Hi all, When authenticating with cached credentials on a AD bound Mac (10.10.x, 10.11.x, 10.12.x) the group memberships are not cached it seems...I was expecting that AD group memberships should also be cached. Seems not the case. Anyone else seeing this behaviour? The case:I use several groups in the form of laptop_admins which all live in AD. The users in those groups should receive admin privileges when logging in to the system. (configured in bind script using dsconfigad -groups) It all works fine except when disconnected from the network during login. Everyone has 2 users, usern and admin_usern. only admin_usern users can be member of a laptop_admins group, usern are standard accounts. When authenticating with network connected, the terminal command id admin_usern gives the expected results (... ,331206878(XXXXXlaptop_admins), ...) . When authenticating with network disconnected, id admin_usern doesn't give that group, but refreshes/updates once communication wit

Stop me if you've already posted this, but I couldn't find anyone talking about it already, which may have just been how I was trying to search. As always, standing on the shoulders of giants, in this case, Per Olofsson's CreateUserPkg. Been using it to deploy one of our hidden service accounts during build with AutoDMG. With ≤10.11 it's always worked to hide our service account if the User ID is sub-500. Starting with testing out an image for 10.12, the User is not hidden. It does create the home directory where we want it (in this case /var/hiddenuser), but it's presented at the login screen, even after rebooting, and it's listed as a user under System Preferences > Users & Groups. Is anyone else encountering this? I could go back and script out JAMF creating/hiding the user, but the CreateUserPkg was a clean, easy way to do it during an image build. I can probably, easily I would guess, push something along the lines of sudo dscl . create /var/hiddenuser IsHidde

I read somewhere that Apple automatically cached Sierra in 10.11.6. If that is the case, is there an easier way to install this OS now? This is for a lab so ideally needs to be done so I don't have to touch the machine. Thanks.

Having a hard time creating this smart group. I would like to create a group of computers that already has Office 2011 installed (14.x.x) and does not have any version of Office 2016 installed (15.x.x). Does anyone know a good way to do this? I tried creating the following: App Title has "Microsoft Word.app"App Version is like "14."App Version is not like "15." However that gives me a group of machines including my own, which has Word 15.31.x installed. Any ideas?

I think I'm losing my mind (the hair's already gone, so it makes sense that it'd be next...) We've been using Casper for three years to manage our first pool of 1:1 laptops. It's almost time to replace these laptops with new ones, which is happening this Summer (whee!). I've built a new JSS 8.7 to manage these new laptops and have been testing and configuring, trying to match the settings as closely as possible to the original JSS (v8.6.2). I have a memory of configuring the original JSS to enforce computer my computer naming. I can remember there being a setting somewhere in the JSS to allow this. So if a computer is re-assigned to someone, you'd only have to change the name in the computer record in the JSS and during the computer's next daily recon, JSS would rename that computer with the new name. But I can't for the life of me find this setting in the new JSS (or the old JSS). I remember ticking off a box somewhere to enforce compute

Does anyone know if there is a way to disable Self-Service prompts (i.e. Allow to use location, etc.) because even though we're using VPP device based app assignments some users are still being asked to register their SS with the App Store.

Bonjour, Je suis tout récemment passé sur mon MacBook Pro d'OSX Yosemite (10.10) à macOS Sierra (10.12). J'utilise donc toujours Casper Admin pour déposer mes packages. À l'ouverture de Casper Admin, l'authentification fonctionne, mais impossible de monter le répertoire partagé. Quand j'étais en 10.10.5, cela fonctionnait sans problème. Ce répertoire partagé est herbégé sur un MacMini en SMB.J'arrive à monter ce répertoire depuis mon MacBook Pro via le même protocole (SMB) et ce via, les deux comptes (Read/Write et Read-Only). Ci-dessous les différentes versions :- Casper Admin : 9.81- JSS : 9.81- OS X du SMB : 10.10.5- Mon MacBook Pro : 10.12.2 Existe-t-il un problème de compatibilité quelconque entre ma machine (en 10.12), le JSS et le dossier partagé ? Quelqu'un aurait-il déjà rencontré un problème similaire ? N'hésitez pas si questions/remarques. Merci par avance,Bien à vous, -- Yohann D.

When scoping to an IP Segment, which IP is used: IP Address or Reported IP Address?

Hello everyone, Is it possible to create a grouptemplate.xml which acts on the jamf criterion patch reporting to create smart group based on this criteria ? Many thanks in advanceBen

Hi everyone, Just got our first DEP unit, however I don't see any device under DEP as per screen shot. Anyone know the workaround?

We're under a directive to change all our local admin passwords. I've come to the painful conclusion that I cannot change the FileVault2 password for the admin user without getting hands-on each and every computer. I ran it by my boss and he approves of creating a NEW admin account with a different name and home folder and adding that user to FV2. I discovered that JSS has an option to create a new local account as an admin and enable them in FileVault with a single policy! I created a policy and filled out all the fields and applied it to one Mac running Yosemite but I keep getting: Error adding user to FileVault: Added users failed error I looked in the system.log on the test computer and it only says: 3/18/16 2:05:17.245 PM Self Service[839]: [ERROR] -[InstallerQueueProcessBinder finishProcess] (line:190) --> Policy NewAdminAcct failed with: Error Domain=JAMFSoftware/SelfService Code=30 "The operation couldn’t be completed. (JAMFSoftware/SelfService error 30.)" It did get

All buttons ????Cant edit or save??

I'm getting around to creating a policy that will update the entire Office 2016 suite instead of the individual apps. I've been using AutoPKG, which creates smart groups based on the individual apps. I can't find an AutoPKG recipe that updates the entire suite so no smart group for me to use. But I'm at a loss at what to scope a smart group against in regard to the entire suite. What's a guy to do?

Okay, so we are getting ready for our 10.6 migration to 10.8 and with it we are doing a fresh install. Below is a rsync script I've been working on, but it seems to ignore the "--excludes" every time??? Any ideas? #!/bin/bash ######################################################################################################### # This script replicates files from the current logged in users home directory # # to USMFS008 for temporary storage. # # # # This script was made as part of the 10.8 Upgrade Project & JAMF Implementation. # # # # Users can restore their data from Self Service by click on Restore User Data. # # This wi

Hi everybody! Hope someone can help... At the moment I'm working on a "First-Setup-Script" to perform some basic steps on a new Mac. This works, more or less, how it should. Except of the notifications. After every finished step, I want to show a small notification to inform the servicedesk member, who will set up the client, that this step has been done and the script itself is in progress. To realise this, I use the following command osascript -e 'display notification "ActiveDirectory join has been done" with title "ActiveDirectory - Done"' When I use this command only to test it, it works without any problem. But running the script, this only leads to a lot of error messages and the notification never shows up. So I tried to use jamf instead: jamf displayMessage -message "ActiveDirectory join has been done." This works, but as long as the servicedesk member not click on OK, the next message won't be shown. Seems like there can only one message window at the moment be displ

I am having problems getting a 4th Gen Apple TV to enroll using Configurator 2. I have tried using wireless profile and Ethernet. Anyone with a workflow that works so I can eliminate the ID10T issue I may have?

Hi i am trying to mount users network drive and am running into some issues using configuration profiles , does anyone have any good ideas or ways they have got around mounting network drives with a AD authentication

Hello, does anyone know where Apple moved the Software Update service in Server.app 5.2? It seems to be missing from the service list on my 10.12 test server...

Hi,i am new on the JSS. Someone could help to me about how to create a screen saver policy with password ? thank you very much.

Hello JAMF, Just installed a JSS and I can't seem to access the interface, I've never had this happen before. Basically, I install the JSS and follow the instructions (SQL, Apache, Java) and go to https://127.0.0.1:8443 (whatever was listed on the installer) and nothing loads. I've restarted TomCat, MySQL and even the Mac. I'm currently starting over from scratch and wiping the machine. Where did I go wrong? Installed: Java JDKMySQLServer.appJSS (Apache)

It's a trojan that comes along for the ride with a an app called EasyDoc Converter.app. It's a full-access backdoor which uses your expected resources of Tor, pastebin, etc. I can't actually find the application anywhere (not that I looked that hard) but I've already setup "EasyDoc Converter.app" in my restricted software. I'm not sure that's the actual process name of the app at launch (when it prompts for credentials to get in place). :- http://www.cultofmac.com/436670/dangerous-new-mac-malware-fully-compromises-os-x/ https://labs.bitdefender.com/wp-content/uploads/2016/07/Backdoor-MAC-Eleanor_final.pdf

On several machines, I've gotten this message when doing a policy run: Not upgrading jamf binary. do_not_upgrade_jamf is set to true in /Library/Preferences/com.jamfsoftware.jamf.plist This particular OS is 10.10.5 and the JSS is version 9.92. Deleting the key/value pair fixes it. Am I the only one seeing this? Also, what is the best way to sniff out these machines? Thanks in advance. Jack

Does anyone have a download link for the newly released Security Update 2016-003 for 10.11.6? support.apple.com/downloads only has 10.12.2 and Security Update 2016-007 for 10.10.5. Thanks,Eric

Nice change in the 10.11 builds. Images used for custom login screens no longer need to be messed with. Of course the install of 10.11 blew out the /Library/Caches folder, but the good news is that if you need/want a custom login window, they look good now. If you haven't done it, the process is to use a graphic (I use .png) named: "com.apple.desktop.admin.png" Place it into /Library/Caches

So I'm testing the Touch ID option on the new MBP in our AD environment. It allows me to log back in from a locked state but when I do Touch ID instead of password entry it sends 2 bad password attempts to AD. So if a user uses Touch ID twice in 10 minute it will lock out their account (we have a 3 strikes lockout policy). Any idea for me to see what is going on here? This is just in testing phase at the moment since I'm the only one with a new MBP, but without a doubt executives are going to want to use the Touch ID option. Any and all advice is appreciated.