All of a sudden, I am having a very strange issue and cannot bind my Mac computers to my Active Directory. Windows machines bind perfectly fine. I am getting the following error: /Active Directory, Module: ActiveDirectory - krb5.dylib - set password using MS set password returned: 0 result_code 32017-05-15 14:03:55.372321 EDT - AID: 0x0000000000000000 - 74357.1515673, Node: /Active Directory, Module: ActiveDirectory - krb5_credential - Changing password failed for 'bpage-imac$@CORP.MYDOMAIN.COM' with error '' (3)2017-05-15 14:03:55.372328 EDT - AID: 0x0000000000000000 - 74357.1515673, Node: /Active Directory, Module: ActiveDirectory - failed to change computer password deleting record - 'cn=bpage-imac,CN=Computers,DC=corp,DC=mydomain,DC=com' It is driving me crazy. DNS looks fine. Time and date is set to the domian controller. I have tried.. shortening the computer namecreating a record in AD firstusing a different account to bindusing a different OU to add the machine to..prefe

Hi, I'm looking to deploy Mac OSX Updates via JSS. I tested it out where I can deliver the Updates via the JSS and the users can installer, but I prefer to do this using another Scenario: Scenario: Cached the OSX update "10.10.4" (I'm not sure how to do the caching) on to the users machine and when they click on the "Install Icon" in self service the package will execute installing from the users local machine rather then over WAN. Also is there a way to know if the package is indeed cached? I'm not great at scripting so I would appreciate any help I can get.

I was browsing through the jss and I noticed one of our Macs has 99 hidden local accounts I have no clue what they are and don't see any other machines like it. The only hidden account any Mac should have is out jssadmin account. Any idea what this is?

Hi, I just learned that Microsoft AutoUpdate 3.9.0 (170409) is not checking automatically for updates when it is set to do so. So I wanted to monitor the issue, and make sure users get the latest version of MAU. Unfortunately MAU is not an app, so I can not use the app version in JSS recognize the effected clients. And it looks as if JAMF still does not collect the version info from the package receipts. Does anybody have an idea how I can detect the bad version of MAU?

Hi y'all! Hoping someone has run into a similar issue and has some relevant thoughts. My setup is clustered JSSs: JSS 1) used by admins for, well, admin work. JSS 2) Limited Access JSS that computers report in to. The LA JSS is open to the internet and so is behind an Apache proxy (running on the same machine). The proxy handles all the TLS. Machines report in just fine, we are able to add and manage machines, etc. The problem I'm running into: the JSS is reporting the IP address of each machine as the IP address of the LA JSS. I realize this is because the connection is coming from the proxy running on the LA JSS, and was hoping that enabling access logging in tomcat would start to report correct IPs, but no luck there. Relevant (I think) line from server.xml: <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" requestAttributesEnabled="true" prefix="localhost_access_log." suffix=".txt" pattern="%h %l %u %t "%r&quot ; %s %b" resolveHos

Hi, Anyone have better idea regarding the following? We are wanting to restrict the access of Macbook's USB ports, so no users can steal company data. We are wanting the USB ports to be read only, so users can still copy some things, but not write out to USB port. When looking into Casper configuration Profiles, the external Disks is either "Allow" or not. I have try this setting, and indeed the Macbook that I tested can no longer see any USB drive detected. So, is there anyway to have a read-only option for USB ports?

Scraping from some scripts here on Jamf Nation I have a small script attached to a policy that executes at login and sets the dock using dockutil. I want it to execute at login so it adds the user's Documents folder to the dock: echo "Adding Documents..."; /usr/local/bin/dockutil --add '~/Documents' --no-restart --position 11 "$LoggedInUserHome" This works perfectly in testing with the policy but I'd love to have this run at login only after a computer is newly imaged. I can't add it to my first boot script because it won't set the Documents folder, not knowing what $LoggedInUserHome is. Wonder if anyone has any thought on how to accomplish? I'm almost ready to just have our Team run this from Self Service, post login and post imaging, but reaching out to Jamf Nation first!

Before I ask the question, this is not an angry post! Just curious why... I have had a couple of open cases with Jamf Support, the latest being a rather important one and ongoing for about a month back and forth now, but then end up randomly being closed. I don't receive any notification of the support case being closed, I just "happen" to come across it. Has anyone else experienced this, or know the reason why behind it?

Hi all, I had no issues with dockutil under 10.11 but using the same script with dockutil on 10.12 machines will not work for some reason. Has anyone been successful in using dockutil with Sierra? I tried updating to the latest dockutil but no dice. I can share my dock script if needed. Thanks!

Is there a command or something that can be ran to report if a computer had a kernel panic. Much like we can report on if a computer's hard drive is almost full? I would like to create a smart group that would notify me if a user experiences a kernel panic.

Hi Guys, I'd like our clients default mail reader to be Outlook 2011.. i tried the com.apple.internet mcx plist but this doesn't seem to work? Any way of doing this via MCX on 10.7 clients or do i need to script the launch services plist?

Hello, I have a REPOSADO SUS and for some reason I don't get any update from Mac OS Sierra 10.12.x http://172.32.129.201:8088/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1_Production.sucatalog Can you please help me how to re-configure the reposado server? Do i have to redo the entire setup? I can't seem to find any settings. Thanks so much.

So I'm starting to work with Apple Classroom as a potential replacement for Casper Focus in our district. We currently have class sets of iPads and they aren't assigned to individual students. Right now we create static mobile device groups with the teacher's name and assign each set of iPads to a group. I have classroom working to a point - it can open on the teacher device and see the available classes, but none of the iPads in the device group assigned to the teacher show up. I checked here and apparently people were hoping that Classroom would support device groups by now. Has anyone gotten it working?

I want to be able to identify machines where filevault is enabled but the fileVault key isn't escrowed in the JSS. Does anyone know a way to report this? I don't need the key just need to know if its present or not. Thanks

Hi everyone, Our school wants to use 100-150 laptops for exams. In the past we've disabled and hidden Spotlight/notification center from the menu bar via script, but because of SIP we get errors until we disable it. Is there a way to completely disable this without having to boot to a recovery drive for each computer? Thanks!

Recently Chrome has stopped auto updating its built in Flash player and end users are getting a flash error when using Chrome with certain sites. Chrome itself updates fine, however, and is current on all machines I've checked having the flash issue. I pushed the PPAPI flash update to a couple of machines I'm testing on and haven't seen any issues as of yet. I also regularly update the NPAPI flash plugin for Firefox and Safari. Just wondering if anyone has run both of these plugins, or just the pepper plugin and had any issues? Thanks in advance.

Hi Guys, Anyone out there using jamJAR yet? I am trying to get it working but running into a annoying little issue... I keep getting an error that says LocalOnlyManifest not declared, however, I have checked the locations of Managed Installs folder and ManagedInstalls.plist and they are definitely present, if I run the munki command managedsoftwareupdate --installonly it works but the script from the JSS just says the above error. The naming convention of everything seems to match whats in the script. Might be the wrong place to be asking this but I figured since its trying to be run from a JSS...

So I am using the Reissuing FileVault keys with the Casper Suite. Followed this to the T (except the DMG for the ICONS). I am getting the follwoing error: Executing Policy Reissue invalid or missing FileVault recovery key Downloading AppleCustomScriptIcon.pkg... Downloading Verifying package integrity... Installing AppleCustomScriptIcon.pkg... Successfully installed AppleCustomScriptIcon.pkg. Running script reissue filevault recovery key... Script exit code: 0 Script result: Alerting user USER about incoming password prompt... Prompting USER for their Mac password... Successfully prompted for Mac password. Issuing new recovery key... **[WARNING] FileVault key was generated, but escrow did not occur. Adding personal recovery key.** Submitting log to https://comapny.jamfcloud.com/ Any ideas why the escrow doesn't occur? And not getting the key uploaded to my JSS?

I seem to be stuck on a part of the setup trying to connect our Active Directory server to JAMF. It keeps telling me that it can't find the account. I have all the right info for the domain. I have tried several known good accounts, but I still get "Could not find user". Any leads or ideas to point me in the right direction would be great. Thanks!

Need some help figuring out deployment of Mac App Store apps that I obtained a VPP license for. Scratching my head as the apps won't deploy and in the computers I scoped to, there are no "pending commands". Hoping this is really easy! In the JSS, I select Mac Store Apps and then add Pages. Distro method is set for "Install Automatically..", I have it scoped to 1 computer as a test and have the VP option checked off in the VPP tab. Sit and wait, check in time passes and nada, no app installed. WTH am I overlooking? Thanks, Tom From the Guide:"Distribute a Mac App Store AppWhen you distribute a Mac App Store app, you configure settings for the app and specify the users and computers that should receive it (called “scope”).1. Log in to the JSS with a web browser.2. Click Computers at the top of the page.3. Click Mac App Store Apps.On a smartphone or iPod touch, this option is in the pop-up menu.4. ClickNew .5. Enter the name of the app, choose an App Store country, and click Next.6.

Not enough room in the subject line to accurately outline everything. I don't even know where to start honestly so I'm just going to jump in here. This is regarding the full macOS 10.12.4 installer, not the updater We are not using imaging, this is for doing a standard "cache then install cached" in-place OS upgrade Hosted JSS w/corresponding Jamf hosted DP w/5GB limit. Unable to upload Apple's Install macOS Sierra installer via Casper Admin because it errors out every time With JSS v.9.98, able to upload larger packages to hosted JSS via Management Settings > Computer Management > Packages Using that method does not allow me to upload Apple's installer, as it shows up as ".app.zip" and the JSS does not recognize it as a valid format So far only successful upload has been when I went into Apple's installer package, removed InstallESD.dmg and uploaded that to the hosted JSS through the Packages upload in the JSS Once the InstallESD dmg had uploaded successfully and it had a va

We recently started rolling out JAMF at my company, as a replacement for MaaS360 and Munki. Currently, we're in the first phase, which is rolling out JAMF for MDM and maintaining Munki for package management while we finish setting up self-service and ironing out some of the problems we're having. Currently several of the computers that are enrolled in JAMF are shutting down after half-hour idle time. I haven't been able to establish a pattern yet, and to the best of my knowledge, it's not affecting every computer. I can fix it on the computers that are experiencing it by using the following commands sudo defaults write /Library/Preferences/.GlobalPreferences com.apple.autologout.AutoLogOutDelay -int 0 sudo defaults delete /Library/Preferences/.GlobalPreferences.plist com.apple.autologout.AutoLogOutDelay but I was wondering if there's somewhere I should look that I'm not to make sure JAMF isn't setting a flag somewhere, or if there's a known conflict with JAMF and Munki where I sho

I have a FileVault Disk Encryption Configuration with an institutional recovery key set to expire in June. Does anyone know if this needs to renewed? How does it effect the encrypted Mac?

Hi, At our organisation we are deploying device profiles to OS X devices to grant acces to our employee network. In the device profile are 2 domain controller certificates included of our primary and secundary domain controller. The issue is, one of or sysadmins upgraded the secundairy DC from win 2012 to 2016 so by that he has issued a new domain controller certificate. When we deploy that to machines it will only work when we delete the old device profile, in the past when the certificates getting expired we deployed a .pkg that deploys the same device profile with new certificates with the same DC name. Now when we deploy the new .pkg with the .mobileconfig files with new info it wont overwire but create a new device profile and only works when we manually remove the old device profile. is there any command we can add to our install/deploy script that it first removes that specific old device (wifi) profile? Quick help woud be appreciated! Greetings!!

My buddy has a wound we are taking care of, and I had this JNUC shirt that was too small for me. He's lookin' sharp!