Basically we have had a couple of users remove admin rights from our admin account on deployed Macs obviously causing issues. Is there a way I can prevent a user from going to user accounts on the Mac and removing admin rights from another admin account>

I am trying to setup a network configuration profile to be installed at imaging so that the computers will be on a base network. We use Target Mode imaging so this would allow the laptops to enroll in the JS and get any other configurations that are needed and to allow users to authenticate in using AD. This will also allow use to run policies and install software without having to have a user loved in, this is all pretty typical stuff. I have created the configuration profile and if I double-click it or run the command (sudo profiles -I -F /private/var/configprofiles/USD512P-Test-Temp.mobileconfig) it will be installed as a machine level profile and it works. The problem I am having is getting it to install using a package, it doesn't. Here is how the computer level profile is setup with the trust certificates: Here is how I have the package and post-install script setup: This is based off of a package we currently use that does the same thing for another network and it works,

Running this extension attribute I am finding that it reports as "Not Present" on systems with multiple drives, and possibly OSX Lion server. Is anyone seeing the same thing?

I am running a VM via VirtualBox to snapshot things more easily. Unfortunately, I am having connection issues when trying to connect to my JSS through Casper Admin. Getting a "(Result: 0) Check your network connection and try again", see attached screenshot. I am able to access it through the web browser in my VM. Confused as to why I am getting this error. Any assistance is greatly appreciated! Thanks

I want to deploy a local account to a group of student machines for teachers to use if the network is unavailable. I have a script that will do it, and it works fine. However, the script contains the account password and can be read by anyone if they browse to the JSS file share. Is there a way to deploy local accounts without using a script, or a way to compile the script into a binary executable?

I have used the Adobe Customization Wizard for my current Adobe Acrobat XI Pro volume license .pkg, never had a problem. Is there a way to add the Adobe updates to this customization wizard process ?

@rtrouton Is it possible to use your First Boot Script like this? Running it on boot drive after imaging instead of the first boot package and using LaunchDaemon to run it. I add/remove some commands in your original script. Also I am more successful using the mobileconfig to suppress the iCloud and Diagnostic Pop ups so I also removed it from your original script. #!/bin/sh # Initial setup script for Mac OS X 10.11.x # Rich Trouton, created July 29, 2015 # Last modified 1-21-2016 # # Adapted from Initial setup script for Mac OS X 10.10.x # Rich Trouton, created August 20, 2014 # Last modified 11-21-2014 # # Set Time Zone /usr/sbin/systemsetup -settimezone "America/Anchorage" # Set Network Time /usr/sbin/systemsetup -setusingnetworktime on # Set Time Server /usr/bin/systemsetup -setnetworktimeserver "time.nsbsd.org" # Configure Finder to always open directories in Column view /usr/bin/defaults write /System/Library/User Template/English.lproj/Library/Pr

Good Morning All, I was preparing an experimental policy sequence this morning using the smart group scope/exclusion method, when I realized that the smart group set as scope had accidentally not been populated with any criteria. Apparently this defaults to include all machines within the JSS, and while my policy was only SS based and didn't do anything adverse, I can't help but imagine doomsday scenarios. Does anyone know if this is expected behavior/a bug or if I should just submit a Feature Request instead? Thanks!

I am rsyncing data from a users old laptop to a newly issued laptop and I want to prompt the user with a script in Self Service that asks for the username and pass it as $nuser. Using that variable to rsync the correct folder. Here is some the script I built so far which works great to pull all user folders but I just want to the user folder for the 1 user who we get the input for: #!/bin/sh #################################################################################################### # ## May 2016 # #############!/bin/sh #echo "Checking for passed paramaters..." echo "Remove Cache from Macintosh HD 1" echo "Remove user home folder cache..." sleep 1 rm -rf /Volumes/Macintosh HD 1/Users/"$nuser"/Library/Caches/* sleep 2 echo "Emptying user Trash..." rm -rf /Volumes/Macintosh HD 1/Users/"$nuser"/.Trash/* sleep 2 sleep 1 echo "Working..." sleep 1 echo "Initializing Migration Assistant..." s

Hello Jamf-Community, Since a few days, we are use Casper Suite. We are useing a Active Directory but we have a problem with the AD Connection at the Login. How I can conntect to the WiFi in the Login Screen? At the moment we need a Ethernet Connection to get all Policies. If the Macbook is not connected by Ethernet, he use the Mobile Account and after the login he connected to the Wifi. Befor we can start the enroll we need to fix this issue, that we get a Wifi Connection on the Login Screen. We use a WPA2 Enterprise Wifi, it is connected to our AD for a easy login. Maybe everyone can help me to fix this issue? Many ThanksChristian

We received notice that our token was expiring in 14 days, so we went to renew it, and did, but were greeted with another message stating, "The service token may be in use by another server. The service token can be reclaimed below for this JSS." We don't want to click that and force all the thousands of apps to have to be re-downloaded, or worse have to re-enroll devices or re-invite users, so here I am asking, what does that button do?

Has anyone verified that the jss api returns jsonp for a cross-domain, browser-based ajax request? I can return json objects from the api with a REST client, but no matter what I try, I can't get a javascript ajax request to return anything other than xml. If anyone has this working, would you mind sharing the bit of your .ajax() or XMLHttpRequest() or whatever you are using that is enabling jsonp?

I'm looking to create a script (hopefully automated from beginning to end) that will kick off after successful imaging, kill the JAMF binary, and modify the record in the JSS to be an un-managed inventory-only record. I've tried several different ways of accomplishing this and none of them work properly and it's likely due to timing. Some of the methods I've tried without success are an at-reboot script and a package that drops a launchdaemon which calls a script to run the removeFramework command. I'm unsure if I will be able to automate this into my imaging workflow due to the fact that most of my imaging have a workflow that installs several packages at reboot. What I've tried so far attempts to kill the binary before imaging is actually complete. If it turns out I can't have this portion automated, it won't be the end of the world to have a script the technician can run after imaging. What I'd like to see if I can include is a modific

Microsoft Remote Desktop version 8 is available from the Mac App Store. Does anyone know if it will be available for deployment to enterprise without being tied to an Apple ID or how to deploy without prompting for the Apple ID when the user launches the app?

Much to our surprise we have just recently found that non-admin users can run a Bash shell out of Terminal (standard users have access to Terminal). So effectively, anyone with the right knowledge can run SUDO commands. Is this normal? If so, what is the best way to remove permissions from the Terminal application using Casper?

@bentoms Hi Ben, wondering if you've ever run into a scenario of the "Re-Check Expiration" in ADPassMon needs to be manually executed to update the password expiration time? Is there anyway I can force a re-check with a casper policy and set it at a timed period, i.e. Check In?.

Hello Community, Again! I need a solution for the Network-Userfolder / Adding Server. The User Folder / Share Folder is mounted automatically and works. The problem is, after I lost the network connection or starting the Macbook without Ethernet I get a Questionmark in the Dock. I attached a Screenschot. I am looking for a script. If one or twice smb server are not mounted, they mount them and kill the dock. The workaround is at the moment, to connect to server manually and kill the dock, then it works. Maybe everyone can help me. Many Thanks for help!Christian

There is a cheating service for membean users that logs minutes on the site automatically. Needless to say, the faculty here are not pleased about this. I have found the most popular culprit in the chrome store (Smart membean) and blocked it via chrome management (we are a google apps for education customer) unfortunately the same kids using a cheat will figure out how to create a non school profile on chrome to keep the extension running. so. I know its possible to create an extension attribute to find this sucker and set a policy to kill it. the extension is here: ~/Library/Application Support/Google/Chrome/Default/Extensions/jkcddaachlfakophhkhafbenfnjpfaeh looks like the "jkcdd..." string is the name of the extension. My scripting chops stink, anyone care to take a crack at this? any help would be greatly appreciated. thank you.

Hello Community, I am looking for a solution that our User can change easy here password in our AD. We test "AdPassMon" but it doesn't works on our Macs. I don't know where the problem is there. Now, I'm looking for a alternativ to change the AD Password and update the Keychains directly. Many ThanksChristian

Is it just me or did Apple just take down the man page reference library? I was referencing the fdesetup page not yesterday: https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man8/fdesetup.8.html Technically, the page hadn't been updated since 10.9 but I figured that was because fdesetup hasn't changed much...

Hi all, I'm wondering if anyone has come across or found a solution to this problem... When accessing the Mac enrolment portal using the servers short name (e.g. https://casper:8443/enroll) as opposed to the FQDN (e.g. https://casper.example.com:8443/enroll), the package download and redirection to the user instructions fails. After logging into https://casper:8443/enroll, Safari is redirected to https://casper.example.com:8443/flatpackagedownload, however the page is blank and the file does not load. In the production environment I am getting a 403 error, however in my test VM it's just a blank (white) page. In either case using the FQDN in the first instance resolves the problem. Additionally, if I log in to the FQDN and am successfully redirected, the short name will then work OK presumably due to some sort of browser caching. In trying to solve this I have reviewed a whole bunch of Tomcat hacks, and was thinking ideally it would be great if I could redirect http://

I have multiple computers that show Spotlight running at 110% to 150% which is causing the computer to run hot and the battery to drain quickly. I have tried using terminal to stop spotlight and restart it, as well as force quitting it in Activity Monitor. That did not work so I called Apple and his only suggestion was to do wipe and reinstall on the computer. Right now I know off about 5 computers with this issue and I am really hopping that there is another way to solve this than wiping the machine. Any help will be much appreciated.

Hi all, I can't see a way how to do this hence asking here I have two VPN appliances on addresses 1.2.3.4 & 5.6.7.8 (for example) Is it possible to create a smart group to find machines which have 1.2.3.4 configured as the destination server in the VPN settings? Thanks, as always in advance.

Hello, A Composer 101 question I'm sure: I've been tooling around in Composer today attempting to create packages for Java, Flash, Xerox Print Drivers, CCleaner, etc by "dropping" the original installers from the vendors websites into Composer...at least that's what it sounds like from the Casper Admin Guide. From there, upload to Casper Admin and use the .pkg with a policy in the JSS. That much I'm sure of. However, instead of installing the desired software on a test group, I'm running into an issue whereby the software is not installing but is rather being dropped into the top level of the Hard Drive. Is a Composer snapshot always necessary for these installers? Thoughts appreciated.

http://www.vshare.com/iphone_en.html A new website has popped up that our students are using to install apps outside of the App Store. I think it's using a combination of profiles and web clips to do this, but I don't have access to a compromised iPad today to investigate more thoroughly. Is anyone familiar with this?