I have a launch daemon and a script created to run after an OS upgrade. Results are that the daemon runs, and the script but only part of the script is executing. Below is a part of the script, the Turn SSH on piece works as I can verify that in the System preferences, when the script completes it removes the daemon and self destructs, but for some reason jamf policy isn't checking for and running the policies and ASU isn't running. I have the daemon and script in in place to set some preferences, run jamf policy and run ASU on first boot after an OS upgrade we have in Self Service. Any advice? #!/bin/bash # Turn SSH on /usr/sbin/systemsetup -setremotelogin on #Check for jamf policies jamf policy #Run Apple Software Update softwareupdate -i -a # Remove setup LaunchDaemon item /bin/rm -rf /Library/LaunchDaemons/org.name.post_os_upgrade.plist # Make script self-destruct /bin/rm -rf $0

Hello Casper admins! I'm relatively new to both the Mac world and JSS computer management. We are primarily a windows shop but as of this summer we will be offering Macs to users (due to popular demand). I have been tasked with coming up with a workflow to add our printer fleet to JSS and map them to their respective users, perhaps using self service (hopefully using Active directory OUs) I have no idea how to do any of this AD integration is even possible with JSS. Also I don't know if its possible for the endpoints to print to the print server rather than printing directly to the printer. My hope is to get some insight on some of what you guys are doing out there in the wild, perhaps get some information on how you did it. Also what the requirements are in terms of getting this up and running? Thanks in advance, Sincerely a Noob Mac admin

I have heard that there is a way to prevent users from running the "sudo /usr/local/bin/jamf removeFramework" command on their computers. Basically a way to disable that command. Could someone point me in the right direction on how to accomplish it? Thank you!

Hi Folks, I am testing bare metal imaging with Casper on the new MacBook Pro using NetBoot via the Belkin USB-C to Ethernet Adapter that is sold by Apple. Imaging works fine, but sometimes during the Setup Assistant, the presence of Ethernet isn't recognized. I was wondering if I need to run a script at postinstall time to ensure the Belkin adapter is discovered and enabled. Any thoughts? I'm testing a basic Sierra image with nothing on it but Microsoft Office 2016. There is a hidden admin account and we are forcing setup of a new account on that third boot. However, Office doesn't get activated and I am wondering if it is because the network connection is down after imaging until that first user account is created and logged in. Imaging log: Initializing Imaging Process... Mounting smb://*******/casper... Preparing disk for block copy... Performing Block Copy of osx_updated_170330-10.12.4-16E195.hfs.dmg... Cleaning up after block copy... Setting computer name to "MBProTouchBar15"..

when running recon.exe I keep getting that it needs .NET framework 3.5 windows features shows that it has .NET framwork 4.6 Advanced Service ON when trying to turn 3.5 features ON it errors. has anyone been enable to enroll a Win 10 computer?

Working through a migration performed on JSS servers a while back. I'd set up a policy to reissue the FileVault 2 key following a few people's work (mostly @rtrouton's FV2 stuff) by deploying a .plist, importing, reissuing, yada yada yada. It's failed on a group that has some bad user identities (wrong admin service account that has local FV2 rights, etc). I don't mind manually touching each one to do fdesetup add -usertoadd JAMFSERVICEACCOUNT but I'm having a hard time identifying the right search criteria to separate out the 2 configurations to identify the FV2 not configured. I've tried a number of the search criteria around FV2 and none of my attempts seem to properly identify the group which shows as "Not Configured" Please help me. I'm stuck in a forest and I desperately can't find the trees.

Hi Folks. Maybe one of you have a quick tip. I need a list of all packages sort by date. Newest packages first. In Casper Admin there is a creation date in package details but no column to display or sort it. I have checked the API Site. But there is also no implementation for get package date. In the JSS is also no creation date column. If some can help, let me know.Thx

Forgive me for asking a newbie question, but I cannot seem to figure out how to create an OS X configuration profile. I've been able to manage some settings, but for example, I want to create a wireless preauth configuration profile. My understanding is that this needs to be done in OS X Server, but I thought Casper Suite would be able to do it as well. At any rate, I can't for the life of me figure out how to create a config profile in Casper or OS X Server. If I have to go the route of OS X Server, do I have to enable Open Directory in order to get the ability to create these? The main reason behind wanting to go with Casper is to not have OD enabled and not have to use the Golden Triangle. Any suggestions and advice is greatly welcome. Thanks in advance.

For the life of me I can't seem to compile duti... Does anyone have a compiled version 10.7 available for download? Thanks

I've fired up a virtual Ubuntu Server that dishes out MS Office Updates to Mac Clients with Office 2016. The settings for updating office are user specific and not globally defined. I'm wondering how anyone is pushing these custom settings out to the clients? I've tested the managed preference option in Casper v9.96 with no luck. I know a way I can do it but didn't know if anyone was using a "cleaner" way than what I've come up with. Also - what is anyone doing about updates once outside the corporate network? I guess I could open up my server to the outside but it'd be nice if it just defaulted to microsoft when my internal server is unavailable but I've tested and it isn't smart enough to do that. Any help / thoughts would be much appreciated. Thanks in advance.

Is there a way to scope a policy by a local user account?I wanted to make a Policy to remove certain dock items from the local student account at each login but it does not seem to allow me to specify the local student account only.

We are looking at rolling out SCEP Configuration Profiles for our iOS devices (and macOS devices...but for now, we're focusing on iOS). There is a definite lack of information out there on doing this, so I am curious if anyone has been able to successfully implement it? We have created an iOS Configuration Profile, with the SCEP payload configured as follows... URLThe base URL for the SCEP Serverhttp://scepserver.domain.org/certsrv/mscep/mscep.dll NameThe name of the instance: CA-IDENTNAME-NDES-MSCEP-RA Display "Redistribute Profile" setting for this profile*Display a setting in the General payload that allows you to choose when you want to automatically redistribute this profileUnchecked SubjectRepresentation of a X.500 name (e.g. O=CompanyName, CN=Foo)CN=$DEVICENAME,O=Organization Name Subject Alternative Name TypeThe type of a subject alternative nameDNS Name Subject Alternative Name ValueThe value of a subject alternative nameBlank NT Principal NameAn NT principal name for

I want to package my com.apple.SoftwareUpdate.plist and have it installed on other macs. the plist i want packaged will have Automatically check for updates. AND install system data files and security updates CHECKED !! I DO NOT WANT Download newly available updates in the background CHECKED. !!! I am going to use that PACKAGES application to package up the .plist and install it in the /Library/Preferences. location. Will this overwrite the .plist that is currently there? for 10.10. 10.11. and 10.12 systems

We've slowly been deploying JAMF to a handful of computers and we've been using multiple methods to deploy. (QuickAdd Package, Self Enrollment, and Apple DEP Enrollment). We've noticed that not all computers are being managed by the same Management account. Is this going to be a problem going forward and if so is there an easy way to clean it up? Most of the managed accounts have random passwords and we're creating additional hidden local administrators on each computer.

Hello, As we want to implement (or force, actually) our users to update to the latest macOS I thought I'd ask for some "best practice" tips if you already have a working system in place. We still have a two users on 10.8.5 and 10.9.5 (sigh), which I will have to deal with personally. But otherwise I'd rather we have a working system using the JSS to have our users, or help the users update this. If you're already doing this, do you have any pointers you'd like to share?

Just making sure I'm not the only one seeing this... When setting up a static query ("Advanced Computer Search"), I have the criteria for "Managed". This lets me select managed, or unmanaged. When setting up a smart group, I only have "Managed by:"... with the options for blank or our management account. End result is likely the same, but seems like a bug to me... I'm simply trying to set up queries that omit unmanaged machines.

I'm trying to unlock some of the system preferences but the security authorizationdb write system.preferences does not seem to work any more ... However old scripts I unless for time settings etc ... are also no longer working so I guess something has changed? This is what I am using #!/bin/sh security authorizationdb write system.preferences allow security authorizationdb write system.preferences.network allow exit 0

I have a customer who wants all of their managed iPads to be logged out of iCloud so that the users can setup their own iCloud account. I was hoping to find a way to do this through Jamf Pro, but I can't find one. Does anyone know if this is even possible? There are options for restricting iCloud features, but I do not see that there is a way to log them all out of iCloud. I'm either missing something, or it's just not possible. Suggestions?

Hi all, Just wanted to see if anyone was getting a bunch of Unapproved Caller errors on they're machines this morning. I think its coming from Symantec. Not sure if this is something that i'm just seeing or if anyone else is seeing this. Thanks,Ronnie

I have recently setup a non prod jss. Netboot is running 10.10.5 on a mac mini. 16gb ram 128gb ssd. My first netboot image I created using Casper NetInstall Image Creator. This image works fine but is not very robust. It basically just launches into Casper imaging and allows the device to be imaged. I am now trying AutoCasperNBI to create the image but it is incredibly slow. According to the website it says 20 mins for an SSD and 90 minutes for a platter drive. I am over 120 minutes into image creation and 3.09gb in file size (still growing) but this seems way too long. Autocasper logs show copying from hdd to the netboot.sparseimage. Has anyone seen this before?

Hey, is anybody managing a network with Mac clients being backed up by Retrospect? Are you using the public/private key function for client login? How much of the client install were you able to automate with Casper? There doesn't seem to be a lot of info on jamfnation about Retrospect, so either lots of people are doing it with no problems or nobody is using Retrospect, haha.

Seems like Server.app 5.3 has broken my JDS.During the upgrade process, Server.app ran through "renewing certificates". As such, the web service is now trying to use the built-in cert vs the JSS cert.Looking at my apache_serviceproxy.conf file, jss_ca.cer is nowhere to be found.About to check the vhost files.

I am renewing the Push Token in our JSS and when I uploaded the PEM file I get this notice. I am relatively certain that I am using the same Apple ID that I used in the past. Is this error an indication that we used a different Apple ID? Or is it a sign of some different problem. Thanks, Tim

Trying to find a way to measure the mail store size via an extension attribute that could then be viewed in inventory. The mail store is for Apple Mail, not Outlook. The potential complication is that there are several different operating systems in the environment and Apple changed the mail database directory in each iteration of the OS, so it could be in any of the following three locations... ~/Library/Mail/V4 (Sierra)~/Library/Mail/V3 (El Capitan)~/Library/Mail/V2 (Yosemite and prior) Has anyone seen an EA that can display these totals?

I've been working on a static HTML page with some info for our users that we will put in Self Service as a plugin URL. I made an update to this page and I can't get the updates to show up in Self Service on my test machine, which seems to have the old version cached. I've run the jamf manage command, rebooted, and as a shot in the dark, cleared Safari's cache. Is there a way to force Self Service to clear its cache?