Hi jamf Nation. I'm pretty new to jamf and this discussion board is so helpful, thank you so much.I now have a Problem where I couldn't find a hint here so try to start a new discussion about it. We are using JSS 9.96, and macOS Sierra 10.12.0 We want to encrypt the Harddrives of all Macs via File Vault2.I have set up personal + institutional key on jamf and put the start encrypt policy into self server so the user (or at the moment test user) has the chance to decide when he wants to start. We want to use the logged in user (an AD account) so the user has just to enter his password once and the computer will boot up into is Desktop.But it will happen that a user forgets his own password (happens really often in the Windows world, so it will be the same in the apple world).It is no problem to take a look at the recovery key on JSS, and it will unlock the drive without any problems, BUT:The user is forced to change his password after the boot (no Desktop, only login window) but this

I have been trying to build a new Casper Imaging configuration for the just-released version of Sierra with Casper Admin 9.96, but keep getting errors on the compile. It appears that the blank disk image that it creates is either not a valid target of possibly not large enough to take the Sierra installation. I get the attached error message... The disk image it creates is a 11.63 GB sparse disk image (compressed format), owned by system:admin (system: Read & Write, admin: Read only permissions). Any ideas? Anyone else experiencing problems creating a compiled configuration?

Hello, I recently inherited an older JSS at version 8.63. We are looking to upgrade to the latest version. I've never made this big of a jump before. Are there considerations or reservations you could advise on for this jump? Any gotchas? Tips or best practices? What would you do or have already done? Contacted TAM already. Open to any and all tips. Here are some tasks I have in mind and a little bit about the environment: • Test environment • Delete old policies and profiles/MCX entries• Delete old packages• Back up database • Upgrade to JSS 8.73 • Upgrade to JSS 9.96 Environment: • JSS currently on Xserve with 10.7.5 server• 200 Macs enrolled, bound to AD • Macs range from 10.6 to 10.12 Thanks for any tips...

Hi Is there a way of exporting/finding out (without clicking them one by one) which app has been assigned to which group etc. I want to keep a record to show certain members of staff.

Greetings, all! I have a pretty (what I believe to be) nifty script which checks to see if specified processes or applications are running before executing a policy. My first really application for this is to be used for Office 2016 updates. I would pass the five Office applications (Excel, OneNote, Outlook, PowerPoint and Word) as the processNameX variables where X is an incremental integer beginning at 1. I also pass the jamfPolicyType and eventorIDName variables in the policy itself with "-id" and "841" respectively. The 841 integer represents the policy that I have created which simply installs the package when it is called on. I have a similar script but it only has 1 processName variable/parameter and it works flawlessly both locally and when used in the JSS. I made a few modifications, all of which were pretty simple, to accommodate for the added parameters being passed. This script runs beautifully when I run it locally and in the JSS when I pass the variables in the script it

I configured Casper to enable users photos with Custom Image URLs.Everything is ok, I see the pictures in Casper, in Apple Classroom but not on the shared iPads. Is there anyone with a solution ? :)

I know this is a long shot but am trying to resolve the problem of users remoting in from their own machines at home to their work machines in a shared office. With the Screen Sharing application being useful and working fully the only major downside is that it leaves their monitor and account open to view by anyone in the near vicinity of their work office machine. Is there a way of turning on a curtain facility or do users have to go out and buy an application to be able to do this???

Hey guys. I am trying to figure out a way to allow the users to assign the current device to them. The idea is we would hand the devices to a large amount of people. Have them log into Self Service with their Active Directory accounts, and then click a button to then assign that device to them using those credentials that logged into Self Service. Anyone have a idea how to get this done?

OK, so I commented on an old thread but do not want to take that thread up anymore.So this user created a command to disable pop-up blocker in Safari. However, it is not working for me, so I decided to test an older version which is..."defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaScriptCanOpenWindowsAutomatically 1"1 meaning disabled, 0 meaning enabled. This works great. However, I can't get it to work in JSS as a script running through a policy. I need to know how to apply this to a user-based level. I know JSS uses $3 to indicate the currently logged in user, but i'm unsure how to indicate this in the script so the command will apply to the currently logged in user and not globally. Any ideas? Side note: it would really be better if I could have the script to write only if the file in plist is set to 0, but if at 1 make no change.

Hello all, We are pushing a large package for the first time after our JAMF deployment. We want to cache/install cache to reduce user downtime during installation. We will use two separate policies: one to cache the package, the next to install cache via self service. Will I need to check FUT/FEU under both policies, or just the install cache policy? Does it make any difference? Thank you

Hello everyone, I am trying to implement an extension attribute to pull the version of SafeGuard. Below is my script: The extension attribute will populate the correct information if I'm physically on the machine running "sudo jamf recon". I enrolled a new machine and it did not pull this extension attribute until I ran "sudo jamf recon" Also worth mentioning, we do not have SSH open, so Casper Remote's inventory functionality isn't feasible in our environment. #!/bin/bash #determines whether or not SGN is installed on the machine if [[ -e /usr/bin/sgdeadmin ]] || [[ -e /usr/local/bin/sgdeadmin ]]; then echo "<result>`sgdeadmin --version | grep Version | awk '{print $NF}'`</result>" else echo "<result>SafeGuard Not Installed</result>" fi

Hi all, We are testing to enable FileVault (2) on our machines. I have followed a white paper to setup the Casper Suite to enable FileVault via Casper/Self Service and I have noticed that not all machine are FileVault Eligible . I have no clue why this is. All systems are 10.11.x + We have around 645 Machines and 92 are not FileVault Eligible.. Any insights are appreciated!

Since imaging with 10.9.5 and binding via the Apple Built-in AD Bind, when i login in as a new user, I get the following message: "A Keychain cannot be found to store "username"". Has anyone else seen this?

I have not been able to find a way to send the 'Allow Activation Lock' command to supervised devices. Supervised devices are reporting the bypass code with inventory, but Activation Lock is not enabled if these devices are restored using Recovery Mode. Here are the relevant commands from Profile Manager: external image link external image link

Cloned a working profile, to set up a "Teen" profile with different restrictions. Now, though, whenever I attempt to add ANY app, including Self-Service, it's asking for iTunes login info. VPP is set up properly. I tore out all apps EXCEPT for self-service, and it's still asking for an itunes login. What am I missing?

Hopefully someone can help me. I am very new at this. After upgrading to JSS 9.96 I can no longer install software from the Self Service App. Right when it gets to downloading it fails, from the logs it appears it cannot find CasperShare. So I recreated CasperShare in File Sharing in OS X Server, if I open Casper Admin the CasperShare now mounts (which did not before). But still Self Service fails at download. I kinda fell into supporting this, since taking over I have only updated JSS Here is what my JAMF Server is...OS X 10.10.5OS X Server 5.0.15JSS and Casper 9.96No JDSTomcat 8.0.36

Is there any way to stage a large package rollout for example to 5 computers at a time in a smart group? Example: Each of our labs have approx 30 computers. When we try and rollout a large package to a lab it ends up not having time to finish after running all night because every single computer in the smart group tries to grab the large package all at the same time. Can we specify to only allow 5 computers in the smart group to download the package at a time and have the other computers in the group wait until a spot opens up?

Anyone know of a way to complete this, i have machines with vpn profiles that are not all nam,ed the same. I want to standardize the adapter via a configuration profile , is there a way to script the removal of a profile with the name VPN in the service title?

So to make things short, we have been through the ringer with Jamf Support, Questar support, and using our own knowledge and hours trying to figure this out. Issue: Questar testing for students on iPad requires Autonomous Single App Mode OR guided access restrictions to be enabled. Guided access requires us to touch thousands of devices AND a passcode to be enabled, which is not ideal at all for us. So we have tried Single App mode. We enabled Single App mode with that particular app in our configuration profile. It's to my understanding that if we use Casper Focus, using the focus to pull up a single app is using single app mode, right? Because the user can't exit the app or do anything until it is removed focus from Casper.If that is TRUE, then something is not working right. We focus the device to the Questar app, HOWEVER, we still get guided access errors. According to another discussion I read, SAM uses the same SDK as guided access...so why are we getting these errors? According

I'm trying to evoke a policy in the post install phase of a payload free package. I created the postinstall script in Composer and entered the line: #!/bin/sh ## postinstall jamf policy -event sierra-postinstall exit 0 ## Success exit 1 ## Failure But when I install the package it doesn't run the policy that I have set up with trigger "sierra-postinstall". I can run the policy just fine via terminal. Is this not possible with Composer? Or am I missing something?

Hello everyone, Yesterday we had an issue with a news article showing up on all of our primary school iPad's, the article was showing was in the widget area of IOS 10. Is there a way of disabling widgets from Casper ? or at least being able to restrict what appears ? Article in question (viewer discretion) Here Cheers

Hi All, I'm not much of a scripter, but I've put together a script for dockutil and ensured it's installed on all my machines. I'm running this script that seems to be giving me a failure, however, when inspected, it appears to have done everything, can anyone tell me what "Script exit code 1" means and after looking at the code what it would mean that it found no matching processes? I'd like to get these successful so I'm not left wondering if the install went bad. Here's the script #!/bin/bash user=`ls -l /dev/console | cut -d " " -f 4` sudo -u $user /usr/local/bin/dockutil --add /Applications/Microsoft Word.app sudo -u $user /usr/local/bin/dockutil --add /Applications/Microsoft Powerpoint.app sudo -u $user /usr/local/bin/dockutil --add /Applications/Microsoft Excel.app sudo killall Dock Here's the result.... Executing Policy Microsoft Office 365 Volume Installer (applications installation)Downloading Microsoft Office 2016 Volume Installer.pkg...Downloading http://jss.insign

Bonjour, Nous souhaitons déployer l'application "Self Service" sur nos tablettes, mais nous rencontrons une erreur lors de l'installation de celle-ci: " L'identifiant ITunes Store de l'application n'a pu être validé ". Pourtant, tous les ports réseau nécessaires au fonctionnement de Jamf sont bien ouverts ...Jamf est en version v9.96 et nos tablettes sont en v9.3.5. Avez-vous déjà rencontré ce problème? Merci de votre aide,Cordialement,M. GAILLARD

Hey there, So I have a piece of software packaged up nice as a dmg in our standard image. However for whatever reason it fails to install correctly. Link for those interested I've tested out a solution involving a script to adjust the permissions relating to the installer, and then run it and that seems to work fine. Would there be a way to put the script and install.app into a .dmg or .pkg so that I can have this be a part of our standard image? I realize that is what Composer is for, I just dont see the option to set it up as such. All I see is that I can use pre-installed software (Which is the original package manifest that does not work)

Hello, As part of my deployment I have a package to install Sophos Cloud Endpoint on the user's computer. When installed individually, without being part of the deployment, the package works. However when the package is part of the installation I commonly get the below image, stating that it was installed incorrectly. On top of that, it is incredibly difficult to uninstall too. Any thoughts or advice on what to try in order to fix this ?