Hello ALL:I am trying to create a restrictions profile on IOS devices. These devices are supervised and enrolled. I would like the end user to be able to download apps from the app store using their own apple id and password but as soon as the iPad downloads this policy the iTunes and app store login credentials get greyed out. I am attaching the portion of the restrictions profile.

Afternoon All. Been wracking my brain on this issue for the past couple days, and I just wanted to find out if anyone had any insight on the following issue. I am working on getting FileVault 2 distributed to my clients via a Configuration Profile, and the following is the behavior I am seeing. My workflow is currently as such; image Mac, walk through setup assistant, enroll in JSS via Setup Assistant, and get to a login window. My setup is the management account is our local admin account, I skip the account creation part as part of the PreStage setup. Once the Setup Assistant is complete, I can log into my management account, and policies start firing off as they should. I see the FileVault Configuration Profile in System Preferences, but for the life of me it doesn't seem to be applied in any way, shape, or form. In one of my walkthrough tests, I did see in the fdesetup status that deferment was set, and when looking at the deferment information, it stated that the deferment was

I am trying to setup an. uninstall for our bit9 agents. I tried calling the uninstall.sh in the bit9 folder that gets installed with the agent, but when I try to call it via a script it errors out.. . . . Running script Uninstall Bit9.sh... Script exit code: 1 Script result: Uninstall is not currently enabled for Bit9. Error running script: return code was 1. Submitting log ... . . . I looked in the script, it does a check on the b9cli -allowuninstall >dev/null but I couldn't find a way to set the flag to allow it...

I need a postinstall PKG script that handles what FEU and FUT do in a Jamf Pro DMG.This is going to be a standalone PKG that may be used on unmanaged systems. Else, I would just use FEU and FUT with a DMG.Before I re-invent the wheel I thought I would ask Jamf Nation.

Is there a statuspage for cloud based JamfPro?

Had a student that violated our AUP so we turned her wifi off using managed preferences. I'm now having issues getting it turned back on. I know it uses the com.apple.MCXAirPort DisableAirPort plist but I'm not sure how to turn her wireless back on now. I did sudo jamf removeframework to see if that would work but it still does the same thing. is it as simple as a defaults write com.apple.MCXAirPort DisableAirPort false ? I've tried that and it doesn't seem to do anything.

We are seeing upgrade failures on devices that have third-party SSD's installed. This was the reply from my engineer in the field: "Mostly Samsung for iMacs and OWC/Samsung for m.2 drives." We've opened a case with Apple on this, but I'm trying to set up a query to report on these drives. I've gone through the different posts and found some Extension attributes. The only one I've been able to get working is from: https://www.jamf.com/jamf-nation/discussions/8931/hard-drive-speed-type-extension-attribute I can get a yes/no answer to if a device has an SSD. But I really want to know what kind of drive. I've also tried the different EA's in this post: https://www.jamf.com/jamf-nation/discussions/4891/report-for-displaying-storage-type-hd-vs-ssd The scripts work great if I run it on the machine. As a script for an EA, the field is blank. I see that the information is stored in Inventory/Storage/Model, but it's not reportable. I've opened a case with support, but wondering if any

Does anyone have a 10.12 install file? It looks like Apple has graciously removed it from the App Store. Is everyone else seeing this issue?

Suspicious Package 3.0

Hello I am looking to rename a folder via a script. I am trying to use mv ~/Google Drive ~/OldGoogleDrive This worked on my computer, but when I tried it on another it gave me the following error. Executing Policy Rename Google Drive FolderRunning script Rename Google Drive Folder...Script exit code: 1Script result: mv: rename /var/root/Google Drive to /var/root/OldGoogleDrive: No such file or directory<br/>Error running script: return code was 1. For some reason on this computer it is looking for the folder in the var/root location, even though on my computer it did not look there. Any help is greatly appreciated.

Hey, guys!Stupid question, but I can't find a solution.I have a bunch of IntelliJ Licenses. I need to distribute it to users. License - just URL, the user should go on it and activate his license. So, my question is:How to create a policy that shows this URL to the user and allows to click on it? Or, just redirect the user to a needed page? Thanks.

If I install it on macOS 10.13 is there going to be a fight, or is that just a Britishism?

has anyone setup software restriction for macOS High Sierra yet? I had macOS Sierra restriction setup with Restrict Exact Process Name = Install macOS Sierra.app and created a new restriction with Install macOS High Sierra.app

I'm trying to apply a configuration profile with the following items:- Passcode- Software Update- Restrictions- Login Window- Security & Privacy- Energy Saver When I apply this policy though, users who do not meet the password requirement are not prompted to change their password when they logout/login or reboot. When I create the config profile with just the passcode payload (no other config profiles are applied), I get the expected behavior, where a user with an invalid password gets prompted to change their password on reboot or login/logout. Is it possible to have the passcode payload in the same config profile as all the other security settings, or does it need to be its own config profile?

Recently we have switched to using the out of the box macOS Sierra when new devices are deployed and use a combination of policies etc. to customize app installs or other customizations. I noticed that all of the built in Apple apps require an Apple ID for any updates when this is done. I have each Mac in our organization set to update the App Store apps automatically. Is there any way around providing an Apple ID for these updates? Do I need to assign the built in apps via VPP in order for them to receive updates? That seemed somewhat illogical to me since the apps come with MacOS already.

Hey all, I'm currently trying to find a solution to the following issue: macOS Recovery allows any user whose computer has been updated to 10.12.4 or above to bypass our restricted software policy regarding High Sierra, allowing users to upgrade to the latest OS. command + option + r kicks off macOS Recovery in a mode that is set to download and install the LATEST OS compatible with the device (High Sierra in this case). Are there any ways to restrict this that don't involve adding a firmware password to each computer? If not, is it possible to script firmware passwords via JSS?

I'm trying to write a bash script that basically stores a file list into an array, loops through the array and then appends something to the files. I.e. loop through a directory and add a . to the beginning to make it hidden.I know this is fairly simple but I've never really worked with arrays or loops in bash at all.1. Insert file list into array2. Loop through array3. cat something to the file name (would I have to use rn? or is there a way to add something to the filename?) #!/bin/bash #get files on desktop and store into array cd /Users/$3/Desktop/ files=($(ls)) #loop through array and cat something to beginning for file in files; do done

Hi, I am having a hard time with deleting a simple value from the login keychain of the logged in user via the CLI, i have tried many commands but non of them will delete the entry, is there anyone who got the golden tip?! See screenshot for what i am trying to delete, it is a keychain entry from a SMB network printer.

Hi all I'm trying to create a policy in self service which displays a dialogue box with the computer's current IP address or addresses. Having done a bit of reading around, the way JAMF runs AppleScript as the root user can cause issues getting the results to the currently logged-in user. My script below runs the script in bash as the currently logged in user, and I have tested it to work fine in Mac OSX as a script.sh file, but when I try to run it in JAMF I get nothing, the JAMF log simply says: Executing Policy Network StatusWed Sep 27 11:58:29 MacBook Pro jamf[18349]: Checking for policy ID 852... #!/bin/sh currentUser=$( ls -l /dev/console | cut -d " " -f4 ) sudo -u $currentUser osascript <<EOD tell application "System Events" delay 0 set myIPAddress to (do shell script "ifconfig | grep 'inet ' | grep -v 'inet 127' | cut -c1-21") display dialog "IP Address Details: " & myIPAddress end tell EOD Am I missing something obvious here? Any help would be greatly apprec

Hi all, With High Sierra released, I am testing deployment via the startosinstall command. I am using a script to initiate an unattended install that I found in this article: https://www.jamf.com/blog/streamlining-your-macos-upgrade-process/ The only modification I have made to the script is to change it so that it looks for a High Sierra installer, rather than a Sierra installer. So basically I want jamfHelper to show a warning message, and then the installer does its thing. I have set up a policy to deploy the installer, and then I send the script, either in the same policy, or as a separate policy (I am figuring on caching the installer on my machines in advance, and then running the script at a later, convenient time). Ideally, I will send both policies via recurring check-in, which is what I have been testing. For whatever reason, the script runs, but doesn't do anything if I just let the machines check in on their own. If I initiate check-in from Terminal, it works fl

So we have about 9 early adopters of High Sierra. Looking at their computer record in our JSS, the disk encryption section indicates that the drives are not encrypted. Going to the machine and looking at the FileVault status, they are in fact encrypted. Has anyone else seen this behavior in their JSS, on machines with 10.13?

Hi All, I'm having trouble using a script to automatically map 2 share drives. we can manually connect them using Cmd+K without the need for credentials but for some reason the scripts we are using do not work on Sierra, however, they did work on Mavericks. Regards.

So a while back I setup restrictions on three different processes to prevent our users from installing High Sierra yet I have a machine in JAMF I use for testing and had it blocked as well yet it installed. Am I missing something? The ones I restricted are Install macOS, I later went back and added to that High Sierra at the end. I also restricted osinstallersetupd & high sierra. Any input as to why it failed to block these actions? Thanks, Adam

I updated my computer to macOS 10.13 and when I ran Casper Imaging it looked strange, anyone else seeing this? I am still running JSS 9.100 and have not actually tried the imaging process yet.

Does anyone have a script they'd be willing to share to display the computer's Active Directory name in Self Service? I've tried writing my own script and it's a challenge that exceeds my meager scripting abilities. In case that's not clear, I'm looking for something along the lines of the scripts posted in this thread that displays the "Computer ID" in AD, instead of the IP address and ComputerName.