We have slowly rolled out FileVault 2 across our fleet of Macs with a good deal of success. However, I've found that a good number of our Macs were encrypted prior to our official deployment. These Macs do not have institutional keys and neither our management account or local admin account are listed as FileVault enabled on the Macs in question. Looking at worst case scenarios I'm predicting a situation where someone leaves on bad terms and we're tasked with trying to unlock a Mac that they encrypted on their own. Obviously I'd like to avoid this. So, do I have any options for programmatically disabling/decrypting these existing FileVault encrypted Macs, then re-encrypting them using Casper, thus giving us the recovery key and enabling our local admin user? I imagine not but figured I'd see if anyone found a creative solution before I start working with a couple dozen people to decrypt their Macs.

As I wait for a response for JAMF support - I'm in need of help and a sanity check surrounding the Database and JDS Ultimately, yesterday I uploaded a 7.14GB dmg... twice.. First time using Casper Admin - it took a while but when it was done, all was good - until I relaunched Casper Admin and found the file in red. I checked my JDS via CLI and sure enough, no file to be found. I decided to re-upload the file using the JSS interface. It took some time as well and sure enough, it still did not appear in the CasperShare folder in CLI. After some research, I found that the JDS needs a /tmp folder larger than what we typically allocate - fine, issue resolved using a symlink to the /data partition. Now however I've noticed my Database is unresponsive - can't stop MySQL or login to MySQL. Each JSS server is stuck at 'Initializing Database' after a quick restart. Browsing the mysql/data/jamfsoftware in CLI, i've found some large files - about the size of my DMG.... (Picture attached.)

my configuration profile is set to use /System/Library/Screen Savers/FloatingMessage.saver but the computer name is not being displayed, instead it just says YOUR MESSAGE HERE I logged into one of the macs , system preferences --> Desktop & Screen Saver --> Screen Saver Options --> and the message is set to the computers name so why is it not displaying the computers name in the floating message?

Hi, everyone. I've recently joined an ad agency where we finally are upgrading about 40 Mac Yosemite users and a few Windows users (but using SCCM; not Casper) from Adobe CS6 to Creative Cloud, using CCP for packaging and Casper for deployment. This is my first time deploying software with Casper, and I'll be trained in a few weeks. I'm reading up in advance. All your insights have been very helpful in schooling me on future potential pitfalls and their workarounds, and I'm grateful for this strong community. In the meantime, I'm wondering what your experiences have been with the logistics: how much time you allow (or are limited to in busy, rushed environments) for image builds, installation, user testing with pilot groups, revising builds based on user feedback, and redeploying. Any loose schedule time ranges are helpful because I'm under pressure to plan the rollout. The installs are enterprise versions, including most applications except for video-editing software. Acrobat

I work in a large secondary school, with 1200 pupils, as the IT Systems Manager. During the summer holiday this year I undertook a programme to upgrade our 120 iMacs and 400 Macbook Pros from 10.8.5 to 10.9.4 so that I could upgrade iWork to the latest version. This was completed and everything looked good for the start of the new academic year. How wrong was I! Students started using the iWork documents that had been created in the previous 2 years that they have been using OS X and iWork but the Autosave function, which is a permanent feature of the new iWork and can't be disabled as far as I am aware, does not work with documents on NTFS formatted network drives. All of the student's home drives are stored on a Windows Server 2008 R2 SAN. These home drives are mapped, using SMB, to the users desktop at login using a script. This has become a major problem as students have been opening up their work from their network home drive, editing their iWork documents and getting

Hi Everyone, First post to JAMFNation and fairly new to Casper - we only had our JumpStart in late May '15. Loving the way this community works. :) On to business.... Our internal security policies require that when an encrypted laptop (Windows or OS X) have their recovery keys retrieved by an IT analyst, the key must change (generate a replacement) almost straight away. This is so that once the recovery key is used to unlock the laptop it can't be used again so it continues to be secure. This also allows us to track who retrieved the key every time a new one is generated. I've had a look at the way the JSS manages the FileVault 2 keys. It doesn't appear to generate a new one or track who looked at it. Is it therefore possible:1. To have some sort of mechanism that generates a new key after someone looks at the JSS's entry?2. Audit who looks at it? Thanks!Vinny

I have users that have enabled FileVault 2 on their computers already. We are moving forward with mandatory FileVault 2 on all devices with an institutional key. Is there a way to add an institutional key without decrypting and recrypting the computers with FileVault 2 already enabled? I found this kbase article, but it doesn't apply since the applied user is not the management account. Thanks in advanced!

We'd like to automate Software Installs through our ticketing system by having end users assigned to AD OU's once a manager approves a software request. I have the correct dscl command to check to see if an end user is a member of a particular AD group, dscl '/Active Directory/All Domains' -read /Users/end.user/ | grep group.name I just don't know how to script it as an extension attribute that can be used for policy triggers. I'd imagine that I need script which username is being read and echo the end result. Has anyone else already done this?

Adobe must have lost a competent person and hired a newbee to head up the Adobe DC team. This new versioning system is completely insane. But why am I not surprised?. EA to identify Acrobat Reader DC (Continuous) 15.010.20056 thru 17.x, so we can deploy patches without inadvertently rolling anyone back. Ugh. Any suggestions to shorten this is most welcome... ...[snip]... ...[snip]... ...[snip]... EDIT: Removing the long list of "Like" to avoid confusion, after getting pinged about it.

If you use Group access or a lot of sites please be aware of the following issue with 9.93. We use a lot of Group access accounts that we have assigned to our technicians in Schools and we encountered two issues: 1) Group accounts cannot select between sites on the front pull down menu. These accounts see"Full JSS" on the drop down menu (They do not actually access Full JSS) and are stuck on one of the group sites so they cannot change to another. If anyone knows of a workaround to select between sites without needing that menu site list please let me know! 2) Drop down menu cannot scroll down, its now static so you have more than 30 approximate sites you cannot select further down. There is a workaround: Collapse the browser window until you see a list of all your sites and then that can scroll down and select your site. Then you expand the window back. Hopefully this is resolved soon. Message from our TAM: *We are running into another Product Issue. This is known as

I'm trying to create a popup message for users who are running low on boot drive space. I'm getting the free space of the boot volume and adding it to a description variable that I then call in the command to jamfhelper. But it doesn't work in jamfhelper (no description displayed) #!/bin/bash space=`diskutil info / | awk '/Free Space:/ {print $4 $5}'` title="Drive Space Warning" description="DNG has detected that your boot drive may almost be out of space! You only have $space free. Please contact DNG support if you need assistance freeing up space." jamfHelper="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper" icon="/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/AlertCautionIcon.icns" "$jamfHelper" -windowType utility -title "$title" -description "$MSG" -button1 "OK" -icon "$icon" -alignDescription center

Hi all, I'm searching through Casper JSS for anything that could lock out a Macbook from users. I'm not trying to do anything malicious here (well, that depends on how honest you think I am ;) ). But I'm the Mac admin for about 600 Macbooks. If an employee ever takes the Macbook out of he company, I want to get control of it again. The Macbook is company property. I am thinking chaning the user's password on a Macbook? Or even something severe like deleting the user's folder? (I think that's too much as it means we can't recover the data)

Hello Community, since a few month I to fix this issue... It is simple but nothing works. I want: ScreenSaver after 5 minutes Immediately Password Require I try it with a configuration profile, it works sometimes and sometimes not. It is a bad option. I try a lot of scripts nothing works. I use JSS 9.93. I hope everyone can help me to fix this simple issue. I only want a screenshot after 5 minutes with a password require :-) Many ThanksChristian

I've just upgraded our test environment to 9.93 and I can't see the Patch Reporting option on the left. Do you have to turn it on in settings? What am I missing here?

We are testing Mavericks 10/9 (13A603), JSS 8.73. Occasionally we see the jamfAgent process freeze, is anyone else seeing this? external image link I did a search through the forum, came up dry. I set tag for this thread to jamf binary but this is for jamfAgent process. After a reboot the jamfAgent process was back to normal. Checked again about an hour later, shows not responding again. TIADon

I've been using RemoteUpdateManager for updating our Adobe Creative Cloud apps for a few months and it's worked fine until recently. There were some major updates that RemoteUpdateManager doesn't pull down (on purpose by Adobe), so I manually updated those through the Creative Cloud GUI app. In the weeks since those major updates, RemoteUpdateManager will only list the Camera RAW update and that's it - even though the Creative Cloud GUI app says there are minor updates available for several apps. All the Macs that have Creative Cloud installed are seeing this same behavior. Has anyone else seen this? Is there something I'm missing? Has Adobe deprecated RemoteUpdateManager so it doesn't even get minor updates any more?

When we are trying to push network printer and tried to print this hold authentication is showing.

This is my workflow - I have a CONFIGURATION POLICY running for anyone that does not have Office installed. It's called "Install Office 2016" "Install Office 2016" has a recurring check-in trigger, and assigned to a scope consisting of a SMART COMPUTER GROUP called "Office Not Installed". The Smart Computer Group "Office Not Installed" has one critera, set as "Application Title Does Not Have Microsoft Outlook.app". This group currently shows ZERO members. Regardless of this, the log on end user's devices are showing this over and over and over - Wed Aug 17 10:46:35 COMPUTER-NAME jamf[15302]: Verifying package integrity...Wed Aug 17 10:47:43 COMPUTER-NAME jamf[15302]: Installing Microsoft_Office_2016_Volume_Installer.pkg...Wed Aug 17 10:49:22 COMPUTER-NAME jamf[15302]: Successfully installed Microsoft_Office_2016_Volume_Installer.pkg.Wed Aug 17 11:04:54 COMPUTER-NAME jamf[18648]: Checking for policies triggered by &#034

Hello, I'm new to Casper and I'm running into a few problems after the machine is imaged. I'll layout my process and versions. JSS and Casper Admin are running 9.93 Downloaded El Captian from App store 2.Dragged the download onto AutoDMG to create image 3.Launch AutoCasperNBI and selected the image AutoDMG created and selected Casper Imaging. 4.Launched Casper Admin incorporated the Image created from AutoCasperNBI into an existing Profile, re-compiled and saved. Turn on macBookPro holding Option down and selecting the appropriate Image Boots into Casper Imaging check the box to erase Hard Drive and Boot to Targeted Partition after, and local Admin account as well. All of that goes fine the image process works however when I first login an error appears "A file operation for CoreTelephony tracing has failed, you may be out of disk space. Details 'Error opening file /tmp/ct.shutdown, err = Operation not permitted" I can fix this issue by performing the command sudo chmod 1777

We have 2 VPP accounts at the moment, one of which is assigned to another MDM and I have the option to reclaim the token for that account. I would like to delete that account. What sort of effect would that have? Will it remove any of the apps from the iPads that are allocated to it from the other MDM?

I am trying to use VM's in my test environment but they keep appearing as MDM Capability: NO. I have seen some post that stated all I needed to do was set my VM so that it has a 12 didgit serial number which I have done, but still the VM appeasrs as MDM Capability: No, and I do not get a MDM profile on the VM.Any help would be appreciated in helping me resolve this issue. Thanks,Larry

I'd like to add a restart to the end of a delete keychain script that users can run from Self Service,is there any way to trigger Apple's restart dialog so the users can choose to Cancel or Restart, i knowi could create a notification/script using Cocoa Dialog or jamfHelper but i'd like to keep it simple if possible. I've looked for a keyboard shortcut that simulates restart from the Apple Menu as i thought i could maybe send those key strokes in a script?, and running sudo shutdown -r doesn't give any feedback at the user level. cheers

This came up at JNUC lunch today. During my JumpStart session we did a target mode imaging that took 5 minutes start to stop including login to the account. When I do the TMI it takes 20-25 minutes. Wonder what I was doing differently from when I was taught at JumpStart. It was just the base image that we are doing from a MacBook Air 11-inch with 10.9.2 Questions that came up... Do we use the JAMF server itself to image from?Do we duplicate the image to another machine to image from?Do we not want to download via WiFi? Current setup is a MacBook air 11inch, with thunderbolt cable to another 11 inch to image. Run admin from one device and it pulls from WiFi then images the attached. Any insight is appreciated.#newb

Anyone know how to do this?I am creating Configuration Profiles for 10.7 but need to download them and deploy using Profiles -I -FAnyone else doing this? If so how?Thanks!

All of my deployed OS X devices have the Autofill forms "greyed out". I am pushing restriction profiles to these devices, however, I have the "Allow Safari autofill" option checked. I am unable to resolve this issue, and am looking for help.