Hi, I'm trying to run a policy with a script to run the sophosupdate command written from info here https://community.sophos.com/kb/pl-pl/15895 The script is #!/bin/sh rm -f /Library/Caches/com.sophos.sau/CID/cidsync.upd sophosupdate I get no errors if i sent this via Remote but the output on a policy is Executing Policy Sophos UpdateRunning script Update Sophos...Script exit code: 127Script result: /Library/Application Support/JAMF/tmp/Update Sophos: line 5: sophosupdate: command not foundError running script: return code was 127. Looks like it doesn't know where to run the command sophosupdate from.. I've had a poke around but can't seem to find an answer. Anyone else tried this or know the path to where the command runs from? Thanks Al

Hi Everyone. I am trying to add a policy that installs Pulse Secure on our endpoints, because we require it for use with VPN. I have seen the instructions from @rtrouton on now to deploy with a custom config, but they do not work, as I am simply trying to get the app to install. I have a .dmg from Pulse that contains a simple .pkg file. When running it manually on an endpoint, it works no problem. However, when I upload the same .pkg to the JSS and use a policy to install it, it results in a broken application that will not open. I have tried using Composer as well to create my own installer, that has the same result. Does anyone have any ideas here? I feel like this should be a really simple answer, but it is evading me currently. Thanks in advance!

Just recently we've noticed an issue where accounts are not able to be added to FileVault. I have a case open with Apple at the moment, but wanted to see if anyone here had noticed this issue. The problem happens when FileVault is already enabled for a user and you try to enable other users from System Preferences. The users password is accepted, but when you click "done" you are immediately presented this message. I've also attempted to enable the user through Terminal to no prevail.

Maybe I'm missing something. I have set up an iPad in a shared prestage. In the setup assistant portion i have left location unchecked (per my JAMF buddy when we first set things up.) When I go to start the iPad up (not all of them mind you, only a handful out of a whole cart), they will not change to the new date/time. This causes the iPad to not allow me to log in with any accounts (at least that's what I'm thinking). I don't believe that the location services are being enabled. It shows logging in and then just jumps back to the enter passcode screen without ever fully logging in. I can take the same account and log in to another iPad from the cart without any issues, so I know it's not the user account. Any ideas?

Hi All,not jamf relatedI am migrating a user from Sierra 10.12.3 to same OS using Migration Assistant. After migration, permissions in the ~/Library are a mess. Cannot repair using ACL repair in Recovery Partition (gone) cannot repair using "Get Info" propagate...no worky..... does not help to disable CIP. Probably some chown command but cannot seem to find Sierra info for that either....Migrated again to make sure it wasn't a glitch. same result...Decided to migrate selectively, the "Old fashioned way" by Target Disk Mode. Deleted the blown up AD Mobile profile from the New computer, and now cannot create a new AD Profile, within which I would dump the files.....Spins for awhile then super helpful generic "Cannot log in because an error occurred"Bind is good (I can log in) Credentials are good (They work on my own computer)I used to know how to get these hidden remnants out using dscl, but too long ago, cannot find command. Help?

When two-factor authentication is enabled, are multi-use QuickAdd packages still able to authenticate and enroll a device? Thanks!

As the title says, how do you detect the presence of a fusion drive from the command line? I don't have any fusion drive computers to experiment on.

Has anyone else seen the notification of a "preview" for [snip] within Outlook 15.31? More importantly, has anyone figured out how to disable it? It popped up for me as soon as I upgraded, and my organization's very-strict security policies require that I kill it with fire as soon as humanly possible.

I cannot wrap my head around the solution for this and I feel like im missing something: Desired Outcome:User opens Self Service and picks "15 minute" or "Immediate" screen lock, On the backend, if you pick 15minutes we want the 15minute security profile to install and remove Immediate if its there. And same on the flip side. Suggestions on how to scope/excluded these? The added issue is we want 15 minute to be applied by default then be able to switch

Hi, We have made a policy in the Self Service that install three packages and run a script for ffmpeg installation from MacPorts.The packages can be installed without problems. The script checks if ffmpeg exists and, if not, install it.The only problem is at the end of the execution of the policy, I get an error and the following message : When the policy has executed :- on the computer, there are not error into log /var/log/jamf.log : in JSS, no error in the log of the policy while the status is failed : If I run again the policy after the first install, so ffmpeg is already installed, I have no error. Is there a timeout at the execution of a policy from the Self Service ?I really favored that problematic because ffmpeg takes about 10 minutes to set on the computer. Have you met same errors/issues? Do not hesitate if issues/suggestions. Many thanks for your support,

Bonjour à tous, Hier (08/02/2017) aux alentours de 14h30, un problème est apparu sans aucune modification quelconque. Le JSS est hébergé sur une machine virtuelle fonctionnant sous Ubuntu alors le répertoire partagé est lui hébergé sur un MacMini configuré pour faire du SMB et de l'HTTPS (avec authentification).Ci-dessous quelques informations supplémentaires :- JSS : 9.97.1482356336- OS X du SMB/HTTPS : 10.12.3 À l'exécution du trigger de n'importe quelle policy sur n'importe quel poste, il est impossible de télécharger le package. Voici le message qui apparaît à la suite de la commande « sudo jamf policy » sur un poste enrollé : Un curl depuis mon poste du package ou un téléchargement direct depuis un navigateur fonctionne sans problème. De fait, toutes les policies actives qui doivent être appliquées sur tous les postes présents dans le JSS ne fonctionnent pas. Elles se mettent donc en erreur.Étonnement, la commande « sudo jamf recon » est fonctionnel et il est possible d'insta

Just to give a little background... We just updated our NBI for our Netboot servers using AutoCasper NBI w/ OS X 10.12.3 as the base OS image. Just ran into an issue with a tech trying to image a Mid 2009 Macbook Pro. Now I know that MacOS Sierra is not compatible with this model. Is there anyone else that has an issue like this in their environment? What solution did you use to Image older devices? What I am really asking is, is there an alternative to having to possibly boot these older models from a Casper Image USB? Thank you in advance for any input.

I'm recently started to use JSS so I still don't know how to use it very well, I have 2 PreStage Enrollments, let's call them "Enroll to Domain A" and "Enroll to Domain B", also, I have 2 static groups "Domain A" and "Domain B", but, I've notice that if the computer was never enrolled before, I can't add it in the static group, Is there a way to create a smart group that can assign the computer based in the PreStage?

Just set up my DEP to talk with JAMF. I'm testing with one iPad. I can see my iPad in the pre-enrollment scope and it does successfully set up supervision. Issue I'm having is its not letting me push out a configuration. During initial setup I get the "Your configuration for your iPad could not be downloaded ..." message.As well as "This operation couldn't be completed. (NSURLErrorDomain error -1012.) I've tried restarted the iPad multiple times, is there anything obvious that I'm missing here?

I'm trying to get a mobileconfig to download and install using a policy. Here are the steps that I am doing: Create configuration profile on the JSSDownload the configuration profileUnsign the profile using Apple ConfiguratorPut <name>.mobileconfig into /tmp/ folderPut /tmp/<name>.mobileconfig in ReconAdd postinstall script to recon package (sudo /usr/bin/profiles -I -F /tmp/<name>.mobileconfig)Save .pkg to DesktopAdd .pkg to JSSAdd JSS package to policyRun sudo jams policy -id <policy id> After reading through the different discussions in Jamf nation, here are the different steps I've tried:chmod 777 <name>.pkgchmod +x <name>.pkg<name>.pkg without post install, run an install script through the "Files and Processes Execute Command" payload I keep getting an installer failed, showing that the package was able to download, but the install was not able to happen. The attached log is what the /var/log/install.log shows

We upgraded our environment to 9.9 since then our apps are not being distributed to our managed iPads. We keep getting this from the management tab - "Pending - Application is not available to install" When troubleshooting this problem I could trace it down to the "Limitations" option we have for deployment. When we distribute a App to the All Managed iPads it will install on the iPad, but when we combine it with the Limitations Tab thats connected to our Active Directory via LDAP and combine it with a user group from there the app won't install and gives the error. This is how we always distributed our apps before 9.9. Anyone know how I can fix this to use my groups again, since not every group in my organization needs the same apps. Manually assignments is no option.

I've done some searches on jamf Nation this morning and come up empty handed. Has anyone been able to add a custom path to inventory collection settings that will inventory items in all Users' Internet Plug-Ins folder? I tried /Users/*/Library/Internet Plug-Ins/ which didn't work, and I even tried /Users/%/Library/Internet Plug-Ins/ thinking that maybe I needed the "%" as a SQL wildcard. I would really like to do this without a custom Extension Attribute because It's much easier to report off of -- at least in my opinion.

Seems to be an easy question, but I'm seeing conflicting answers in my environment. I've been applying a policy to install all available Software Software Updates from Apple's server. If no user is logged in, restart if a package/update requires it. If user is logged in, do not restart. When I do the latest update from the app store by hand on either 10.12, 10.11, or 10.10, it says the restart is required and then actually restarting results in that black Apple logo screen that says it is applying the update. After it finishes, "About this Mac" reports the new version, and the new version is reported back to JAMF as expected. All fine and good here. When I do these same updates via the policy while someone is logged in, meaning it doesn't restart after the updater finishes, "About this Mac" reports the new version. Restarting manually after the policy finishes does NOT result in the black Apple logo "updating" screen. The new version is reported back to JAMF during Recon as the new

Hi, I know this seems like a naive question but I think I remember that in newer versions of Casper, there was no need to have a firstboot script to kickstart ard? IIRC screensharing would be on but the check box in SysPrefs>Sharing wouldn't be ticked and only the management account would have rights to screenshare on the box? Maybe? The reason I ask is that lately machines that are going through Casper imaging don't have ARD enabled at all... I use AutoCasperNBI to build my NBI's and do't do anything more exotic than that.

I have a launch agent that points to a bash script that gets executed on login. I have some users who like to "investigate" and I don't want them to see the script contents that the launch agent is calling to execute. I think the user has to have read access to the script to execute it since its a launch agent... I've heard about SHC which can convert bash scripts into executables but never used it. I know there are ways around SHC but I just want something quick that hides the contents of the script to the end user. They won't be doing any lengthy investigation. Any advice on how I could hide the contents of the script or compile it so the end user cannot see is contents would be greatly appreciated.

Hi all, I believe a script can only be run before or after some package runs. I have a sequence of event that I would like to do: a) Copy some files (these files are required by step b)b) run a install.sh scriptc) install a pkg packaged) install another pkg packagee) run another sh scriptf) delete the files from step a (This can be a script, so that's ok) Step B is what I am stumped about. How can I copy some file in (files would be in DMG package), then run my script, then install some more pkgs?

We name our student 1:1 Macbooks with their username. Let's say that student leaves and I want to give his laptop to another incoming student. I go in, change the binding name and sharing name. Do I need to run Recon again on this machine to update the info? Would it be better to remove the computer in JSS, rename the computer, then Recon? Not sure what the best method would be.

I have a small batch of iPads which I enrolled into Jamf using a Shared iPad flag in the Prestage enrolment. All testing done I now want to reset them so they are NOT Shared iPads. I've changed the Scope so that when they go back through the DEP activation they will pick up a non-Shared iPad Prestage. So far so good. But the option to Erase All Content and Settings is not available on the iPads themselves. I can see a load of remote commands in Jamf I can use, but having got this badly wrong in the past can I ask which remote command will cause an iPad to completely reset itself back to "out of the box" state so that it can activate again in DEP? Last time I tried this I hit the wrong one, and managed to leave the iPad untouched and still Shared but no longer in Jamf! What a nightmare THAT was!

I know there are different related post about this question, still can't find the answer I'm looking for. -our macs are bound to AD-sometimes we forget to rename the mac with proper name, we would like to update that remotely to our JSS and to our AD. how can I do that? I would like to do that either way our-self or have the users do that them-self through self service. thank you in advance for your help.

Just had an upgrade from 9.81 to 9.92, I have now noticed that since the upgrade, policies that run on 'Enrollment' are not running. looking at the /var/log/jamf.log shows 'checking for policies triggered by "enrollmentComplete" but none of the enrollment policies are listed to of executed. JSS policy logs for the enrolled computer is blank Has anybody else encountered this ?