isn't correct can someone tell me what I'm doing wrong? Thanks

We setup DEP and preStage successfully. preStage enrollment requires Active Directory credentials, which we verified to be working before enrolling. The Active Direcotry login populates the local user information (e.g. First, Last name along with uid) correctly. The local account is created correctly, and when it loads, the managementFramework enrollment is not fully complete. In JSS, the computer status ends up in an 'unmanaged' state. Conversely, when using the QuickAdd.pkg (downloaded from user-initiated enrollment page) with the same login credentials, we observe that the enrollment is fully successful and the computer is Managed by the Management Account. We have reproduced the same issue on multiple computers with multiple user credentials to rule out any potential anomalies. Additionally, we have verified the JSS hosts are able to communicate with APNS, HTTPS, etc.

Hello, I am using the Casper REST API to populate our Asset Management database in ServiceNow. I am using the resource URL ../computers/subset/basic This URL provides most of the information I need for my queries. However, I need BOTH the Primary Mac Address AND the Secondary Mac Address. That URL provides only one field <mac_address>. Also, I tried building a computer report and pulling from ../computerreports However, the report builder only provides a single mac address. What resource URL can I use to query both network adapters for a single computer? I’m unable to locate a table that stores network adapters specifically. Let me know if anyone has any advice! Thank you!

Hello, I have run into numerous printing errors when adding this model printer to Jamf Admin and deploying through a policy triggered by Self-Service. It seems HP have given up on supplying specific drivers for this fairly new printer model, using the supplied auto config driver when adding using CUPS results in postscript errors and blank pages being printed. Using the General Postscript Driver seems to yield better results at the cost of customization settings when printing. Hp Easy start is a disaster and will not even find the desired printer using IP discovery. Printer Firmware has been updated and we are running OSX High Sierra(10.13.2-3). Any insight is much approved, has HP abandoned enterprise support for Mac? Thanks, Matt RoyTechnology SpecialistISD659

Hey folks I'm pretty sure I know the answer to this, but I thought I would ask anyways.We would like to set the names of our iPads with a slightly different format than our Apple TVs and I can't see a way to do this with prestage enrollments; does anyone have a suggestion? ThanksDeano

Afternoon Jamf Nation We are switching from Profile Manager to Jamf Pro in the coming months, and I have been tasked with this transition. One of the things that I am having trouble with is our Code Signing Certificate. It expires next month (which I'm not sure is beneficial or detrimental), and our higher ups want to continue to have that that nice green checkmark that says Verified when a device is manually enrolled. Problem is I didn't setup and implement our original Code Signing Certificate with Profile Manager, so this is my first time in that particular rodeo. As I am also not familiar with the inner workings of Jamf yet, I'm having some trouble figuring out where to start in this whole Code Signing Certificate endeavor. I know we will need to either renew or purchase a new Code Signing Certificate in order to get that green Verified checkmark, but I can't seem to find anything about steps that are needed after purchase to get it up and running Jamf. Any help, information, t

My bosses are about to implement a conference room booking system that may use iPads mounted at the entrances to rooms to display room status and allow for booking etc right on the iPad. I am told that we will need to manage these iPads especially to get them on our 802.1x network. I have never had a need to manage iOS devices until now. I don't even know where to begin - especially with the 802.1x. Am I going to need to get VPP working? Will I need to use Apple Configurator? Will I have to create AppleIDs for each iPad or can I use a single ID on them all? Is there a JAMF Pro "getting started" guide for iOS management? (DEP is out of the question here.)

Has anyone come up with a way to check the version of the currently installed DisplayLink drivers? There's no app and I can't find where the actual driver files are installed to query.

It appears that an installation of CarbonBlack (6.0.4.70328) crashes macOS High Sierra 10.13.2 and systems that are running CarbonBlack (6.0.4.70328) will not boot after an upgrade to macOS High Sierra 10.13.2. Removing CarbonBlack appears to heal all wounds.

Mac OS 10.11.6Casper/JSS version 9.9.6 On my first attempt at setting up automatic installation of VPP apps, I have run into a situation where only some of the apps will install automatically. I have six free VPP apps that I am trying to deploy via the automatic installation process within the Mac App Store Apps settings. Each time only three install on first login. TextWranglerNumbersPages The three remaining: Microsoft Remote Desktop, Keynote and xCode do not install unless I un-scope them from within Mac App Store Apps --> Application, then re-scope them. I have my configurations for all six apps the same. I have tried this with the apps scoped in a Smart Group/All Users or Single Client/All Users. In each instance it is the same apps that will install or not. Is there a limit as to how many apps I can automatically install with this process? Is this a known bug? Cheryl

We have some software that we want users specifically request by calling/mailing our helpdesk, and then our helpdesk can assign the software to the users computer. Is static groups the best route for this? For example a user wants SPSS 24. Sends a ticket to helpdesk, they log in and assign the computer to a static group called Install SPSS 24 that is scoped to a policy that installs SPSS 24. Any caveat with this or would you rather just add the computer directly to the policy instead?

I've been working on a script that validates if a Mac's binding to AD is still active or not. This is an issue that seems to be caused when the computer is off the corporate network at the time of kerberos key cycling, typically set to 14 days (see dsconfigad -show; setting it to 0 will stop this cycling, which I am currently testing to see if it stops bindings from breaking). This has been working fairly well, except for that we are getting some false failure reports when using the id command. Has anyone had to do this and found a more consistent way to see if a device binding is working or broken using the id, dscl or other commands? #!/bin/sh adserver="directory.contoso.com" testuser="_MacComputer" pass="AD Binding OK" fail="AD Binding Failed" offline="Not in range of DC" notbound="The Mac is not bound to contoso.com" # Check if we can ping the AD Domain Controller, if ping was successful check if we can query a UPN # If the ping was successful check if we can we query a UPN?

Hi folks, I've got a curious problem. My scripts, part of a configuration used at image time, seem to get cut off half way through. I think this is to do with the jamf.app doing an upgrade when the Mac boots for the first time (and seemingly while the script is running). The script works normally if called at any other time after imaging. JSS version 10.1.1-t1513360285However, the imaging.app simply shows as 101.1 - autocaspernbi reports a minor version difference, but is happy to build the nbi. There is no higher version available to me it seems. I assume that an older jamf binary is in this "older" imaging.app that nbi uses, which then gets upgraded as soon as the image is delivered and booted up for the first time. So, at least to troubleshoot this issue, can I somehow get the upgrade to be delayed? The upgrade is automatic so I'm assuming no? Should I create a quickpackage and add to the configuration? Or is there another imaging.app that I can download somewhere? For referenc

Ok. So, I have been all around JAMFnation and found the following article that is supposed to fix the exact issue that I am having: http://www.macos.utah.edu/documentation/administration/setup_netboot_service_on_mac_os_x_10.6.x_client.x_client/setup_netboot_service_on_mac_os_x_10.6.x_client-diskless_netboot.html The problem is that I can download the file, but not put it in the directory since it is a "read-only file structure." I have tried editing the file with the same results. I have tried making a copy of the NBI and editing it outside of the netboot directory and even enabled the root account and tried to edit it using that. Same error in terminal for those that are thinking it... I am unsure what to do now and where to go from here.Do I need to build a new MBI with the rc.netboot file built into it? Does anyone have a suggestion on how to get rid of the original error? System info:OS 10.10.4JSS 9.72 Any help would be appreciated,Dan

I have a few programs that gets installed when a computer first gets enrolled with the Enrollment Complete trigger: Office 2016, Acrobat Pro DC, Skype for Business and so on. Is there any neat way to skip installing the program IF the program is already installed? Say a user enroll a machine that already has Office 2016 installed via a user initiated enrollment - I don't want the policy to re-install Office 2016 since its already on the machine. Any tips?