Hey, guys!Stupid question, but I can't find a solution.I have a bunch of IntelliJ Licenses. I need to distribute it to users. License - just URL, the user should go on it and activate his license. So, my question is:How to create a policy that shows this URL to the user and allows to click on it? Or, just redirect the user to a needed page? Thanks.

If I install it on macOS 10.13 is there going to be a fight, or is that just a Britishism?

has anyone setup software restriction for macOS High Sierra yet? I had macOS Sierra restriction setup with Restrict Exact Process Name = Install macOS Sierra.app and created a new restriction with Install macOS High Sierra.app

I'm trying to apply a configuration profile with the following items:- Passcode- Software Update- Restrictions- Login Window- Security & Privacy- Energy Saver When I apply this policy though, users who do not meet the password requirement are not prompted to change their password when they logout/login or reboot. When I create the config profile with just the passcode payload (no other config profiles are applied), I get the expected behavior, where a user with an invalid password gets prompted to change their password on reboot or login/logout. Is it possible to have the passcode payload in the same config profile as all the other security settings, or does it need to be its own config profile?

Recently we have switched to using the out of the box macOS Sierra when new devices are deployed and use a combination of policies etc. to customize app installs or other customizations. I noticed that all of the built in Apple apps require an Apple ID for any updates when this is done. I have each Mac in our organization set to update the App Store apps automatically. Is there any way around providing an Apple ID for these updates? Do I need to assign the built in apps via VPP in order for them to receive updates? That seemed somewhat illogical to me since the apps come with MacOS already.

Hey all, I'm currently trying to find a solution to the following issue: macOS Recovery allows any user whose computer has been updated to 10.12.4 or above to bypass our restricted software policy regarding High Sierra, allowing users to upgrade to the latest OS. command + option + r kicks off macOS Recovery in a mode that is set to download and install the LATEST OS compatible with the device (High Sierra in this case). Are there any ways to restrict this that don't involve adding a firmware password to each computer? If not, is it possible to script firmware passwords via JSS?

I'm trying to write a bash script that basically stores a file list into an array, loops through the array and then appends something to the files. I.e. loop through a directory and add a . to the beginning to make it hidden.I know this is fairly simple but I've never really worked with arrays or loops in bash at all.1. Insert file list into array2. Loop through array3. cat something to the file name (would I have to use rn? or is there a way to add something to the filename?) #!/bin/bash #get files on desktop and store into array cd /Users/$3/Desktop/ files=($(ls)) #loop through array and cat something to beginning for file in files; do done

Hi, I am having a hard time with deleting a simple value from the login keychain of the logged in user via the CLI, i have tried many commands but non of them will delete the entry, is there anyone who got the golden tip?! See screenshot for what i am trying to delete, it is a keychain entry from a SMB network printer.

Hi all I'm trying to create a policy in self service which displays a dialogue box with the computer's current IP address or addresses. Having done a bit of reading around, the way JAMF runs AppleScript as the root user can cause issues getting the results to the currently logged-in user. My script below runs the script in bash as the currently logged in user, and I have tested it to work fine in Mac OSX as a script.sh file, but when I try to run it in JAMF I get nothing, the JAMF log simply says: Executing Policy Network StatusWed Sep 27 11:58:29 MacBook Pro jamf[18349]: Checking for policy ID 852... #!/bin/sh currentUser=$( ls -l /dev/console | cut -d " " -f4 ) sudo -u $currentUser osascript <<EOD tell application "System Events" delay 0 set myIPAddress to (do shell script "ifconfig | grep 'inet ' | grep -v 'inet 127' | cut -c1-21") display dialog "IP Address Details: " & myIPAddress end tell EOD Am I missing something obvious here? Any help would be greatly apprec

Hi all, With High Sierra released, I am testing deployment via the startosinstall command. I am using a script to initiate an unattended install that I found in this article: https://www.jamf.com/blog/streamlining-your-macos-upgrade-process/ The only modification I have made to the script is to change it so that it looks for a High Sierra installer, rather than a Sierra installer. So basically I want jamfHelper to show a warning message, and then the installer does its thing. I have set up a policy to deploy the installer, and then I send the script, either in the same policy, or as a separate policy (I am figuring on caching the installer on my machines in advance, and then running the script at a later, convenient time). Ideally, I will send both policies via recurring check-in, which is what I have been testing. For whatever reason, the script runs, but doesn't do anything if I just let the machines check in on their own. If I initiate check-in from Terminal, it works fl

So we have about 9 early adopters of High Sierra. Looking at their computer record in our JSS, the disk encryption section indicates that the drives are not encrypted. Going to the machine and looking at the FileVault status, they are in fact encrypted. Has anyone else seen this behavior in their JSS, on machines with 10.13?

Hi All, I'm having trouble using a script to automatically map 2 share drives. we can manually connect them using Cmd+K without the need for credentials but for some reason the scripts we are using do not work on Sierra, however, they did work on Mavericks. Regards.

So a while back I setup restrictions on three different processes to prevent our users from installing High Sierra yet I have a machine in JAMF I use for testing and had it blocked as well yet it installed. Am I missing something? The ones I restricted are Install macOS, I later went back and added to that High Sierra at the end. I also restricted osinstallersetupd & high sierra. Any input as to why it failed to block these actions? Thanks, Adam

I updated my computer to macOS 10.13 and when I ran Casper Imaging it looked strange, anyone else seeing this? I am still running JSS 9.100 and have not actually tried the imaging process yet.

Does anyone have a script they'd be willing to share to display the computer's Active Directory name in Self Service? I've tried writing my own script and it's a challenge that exceeds my meager scripting abilities. In case that's not clear, I'm looking for something along the lines of the scripts posted in this thread that displays the "Computer ID" in AD, instead of the IP address and ComputerName.

We have 500 VPP licenses for xcode, when trying to install xcode from Self Service, instead of installing automatically the Mac App Store starts up and you have to "Get" xcode from there. All of our mac apps that have VPP licenses install fine through Self Service. Any ideas?

Is there a way to suppress the dialogue? I notice it popping up on clients quite often. Usually they ignore it, as they aren't admins, but I'm sure it gets annoying.

We have a script which I'm attempting to run once a week via a launchd task. Launchd appears to be working normally, script launches, but at the end of the script it calls a JSS policy via a custom trigger. This portion of the script appears to be failing. If I run the script manually, it tells me "There was an error. This application must be run as root. Try the sudo command." Running with sudo produces the desired result. What is the best-practice in terms of having launchd execute the script with admin/root privileges? My launch daemon plist is in /Library/LaunchDaemons, ownership set to root:wheel, -rw-r--r-- Script itself is located in /Library/Application Support/JAMF/Scripts, and similarly, root wheel -rwxr-xr-x It appears that the "jamf -policy -event <trigger> command in the script is where it is asking for sudo - what is the best way to make this run correctly when triggered by launchd?

Just upgraded to 101 from 100.1 new notification when I log into the JSS. Says: PRESTAGE_IMAGING_SECURITY PRESTAGE_IMAGING_SECURITY_LINK The link takes me here:https://www.jamf.com/jamf-nation/admin/articles/469 404 Error The URL requested does not exist. Very handy.Anything I need to know about?

I've started testing the 15.21.1 Office Update and noticed that my Outlook client doesn't seem to authenticate through AD FS/Office 365 with our Office 365 environment thus resulting in the error below: Reverting back to Outlook 15.19.1 and the authentication works fine again. I tested this on another Mac and the problem occurred there as well. Tested on El Capitan, 10.11.4. Does anyone else has this issue as well?

Hi ,We would like to remove the mac apps pages and numbers from MAC x for 'n' numbers of users, can I have any removal script to run via policy ?

We have a computer that we would like to decrypt the Filevault and do some testing. I decrypted the computer manually, and added the machine as an exception in the JSS policy, but upon trying to log on it is asking to enable Filevault again. Is there a file somewhere that is causing this?

Dear Experts, I wonder whether it is possible to have a policy run a script on the MDM instead of the client. We have a script on the MDM that extracts some information from an external database and fills some extension attributes. We run that script via cron on the node hosting MDM (but it could also live elsewhere) to keep the information in sync. This script checks for every device whether the information is up to date, so it takes some time to do its job. We want to make sure the EAs in question get updated directly when the enrollment is finished, so it would be nice if we could trigger running this script with a device ID as argument (to avoid it has to loop over all devices) whenever a device was enrolled. Is that possible? Thanks in advance for your valuable comments.

Hello, does anyone have an EA for identifying whether or not a inventoried Mac has a USB-C port?

Hello, I'm trying to import users from Apple School Manager but JSS is using the managed apple id for the email address field. This is causing issues with the matching criteria and JSS is creating new users when that person already exist. Is there a setting I'm missing? Has anyone else ran into this issue? Thanks!