The subject kind of says it all. I'm looking for valid client id tags to use in the preStage enrollment directory payload. $SERIALNUMBER works, but i'd prefer to be able to get username-mbp working and would like to know what the options are. Thanks!

Our old practice was to have the "Use UNC path from Active Directory..." checkbox selected to make the home share path available in the Dock. We would like to deselect that option and instead use a script to provide a dock item to the home share. This is working fine for Macs that stay on the LAN, but a login when OFF the LAN is still providing the home share path error during login, and dock item being added (in addition to the one that we are putting their via script). I've tried deleting the dock.plist then 'killall Dock' and that does remove the dock item that the OS has placed, but a subsequent login will put it back, despite "Use UNC path from Active Directory..." being unchecked. Is there something in addition I need to do in order to turn this off? I am testing on 10.12.4. The only thing that seems to have a permanent change is to delete the local mobile account. Creating the new mobile account at first login will respect the "use UNC

Our go live is later this month, in the meantime, we are having to send a few devices abroad - is it possible to have users visit the URL and perform the enrolment themselves? Or will they have to be connected to one of our networks in order for them to do so, or can we have either setting?

Hello, Just got a question about some users that travel frequently. They would like the ability to remove SSIDs because when they return to a site the WIFI password has changed and since they do not have admin rights, they cannot remove the SSIDs to re-add them with the new credentials. I've done some research but I have not seen anything with a resolution for this issue. All feedback is greatly appreciated. Thank you

Hello all, Let me try to explain this as best I can....... We have multiple VPP accounts across campus for the different colleges...... using the individual VPP accounts for their apps is fine regarding being able to "Categorize" for each department in the jss mobile apps section. This is fine for apps that aren't used outside of one department. What can be done for an App like "Dropbox" that is used across multiple colleges..... I'm assuming it's best to use a neutral VPP account (campus / IT account) and "Categorize" it as a campus-wide app because I don't see how you can have more than instance of an App in the jss to categorize separately by college / VPP account. Hope that makes sense! TIADavid

Hoping someone can help. Trying to write a script to download the latest version of Microsoft Teams for OS X. Using the following URL in Safari reveals the download location. However, using CURL does not. Anyone have any insight on how to retrieve the download path with CURL? https://teams.microsoft.com/downloads/DesktopUrl?env=production&plat=osx&arch=64

Im sure there is a grep and lpadmin command that will allow this, but before reinventing the wheel I figured I'd ask if anyone has already created this. I have printers that all start with "HS-" added on our staff computers which we now need to delete so we can let users add the printers with our newer print server in self service. So I was trying to get a script to just target the ones with those names and leave their others in tact. Gabe ShackneyPrinceton Public Schools

I'm trying to determine what the effect of disabling ssh might be for managed computers. At the moment, all I can see is that Recon and Casper Remote won't work. Recon isn't a big problem, since ssh would be disabled after enrolment and deployment are complete. Is ssh used by JSS or other components? Would any other functionality be affected?

Hi, I am having a few issues trying to set up offline imaging through Casper. I want to be able to image Macs using 1 of 4 OS images and then 1 of 4 configurations on top of the OS. I have created a base and a creative image for the El Capitan and Sierra OS's, and setup 4 configurations for the different offices, as they all need slightly different setups i.e. required software, printers etc. Due to network bandwidth issues I don't want to be pushing GB of data across our site links so would prefer to have everything on an external disk so I have a portable imaging solution I can take with me to each site. The ideal result I am looking to achieve would make it so I am able to build any combination of the OS images, with the configurations from an external Thunderbolt drive via target disk mode. From what I have read offline imaging via target mode imaging would seem to be the best solution, but according to the small bit of info about offline imaging on the JAMF website you need to i

I may not be using the right terminology, but I have a problem. I need to built about 100 iMacs via Casper Imaging, and I have a bunch of files in a folder that I want it to copy to each one as part of the build process. What would be the best way to do that?

Is flushPolicyHistory part of Casper imaging now? It seems like it's is flushing the policy history at imaging on v8.62.If yes I don't have to manually run the "jamf flushPolicyHistory" command at our post image scripting. I would like to get an official answer from JAMF. Thanks

I keep noticing while using Safari how when editing smart groups or when creating policies it pinwheels and stutters. Just curious if others have noticed this as well? I was going to open a bug report with Apple. Gabe ShackneyPrinceton Public Schools

Howdy, I'm receiving an error when attempting to upgrade from 9.81 to 9.90 on a Windows 2012 R2 server. The following error message is displayed in the logs. JSS (c) (88:01) [10:08:59:855]: JSS_BACKUP_DIR=C:Program FilesJSSBackupsJSS-20160401-100859 Info 2826. Control Bitmap_1 on dialog CancelDlg extends beyond the boundaries of the dialog to the right by 7 pixels. Exception thrown by custom action: System.Reflection.TargetInvocationException: Exception has been thrown by the target of an invocation. ---> System.Exception: There was an unexpected error running 'robocopy.exe "C:Program FilesJSS" "C:Program FilesJSSBackupsJSS-20160401-100859JSS" /b /copyall /R:2 /W:5 /e /XD temp backups logs work /LOG:"C:Program FilesJSSBackupsJSS-20160401-100859JSS-Backup.log"'! ---> System.TimeoutException: Running 'robocopy.exe' timed out after '60' seconds. at JAMF.JSS.InstallUtilities.Utilities.LaunchExe.Run() --- End of

Is there a way to make a smart group based on whether or not a Mac has specific proxy settings? We are pushing a script: networksetup -setautoproxyurl Ethernet http://blahblahblah and I want to create a smart group to make sure all our Macs always have this set correctly.

We got 4 Apple TVs to test to use in conference rooms and eventually classrooms for presenters. I got the TVs to enroll in jamf and apply a config profile. My question is about restrictions on the config profile. We were told by our Apple rep that we should be able to restrict access to the App Store and certain apps so people can't pull up Netflix, etc... only apps we say are okay to use. I can't seem to figure out where these settings would be as it looks like there aren't many specific settings for tvOS. We are currently on jamf 9.98.

I am attempting to use the JSS API to programatically manipulate the list of packages in various policies, but when I "PUT /policies/id/123" (using an appropriate policy number) I am getting unpredictable "HTTP 409 CONFLICT" errors, where the returned HTML says that there are "conflicting names". The JSS in question has various sets of identically-named policies, usually with different sites/categories/buildings, and there is no problem with creating as many identical copies of a policy using the human/web interface as I want (even with the same site, category, and building). But sometimes I can't PUT changed/updated XML for a policy, and sometimes I can just fine, seemingly randomly. Questions: Does the "conflicting names" refer to policy names, or might it refer somehow to other conflicting names of things inside the policy? Should I in fact be able to PUT (& POST) policies distinguished by different IDs but with identical names? When PUTting an update, should I pass in the

I updated the JSS today to the latest and for whatever reason my netboots will not show up at all on client machines. I tried making a new AutoCasperNBI, no luck. Image is available over NFS. Here's a netboot log if that helps: netboot:state = "RUNNING" netboot:stateTFTP = "RUNNING" netboot:readWriteSettingsVersion = 1 netboot:netBootConnectionsArray = _empty_array netboot:logPaths:netBootLog = "/var/log/system.log" netboot:dhcpLeasesArray = _empty_array netboot:stateDHCP = "STOPPED" netboot:stateHTTP = "RUNNING" netboot:serviceCanStart = 1 netboot:timeOfSnapshot = "2017-05-24 20:59:28 +0000" netboot:stateNFS = "RUNNING" netboot:stateImageArray:_array_index:0:_array_index:0 = 0 netboot:stateImageArray:_array_index:0:_array_index:1 = 0 netboot:stateImageArray:_array_index:0:_array_index:2 = 0 netboot:stateImageArray:_array_index:0:_array_index:3 = 0 netboot:stateImageArray:_array_index:0:_array_index:4 = 2 netboot:stateImageArray:_array_index:1:_array_index:0 = 1 netboot:stateImageAr

This past year we implemented a 1:1 laptop program in 12 schools with close to 7,000 laptops. We are now in the process of planning the checkin process and I would like to update/store some data in the JSS as part of this. I have built a site using only HTML and Javascript (with the addition of the jquery library) that allows us to scan our asset tag, update the assignment and make notes about the condition of the laptop and power adapter. The problem I am running into is Cross Origin Request Security from my internal webserver (IIS 8) to the JSS. http://www.w3.org/wiki/CORS_Enabled#For_Apache_Tomcat_.287.0.41_and_above.29 Has anyone else run into this with the JSS and or Tomcat? If so, what steps did you go through to allow your app to communicate with the JSS. I've gone through the steps above with one of my web-servers (We have 4 in a cluster) and I was still receiving the error. Any help or recommendations are appreciated. Let me know if I can clarify further.

I'm trying to inject a script and plist to our end users for running some updates. I've verified that the injection method for the plist works, and that the script works. However, when I upload this plist with the script, it constantly fails to run and reports an "127" error. I'm relatively new to launchd for launching scripts, has anyone seen this error or is there a glaring issue with this plist I've missed? <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.redacted.delayscript</string> <key>ProgramArguments</key> <array> <string>/Users/Shared/.restartscript.sh</string> </array> <key>StartInterval</key> <integer>60</integer> <key>RunAtLoad</key> <true/> </dict&gt

When running a script for 802.1x wifi configuration through Self Service, the following works perfectly. If I push it from a policy, the certificate doesn't get assigned to the com.apple.network.eap.user.identity.wlan.ssid identity in keychain. Is there a difference in how the JSS distributes the script through self service vs pushing via policy? If I run it through "sudo jamf policy" as the logged in user, it'll also work. Just seems to be when the policy kicks off on its' own is when it's not working. #!/bin/sh security set-identity-preference -n -s "com.apple.network.eap.user.identity.wlan.ssid.LC-SSID" security set-identity-preference -c "$Cert" -s "com.apple.network.eap.user.identity.wlan.ssid.LC-SSID" /Users/$currUser/Library/Keychains/login.keychain /Library/Keychains/System.keychain

I am trying to get a usable list of who is an admin on a given set of machines. Should be easy... run an extension attribute for anyone above 500 and BAM.. but these are AD mobile accounts so the UID is 10 digits long. See the example from a record below. I can look at an individual record and see that there is a field marked admin that is correctly populated. Ive been working with JAMF support and they claim there is no way to use that field to generate any sort of usable output... a smart list, .csv anything! Anyone know of a way to pull that "admin" field out of the JSS? or create an exention attrubute that will give me the admins on a system without relying on UID's above 500? thank you. EXAMPLE: name has been changed to protect the annoying little F(redacted)Local User AccountsUID Username Full Name Admin Home Directory Size Legacy FileVault Enabled FileVault 2 Enabled501 admin administrator Yes /Users/admin 28 MB No No502 admin2 admin2 Yes /Use

Apologies if this has been answered elsewhere. I'm experimenting with modifying the username value using the REST API rather than our current method of running jamf recon -endUsername $user, but realized that the former won't update the corresponding user attributes via LDAP as does inventory collection. I realize I can just PUT the Real Name and Email Address values as well... but that would kind of defeat the purpose of mapping LDAP in the first place, not to mention invite the possibility of inconsistency. Is there a workaround for this to allow both username updates via API + LDAP autopopulation? Or am I required to update it via recon to achieve this?

Warning up front my API wisdom is very very basic. I've had some luck here and there with other things, but first time trying to change/fill a user extension attribute. I have an extension attribute called "UserID_Number" which has ID number 1. I know this can be done as I've done it manually with "The MuTT" but unfortunately something I can automate is now required. I figure I've got something wrong down below but after a few hours of smacking the desk I'm still lost. Any direction to the way that works would be greatly appreciated. Thanks. #!/bin/sh #Variables file="/path/to/file.csv" #Path to the CSV server=JSSSERVER #Server name username=CAPABLEUSERNAME #JSS username with API privileges password=CAPABLEUSERSPASSWORD #Password for the JSS account user=no-one@gatewayk12.org UserID=187 JSS_API_INFO_DIR="/tmp/jss_api_tmp" # Directory where working files for each JSS ID will be stored

I'm trying to write a script that will pull the local username for a given UID so I can reset the password for an account without knowing the username. The goal is to reset all local user passwords (except a specific admin account) on a device. I'm trying to assign the username to a variable by using id but it isn't working. Any thoughts are appreciated. # HARDCODED VALUES newPassword="12345" # CHECK FOR VALUE PASSED FROM JSS IN PARAMETER 4 AND, IF SO, ASSIGN TO "newPassword" if [ "$4" != "" ] && [ "$newPassword" == "" ]; then newPassword=$4 echo "New password will be passed from JSS policy" fi # VARIABLES user501=[[ id -F 501 | tr -d ' ' | tr '[:upper:]' '[:lower:]']] user502=[[ id -F 502 | tr -d ' ' | tr '[:upper:]' '[:lower:]']] # display info for testing purposes echo "501 = " $user501 echo "502 = "

Hi all, I have been bashing my head against this all day, for some reason when trying to enable filevault via a Configuration Policy it just doesnt seem to work. The policy goes down to the machine but it doesnt look like the institutional key goes down, when i reboot the mac it asks for admin creds to enable FileVault but then pops up with a "There was a problem enabling FileVault. Please use SysPreferences>Security to enable", logs dont really seem to be showing anything and when running fdesetup hasinsitutionalkey it shows as "false", Can someone point to where i have possibly gone wrong here?