Is there a way to scope a policy by a local user account?I wanted to make a Policy to remove certain dock items from the local student account at each login but it does not seem to allow me to specify the local student account only.

We are looking at rolling out SCEP Configuration Profiles for our iOS devices (and macOS devices...but for now, we're focusing on iOS). There is a definite lack of information out there on doing this, so I am curious if anyone has been able to successfully implement it? We have created an iOS Configuration Profile, with the SCEP payload configured as follows... URLThe base URL for the SCEP Serverhttp://scepserver.domain.org/certsrv/mscep/mscep.dll NameThe name of the instance: CA-IDENTNAME-NDES-MSCEP-RA Display "Redistribute Profile" setting for this profile*Display a setting in the General payload that allows you to choose when you want to automatically redistribute this profileUnchecked SubjectRepresentation of a X.500 name (e.g. O=CompanyName, CN=Foo)CN=$DEVICENAME,O=Organization Name Subject Alternative Name TypeThe type of a subject alternative nameDNS Name Subject Alternative Name ValueThe value of a subject alternative nameBlank NT Principal NameAn NT principal name for

I want to package my com.apple.SoftwareUpdate.plist and have it installed on other macs. the plist i want packaged will have Automatically check for updates. AND install system data files and security updates CHECKED !! I DO NOT WANT Download newly available updates in the background CHECKED. !!! I am going to use that PACKAGES application to package up the .plist and install it in the /Library/Preferences. location. Will this overwrite the .plist that is currently there? for 10.10. 10.11. and 10.12 systems

We've slowly been deploying JAMF to a handful of computers and we've been using multiple methods to deploy. (QuickAdd Package, Self Enrollment, and Apple DEP Enrollment). We've noticed that not all computers are being managed by the same Management account. Is this going to be a problem going forward and if so is there an easy way to clean it up? Most of the managed accounts have random passwords and we're creating additional hidden local administrators on each computer.

Hello, As we want to implement (or force, actually) our users to update to the latest macOS I thought I'd ask for some "best practice" tips if you already have a working system in place. We still have a two users on 10.8.5 and 10.9.5 (sigh), which I will have to deal with personally. But otherwise I'd rather we have a working system using the JSS to have our users, or help the users update this. If you're already doing this, do you have any pointers you'd like to share?

Just making sure I'm not the only one seeing this... When setting up a static query ("Advanced Computer Search"), I have the criteria for "Managed". This lets me select managed, or unmanaged. When setting up a smart group, I only have "Managed by:"... with the options for blank or our management account. End result is likely the same, but seems like a bug to me... I'm simply trying to set up queries that omit unmanaged machines.

I'm trying to unlock some of the system preferences but the security authorizationdb write system.preferences does not seem to work any more ... However old scripts I unless for time settings etc ... are also no longer working so I guess something has changed? This is what I am using #!/bin/sh security authorizationdb write system.preferences allow security authorizationdb write system.preferences.network allow exit 0

I have a customer who wants all of their managed iPads to be logged out of iCloud so that the users can setup their own iCloud account. I was hoping to find a way to do this through Jamf Pro, but I can't find one. Does anyone know if this is even possible? There are options for restricting iCloud features, but I do not see that there is a way to log them all out of iCloud. I'm either missing something, or it's just not possible. Suggestions?

Hi all, Just wanted to see if anyone was getting a bunch of Unapproved Caller errors on they're machines this morning. I think its coming from Symantec. Not sure if this is something that i'm just seeing or if anyone else is seeing this. Thanks,Ronnie

I have recently setup a non prod jss. Netboot is running 10.10.5 on a mac mini. 16gb ram 128gb ssd. My first netboot image I created using Casper NetInstall Image Creator. This image works fine but is not very robust. It basically just launches into Casper imaging and allows the device to be imaged. I am now trying AutoCasperNBI to create the image but it is incredibly slow. According to the website it says 20 mins for an SSD and 90 minutes for a platter drive. I am over 120 minutes into image creation and 3.09gb in file size (still growing) but this seems way too long. Autocasper logs show copying from hdd to the netboot.sparseimage. Has anyone seen this before?

Hey, is anybody managing a network with Mac clients being backed up by Retrospect? Are you using the public/private key function for client login? How much of the client install were you able to automate with Casper? There doesn't seem to be a lot of info on jamfnation about Retrospect, so either lots of people are doing it with no problems or nobody is using Retrospect, haha.

Seems like Server.app 5.3 has broken my JDS.During the upgrade process, Server.app ran through "renewing certificates". As such, the web service is now trying to use the built-in cert vs the JSS cert.Looking at my apache_serviceproxy.conf file, jss_ca.cer is nowhere to be found.About to check the vhost files.

I am renewing the Push Token in our JSS and when I uploaded the PEM file I get this notice. I am relatively certain that I am using the same Apple ID that I used in the past. Is this error an indication that we used a different Apple ID? Or is it a sign of some different problem. Thanks, Tim

Trying to find a way to measure the mail store size via an extension attribute that could then be viewed in inventory. The mail store is for Apple Mail, not Outlook. The potential complication is that there are several different operating systems in the environment and Apple changed the mail database directory in each iteration of the OS, so it could be in any of the following three locations... ~/Library/Mail/V4 (Sierra)~/Library/Mail/V3 (El Capitan)~/Library/Mail/V2 (Yosemite and prior) Has anyone seen an EA that can display these totals?

I've been working on a static HTML page with some info for our users that we will put in Self Service as a plugin URL. I made an update to this page and I can't get the updates to show up in Self Service on my test machine, which seems to have the old version cached. I've run the jamf manage command, rebooted, and as a shot in the dark, cleared Safari's cache. Is there a way to force Self Service to clear its cache?

Hello, long time lurker here. We are setting up a secure print service and part of the setup is to have your username before the print server/queue. I have uploaded the driver package, attached my PPD of my printer configuration and set up the printer in JSS, and created a self service policy that distributes the drivers and printer config. Everything works super flawless except getting the current users login added to the lpd url as seen below. Device URllpd://$USERNAME@myservername.mycompany.com/SecurePrint_MAC_Queue The #USERNAME stays in /etc/cups/printer.conf same as above. I need my actual username to replace it as you can gather. If its not supported this way then perhaps I can use a script, one script I have tested is this: sudo launchctl stop org.cups.cupsdloggedInUser=$( ls -l /dev/console | awk '{ print $3 }' ) | sed -ie "s|$USERNAME|${loggedInUser}|g" /etc/cups/printers.confsudo launchctl start org.cups.cupsd now it does reportedly stop cups and r

Bonjour, Dans le JSS, dans les propriétés d'un appareil, nous avons la possibilité de forcer le fait que le nom de cet appareil (figurant dans Jamf) ne soit pas modifiable par l'utilisateur. Nous aimerions activer cette fonctionnalité pour tous nos ipads, mais nous ne pouvons pas nous résoudre à traiter les ipads un par un! Avez-vous connaissance d'une commande SQL à exécuter afin d'activer cette case à cocher pour tous les ipads? Merci de votre réponse,Cordialement,M. GAILLARD

We've got multiple versions of some Adobe apps on some of our machines, and we thought it'd be nice to have slightly customized icons (2017 added to the bottom corner of the icon for example). It'd be nice if we can replace the icon with a post-install script, but it's not working. I've got the icons converted to .icns files and their names changed as appropriate name for each app (ex. pr_app_icons.icns for Premiere). The icns files are installed in /tmp and a post-install script copies the files to [Adobe App]/Contents/Resources/, and changes the ownership and permissions to match the original icns file. A restart of the Finder, and no change in the app icon. I kill the cache service (cfprefsd) and then kill the Finder, and no change. Any idea what I'm missing. I'm thinking either a weird security feature or it's a hidden .icns file. But this looks to be the correct file in the /Contents/_CodeSignature/CodeResources file.

Content backfill required

I have always used Open Directory when Active Directory isn't available. However for the first time I had an Open Directory go bad as a result of a major OS upgrade. I was going from Yosemite to El Capitan. A little command line work successfully restored the OD from a Time Machine backup. For years I've heard of Open Directory being fragile, but honestly this is the first time I've been stung by a broken OD. Things that easily break are things I want to avoid I generally have sites dominated by Mac OS clients, with a few Windows clients here and there. Also Mac servers, and services & devices that support LDAP. The JSS for one. Some things will bind to Open Directory LDAP, some don't. Authenticating network printers would be nice. I've been quite successful with pGina for authenticating Windows systems, but it is a rather clunky solution and leaves out things like printers A hosted directory service seems appealing, at least from what little I know abou

I logged in to developer.apple.com/download to get Xcode 8.3.1 and discovered that the latest version available from there is 8.3. However 8.3.1 is available in the Mac App Store. Does this mean we will no longer be able to stay on top of the latest versions via the developer site? Has anyone heard one way or the other?

I have an app that I want to make available for a several departments in self service. I have another department that wants the app installed automatically. Is there a way to do this with JAMF Pro?

How is everyone doing so far with Sierra enrollments, policies, profiles etc... ? are you seeing any strange things happening? I am seeing this in my FV2 configuration profile for the 'security& Privacy' payload !! Not sure sure if its a Sierra issue . running 9.96 (FileVault Recovery Key Redirection payload is fine) Security & PrivacyOSXConfigurationProfile.com.apple.SubmitDiagInfo.jsp is not implemented. Check the log for more information.

10.11.4 - User folders not creating when logging in as AD user. The iMAc has been binded. When I login as any AD users I seem to get library, keychain errors, and the user folder is not creating. It also seems that when I make for instance as change to the mouse to right click the setting does not stick. This has happened on 2 iMAcs so far. Any Ideas is helpful.

Hi all I had been using the network range of our Firewall to tell if a Mac was external to our network or not and it would update the building accordingly. Unfortunately that's now changed and there's no fixed range to tell if a Mac is external, i've looked at the 2 built in EA's of Last reported IP and IP and i can make a smart group based on these to tell if the Mac is external or not but what i'd ideally like to do is have the Building update based on these as they're updated every 15 minutes at check in (rather than any EA i make which will only update at recon). Is there any way to update the building details outside of using the network segments ?