Bonjour à tous, Hier (08/02/2017) aux alentours de 14h30, un problème est apparu sans aucune modification quelconque. Le JSS est hébergé sur une machine virtuelle fonctionnant sous Ubuntu alors le répertoire partagé est lui hébergé sur un MacMini configuré pour faire du SMB et de l'HTTPS (avec authentification).Ci-dessous quelques informations supplémentaires :- JSS : 9.97.1482356336- OS X du SMB/HTTPS : 10.12.3 À l'exécution du trigger de n'importe quelle policy sur n'importe quel poste, il est impossible de télécharger le package. Voici le message qui apparaît à la suite de la commande « sudo jamf policy » sur un poste enrollé : Un curl depuis mon poste du package ou un téléchargement direct depuis un navigateur fonctionne sans problème. De fait, toutes les policies actives qui doivent être appliquées sur tous les postes présents dans le JSS ne fonctionnent pas. Elles se mettent donc en erreur.Étonnement, la commande « sudo jamf recon » est fonctionnel et il est possible d'insta

Just to give a little background... We just updated our NBI for our Netboot servers using AutoCasper NBI w/ OS X 10.12.3 as the base OS image. Just ran into an issue with a tech trying to image a Mid 2009 Macbook Pro. Now I know that MacOS Sierra is not compatible with this model. Is there anyone else that has an issue like this in their environment? What solution did you use to Image older devices? What I am really asking is, is there an alternative to having to possibly boot these older models from a Casper Image USB? Thank you in advance for any input.

I'm recently started to use JSS so I still don't know how to use it very well, I have 2 PreStage Enrollments, let's call them "Enroll to Domain A" and "Enroll to Domain B", also, I have 2 static groups "Domain A" and "Domain B", but, I've notice that if the computer was never enrolled before, I can't add it in the static group, Is there a way to create a smart group that can assign the computer based in the PreStage?

Just set up my DEP to talk with JAMF. I'm testing with one iPad. I can see my iPad in the pre-enrollment scope and it does successfully set up supervision. Issue I'm having is its not letting me push out a configuration. During initial setup I get the "Your configuration for your iPad could not be downloaded ..." message.As well as "This operation couldn't be completed. (NSURLErrorDomain error -1012.) I've tried restarted the iPad multiple times, is there anything obvious that I'm missing here?

I'm trying to get a mobileconfig to download and install using a policy. Here are the steps that I am doing: Create configuration profile on the JSSDownload the configuration profileUnsign the profile using Apple ConfiguratorPut <name>.mobileconfig into /tmp/ folderPut /tmp/<name>.mobileconfig in ReconAdd postinstall script to recon package (sudo /usr/bin/profiles -I -F /tmp/<name>.mobileconfig)Save .pkg to DesktopAdd .pkg to JSSAdd JSS package to policyRun sudo jams policy -id <policy id> After reading through the different discussions in Jamf nation, here are the different steps I've tried:chmod 777 <name>.pkgchmod +x <name>.pkg<name>.pkg without post install, run an install script through the "Files and Processes Execute Command" payload I keep getting an installer failed, showing that the package was able to download, but the install was not able to happen. The attached log is what the /var/log/install.log shows

We upgraded our environment to 9.9 since then our apps are not being distributed to our managed iPads. We keep getting this from the management tab - "Pending - Application is not available to install" When troubleshooting this problem I could trace it down to the "Limitations" option we have for deployment. When we distribute a App to the All Managed iPads it will install on the iPad, but when we combine it with the Limitations Tab thats connected to our Active Directory via LDAP and combine it with a user group from there the app won't install and gives the error. This is how we always distributed our apps before 9.9. Anyone know how I can fix this to use my groups again, since not every group in my organization needs the same apps. Manually assignments is no option.

I've done some searches on jamf Nation this morning and come up empty handed. Has anyone been able to add a custom path to inventory collection settings that will inventory items in all Users' Internet Plug-Ins folder? I tried /Users/*/Library/Internet Plug-Ins/ which didn't work, and I even tried /Users/%/Library/Internet Plug-Ins/ thinking that maybe I needed the "%" as a SQL wildcard. I would really like to do this without a custom Extension Attribute because It's much easier to report off of -- at least in my opinion.

Seems to be an easy question, but I'm seeing conflicting answers in my environment. I've been applying a policy to install all available Software Software Updates from Apple's server. If no user is logged in, restart if a package/update requires it. If user is logged in, do not restart. When I do the latest update from the app store by hand on either 10.12, 10.11, or 10.10, it says the restart is required and then actually restarting results in that black Apple logo screen that says it is applying the update. After it finishes, "About this Mac" reports the new version, and the new version is reported back to JAMF as expected. All fine and good here. When I do these same updates via the policy while someone is logged in, meaning it doesn't restart after the updater finishes, "About this Mac" reports the new version. Restarting manually after the policy finishes does NOT result in the black Apple logo "updating" screen. The new version is reported back to JAMF during Recon as the new

Hi, I know this seems like a naive question but I think I remember that in newer versions of Casper, there was no need to have a firstboot script to kickstart ard? IIRC screensharing would be on but the check box in SysPrefs>Sharing wouldn't be ticked and only the management account would have rights to screenshare on the box? Maybe? The reason I ask is that lately machines that are going through Casper imaging don't have ARD enabled at all... I use AutoCasperNBI to build my NBI's and do't do anything more exotic than that.

I have a launch agent that points to a bash script that gets executed on login. I have some users who like to "investigate" and I don't want them to see the script contents that the launch agent is calling to execute. I think the user has to have read access to the script to execute it since its a launch agent... I've heard about SHC which can convert bash scripts into executables but never used it. I know there are ways around SHC but I just want something quick that hides the contents of the script to the end user. They won't be doing any lengthy investigation. Any advice on how I could hide the contents of the script or compile it so the end user cannot see is contents would be greatly appreciated.

Hi all, I believe a script can only be run before or after some package runs. I have a sequence of event that I would like to do: a) Copy some files (these files are required by step b)b) run a install.sh scriptc) install a pkg packaged) install another pkg packagee) run another sh scriptf) delete the files from step a (This can be a script, so that's ok) Step B is what I am stumped about. How can I copy some file in (files would be in DMG package), then run my script, then install some more pkgs?

We name our student 1:1 Macbooks with their username. Let's say that student leaves and I want to give his laptop to another incoming student. I go in, change the binding name and sharing name. Do I need to run Recon again on this machine to update the info? Would it be better to remove the computer in JSS, rename the computer, then Recon? Not sure what the best method would be.

I have a small batch of iPads which I enrolled into Jamf using a Shared iPad flag in the Prestage enrolment. All testing done I now want to reset them so they are NOT Shared iPads. I've changed the Scope so that when they go back through the DEP activation they will pick up a non-Shared iPad Prestage. So far so good. But the option to Erase All Content and Settings is not available on the iPads themselves. I can see a load of remote commands in Jamf I can use, but having got this badly wrong in the past can I ask which remote command will cause an iPad to completely reset itself back to "out of the box" state so that it can activate again in DEP? Last time I tried this I hit the wrong one, and managed to leave the iPad untouched and still Shared but no longer in Jamf! What a nightmare THAT was!

I know there are different related post about this question, still can't find the answer I'm looking for. -our macs are bound to AD-sometimes we forget to rename the mac with proper name, we would like to update that remotely to our JSS and to our AD. how can I do that? I would like to do that either way our-self or have the users do that them-self through self service. thank you in advance for your help.

Just had an upgrade from 9.81 to 9.92, I have now noticed that since the upgrade, policies that run on 'Enrollment' are not running. looking at the /var/log/jamf.log shows 'checking for policies triggered by "enrollmentComplete" but none of the enrollment policies are listed to of executed. JSS policy logs for the enrolled computer is blank Has anybody else encountered this ?

We are in the testing phase of rolling out new Mac Hardware in particular the new MacBook Pro's 2017 model which only has USB Type C ports. I am able to join the MacBook Pro's to our AD domain but I was wondering if I am missing something when it comes to actually creating the network user accounts on the new MacBook Pro. Seeing as the computer needs to have a network connection to see the domain and authenticate to it but wireless does not work until you are logged into the computer. In the past I would get around this by simply plugging in the ethernet cable. But the new MacBook Pro has no ethernet port. Do I need to purchase the USB-C to ethernet adapter or is there some other solution to this problem.

Hi all, I have a install.sh script, and to run it, I manually would have to do "sudo sh install.sh -i" If I put it to JSS, I notice in the script options, there are parameter 4, parameter 5, etc. Can I just add in my script, then have a policy that calls the script with parameter 4 = -i ?

Hi everyone, I'm loving the resources here but I can't seem to find anything on this.Using a policy, is it possible to create a local user with a username taken from results of an executed command in the 'Files and Processes' section? I see in the logs that my command is working and giving me the result I want, but I can't figure out how to get the results useable in the 'Local Accounts' section.

Hi all, what is the most efficient way to push proxy.pac settings via JSS? And how can we verify which settings are in use?We are using Sierra 10.12.3 and Jamf Pro 9.97Thanks a lot!

Windows 2012 Server, JSS 9.81. We did have a VERY old version of Java 7 on the server so I upgraded it to the latest Java 8 a few weeks ago. I just discovered that our JSS has not been backed up since the day I upgraded the Java. When I manually run the JSSDatabaseUtil.jar (by launching it from the command line) I get the following error: C:Windowssystem32>java -jar "C:Program FilesJSSinJSSDatabaseUtil.jar" Error: Registry key 'SoftwareJavaSoftJava Runtime Environment'CurrentVersion' has value '1.8', but '1.7' is required. Error: could not find java.dll Error: Could not find Java SE Runtime Environment. How do I fix this? I thought Java 8 was supported.

Good morning everyone, This is not a ground breaking thing but I cannot get the Managed Preferences to display a picture that I choose to show on the Desktop no matter what I do. Funny because I can set the Wifi, Bluetooth and other items to turn off, but not the Desktop Picture of my choosing to display. We do a lot of Adobe CC for training and college production and the teachers and designers want the gray Desktop to be present when logged in. And I am at a lose. Again not an earth shattering thing but I am at a lose. Everyone have a very great day today!

Hi, We have been migrating macs across the company and after running scripts to reACL local home folders to the new AD account, we noticed that we need to re-enable the FileVault user in System Preferences. The problem with this now is that the user sees two FileVault enabled accounts (with the same username) on the initial screen at boot. After a bit more digging (using the fdesetup list and fdesetup list -extended commands) I can see that the old account is still visible with a UUID but no name associated. For example... 1) Running 'sudo fdesetup list' displays.. (null),EBADDBBC-FB36-4A95-8D74-DACA5FE232812) Running 'sudo fdesetup list - extended' displays.. ESCROW UUID TYPE USER EBADDBBC-FB36-4A95-8D74-DACA5FE23281 OS User So the User field is blank. I know i can run "sudo fdesetup remove -uuid EBADDBBC-

Our SPED dept has two separate VPP account and purchased one app on both of the VPP accounts and in mobile apps catalog we can only see one of the two VPP accounts apps. Thought?

So we're in the process of swapping out 700+ iPads. We finding a lot of our users are running into 2 issues: 1) After the restore the iPad has to install the DEP configuration profile. The iPad gets stuck on the screen saying Installing Config Profile. We can press back but when we do this the iPad crashes and comes back to the same place. So the only choice we've got is to plug it into iTunes/AC2 and erase the device and try again. 2) A lot of our users are finding their restored apps crash upon opening. Very similar to the Auto App Update issue but we have this turned off so this can't be the reason. Must be something to do with the restore. Has anyone else had anything similar or know of anything we can do to stop this?

We are in the testing phase of rolling out new Mac Hardware in particular the new MacBook Pro's 2017 model which only has USB Type C ports. I am able to join the MacBook Pro's to our AD domain but I was wondering if I am missing something when it comes to actually creating the network user accounts on the new MacBook Pro. Seeing as the computer needs to have a network connection to see the domain and authenticate to it but wireless does not work until you are logged into the computer. In the past I would get around this by simply plugging in the ethernet cable. But the new MacBook Pro has no ethernet port. Do I need to purchase the USB-C to ethernet adapter or is there some other solution to this problem.