OK, so I've read the threads and support documentation about SIP and netbooting. However, even after using [OPTION], Using the Startup Disk Preference, Booting into the Recovery partition, running Terminal and using the csrutil netboot add commands, I cannot net boot from my El Capitan server. Even after using csrutil disable, the netboot service is ignored and the on board OS boots as per expectation. I've used Target imaging and even used CasperAutoNBI to create an external boot disk, those work just fine. But netbooting is no longer an option with my El Capitan servers in place. I surely hope this can be overcome. Even after whitelisting, the bless command is useless. If anyone has figured this out... I'd sure like to know what you did. Kindest,-A

Hi Guys, I have spent ages trying to get together a way of setting the screensaver to a company picture. I've tried scripts and Screensaver packages created in composer, configuration profiles, I can't seem to find a solution. Can someone suggest to me what might work? I will put the script I've been using down below just in case I'm doing it wrong. #!/bin/sh currentUser=`ls -l /dev/console | cut -d " " -f 4` # grab the system's uuid if [[ `ioreg -rd1 -c IOPlatformExpertDevice | grep -i "UUID" | cut -c27-50` != "00000000-0000-1000-8000-" ]]; then macUUID=`ioreg -rd1 -c IOPlatformExpertDevice | grep -i "UUID" | cut -c27-62` fi jamf displayMessage -message $currentUser defaults write /Users/$curUser/Library/Preferences/ByHost/com.apple.screensaver.$macUUID.plist CleanExit "YES" defaults write /Users/$curUser/Library/Preferences/ByHost/com.apple.screensaver.$macUUID.plist PrefsVersion -int 100 defaults wri

Can someone explain to me how categories are expected to work? I haven't found a clear answer in documentation yet, but I thought that by assigning priority numbers I would influence the order the categories appeared. Mine all show up in alphabetical order no matter the priority number. edit: found this in the admin guide- Enter a display name and choose a priority for the category. Note: Priority is used for displaying the category in Self Service (e.g. A category with a priority of “1” is displayed before other categories). So should I assume its a bug? I am in v.9.91

Can someone explain to me how categories are expected to work? I haven't found a clear answer in documentation yet, but I thought that by assigning priority numbers I would influence the order the categories appeared. Mine all show up in alphabetical order no matter the priority number. edit: found this in the admin guide- Enter a display name and choose a priority for the category. Note: Priority is used for displaying the category in Self Service (e.g. A category with a priority of “1” is displayed before other categories). So should I assume its a bug in 9.91?

Hi, Our deployments are set so that only the Management account can use SSH. I'm trying to work through how to change that to All Users because of a request for one of the labs that is for computer science students. As the machines are already imaged, I'm trying to do this via the command line. From various posts I've read it seems like the right way to change this is to rename the com.apple.access_ssh group to com.apple.access_ssh-disabled but I don't know how to do this in the command line. Maybe with dscl or dseditgroup? I just can't seem to find an example or documentation on how this might be done. Has anyone got any suggestions on how to go about doing this? Am I missing some setting in the JSS that would do this for me? Regards, David

Hello, I'm trying to setup automatic enrollment for my Windows machines. I've setup a scheduled task in group policy for checking in, this works great. However, upon Quickadd creation I was getting some strange errors, here is a screenshot. I went on to investigate command line enrollment for my clients. Here is the (same) result: C:WindowsTempjamf.exe enroll -overrideJSS https://jss.psd401.net:8443 -username imaging -password * -allowInvalidCertificate -ssl true JSS enrollment process started...Overriding JSS Url. Url to be used -> https://jss.psd401.net:8443Overriding AllowInvalidCertificate -> TrueEnrolling to 'https://jss.psd401.net:8443/'...The SSL certificate was successfully save as: 'Peninsula School District JSS Built-in Certificate Authority'Starting invitation request...There was an unexpected error executing the command 'jamf.Commands.CommandEnroll'!System.NullReferenceException: Object reference not set to an instance of an object. at jamf.JAMFCoreComm.JssR

Hi all, We're looking to move all of our Macs over to El Capitan next month. We are hoping that we can perform a silent installation of the new OS X that doesn't require it to be user initiated. We also want to upgrade, NOT overwrite. We want to keep user data intact. Has anyone found a way to do this? We know that we can cache the installer and run a script to activate the installer. This still requires the user or a technician to sit there and click their way through it, which we are hoping to avoid. Thanks,Doug

I have a simple extension attribute that's supposed to display an Agent version: #!/bin/bash # Check to see if the SentinelOne agent is installed. # If the agent is installed, report the agent # version. printf '<result>' if result=`/usr/local/bin/sentinelctl version | awk '{print $2 $3}'`; then printf "$result" else printf "Unavailable/Not Installed" fi printf '</result>' When I run this locally on my machine, it works, but running it as an extension attribute doesn't seem to work. Any suggestions on how to debug this issue?

Hi all I'm working on automating back ups for users that have left the company, the policy/script will run whilst logged in as the local administrator as the user's account will more than likely be disabled at this point. I'd like part of the script to get the username of the latest logged in Active Directory user so we know we're back up the correct home folder and creating a directory with the correct name on the network share. What i have so far works to select just the domain account home folders and exclude any local accounts, but the part i can't get to work is how to select the folder that has the latest modified date, from what i can see on the Googlesphere head -1 should get the last modified folder but in my testing that's not working. Can anyone suggets a different way to skin this cat or why the command is not picking up the last modified folder ? #!/bin/sh lastaduser=$( find /Users/ -mindepth 1 -maxdepth 1 -type d -group "OURDOMAIND

I'm currently having some problems with my laptops binding during imaging. I have my computers set up to netboot to a server and run casper imaging. I have Directory Binding set up and have it selected in the configuration that i'm trying to push. After the imaging I checked the jamf.log file and it gives me this error. An error occurred binding to Active Directory: dsconfigad: Container does not exist. It attempts and fails with that error 5 times before giving up and moving on. Everything else seems to be installing just fine.

Hello Community, how I can deploy a FireFox AddOn? I want to deploy the AddOn "FireBug" I try it with Composor but it doesn't works. Maybe everyone can help there? Many ThanksChristian

Hi.We are using a Configuration Profile to push Password settings to our clients that are not connected to the Domain.In order to apply some Kiosk Settings to this machines we need to remove this Configuration Profile (Device Profile) from the machines.The Profile is scoped to not apply to machines that are Kiosk machines. But we are searching for a way to remove the profile during the initial setup. During search I came across "Profiles" for command line.But this only can remove User applied Profiles. Is there any way to remove a Device Profile? Thanks for your help

Hi all, I would like to know if it is possible to deploy a Mac App store App via Self Service without the use of the Users Apple ID. I know I can deploy Mac Store Apps via JSS with the Automatic Deploy option. But I don't want this app to be automatic deployed. I want it to be a Users choice. But I don't want to force users on an Apple ID (yes we have lot's of users without an Apple ID) What I have done so far is bought the (free) app via VPP for business. The App is shown in casper with the license total. Create a Mac store App and set the Distribution to SelfService. Now the app is available in SelfService but when a User clicks on install it redirects to the App store and when a user click Install there is a prompt for an Apple ID which I do not want. Any ideas?

HelloI have successfully set up an AUSST server on a Mac server, and am deploying the client config file to the Mac. The instructions state to deploy to this path:/Library/Application Support/Adobe/AAMUpdater/1.0/AdobeUpdater.OverridesHowever, even after installing an Adobe CC app locally, this path does not exist. There is a similar one however,/Library/Application Support/Adobe/AAMUpdaterInventory/1.0/Does anyone have an insider scoop on any changes that may have been implemented with AUSST or Adobe CC installs?For fun, I have created the first directory, and dropped the config file in there as well as dropping it at the second path noted.The problem is that after running the RUM tool, the logs do not specify where the client went for an update, only if it succeeded or failed. (it does not indicate whether it went out to Adobe's update server or used my local AUSST).

Howdy Nation! Anybody deploying Smart Notebook 2016 using Smart Installer? How are you doing it? Delayed Activation? Or Activating via Script? With my testing, Delayed activation doesnt work if installed during imaging. So I used the Script. I ran Smart Installer and Generated the Notebook installer without the Product Key, installed on imaging phase, then put the script and run on reboot. It still doesnt work. So I tried "Install on boot drive after imaging" priority 1 before Sophos, then the script. That one works...but I dont like it! Because its just adding more time on the installation waiting time, before, Sophos itself already takes time to finish installing, and now, I need to add Smart Notebook which is a bigger file. Anybody doing it differently and successful? Here is the script I'm using. /Library/Application Support/SMART Technologies/activationwizard.app/Contents/MacOS/activationwizard --puid=education_bundle --m=4 --v=3 --a --pk=NC-XXXXX-XXXXX-XXXXX-

Basically we have had a couple of users remove admin rights from our admin account on deployed Macs obviously causing issues. Is there a way I can prevent a user from going to user accounts on the Mac and removing admin rights from another admin account>

I am trying to setup a network configuration profile to be installed at imaging so that the computers will be on a base network. We use Target Mode imaging so this would allow the laptops to enroll in the JS and get any other configurations that are needed and to allow users to authenticate in using AD. This will also allow use to run policies and install software without having to have a user loved in, this is all pretty typical stuff. I have created the configuration profile and if I double-click it or run the command (sudo profiles -I -F /private/var/configprofiles/USD512P-Test-Temp.mobileconfig) it will be installed as a machine level profile and it works. The problem I am having is getting it to install using a package, it doesn't. Here is how the computer level profile is setup with the trust certificates: Here is how I have the package and post-install script setup: This is based off of a package we currently use that does the same thing for another network and it works,

Running this extension attribute I am finding that it reports as "Not Present" on systems with multiple drives, and possibly OSX Lion server. Is anyone seeing the same thing?

I am running a VM via VirtualBox to snapshot things more easily. Unfortunately, I am having connection issues when trying to connect to my JSS through Casper Admin. Getting a "(Result: 0) Check your network connection and try again", see attached screenshot. I am able to access it through the web browser in my VM. Confused as to why I am getting this error. Any assistance is greatly appreciated! Thanks

I want to deploy a local account to a group of student machines for teachers to use if the network is unavailable. I have a script that will do it, and it works fine. However, the script contains the account password and can be read by anyone if they browse to the JSS file share. Is there a way to deploy local accounts without using a script, or a way to compile the script into a binary executable?

I have used the Adobe Customization Wizard for my current Adobe Acrobat XI Pro volume license .pkg, never had a problem. Is there a way to add the Adobe updates to this customization wizard process ?

@rtrouton Is it possible to use your First Boot Script like this? Running it on boot drive after imaging instead of the first boot package and using LaunchDaemon to run it. I add/remove some commands in your original script. Also I am more successful using the mobileconfig to suppress the iCloud and Diagnostic Pop ups so I also removed it from your original script. #!/bin/sh # Initial setup script for Mac OS X 10.11.x # Rich Trouton, created July 29, 2015 # Last modified 1-21-2016 # # Adapted from Initial setup script for Mac OS X 10.10.x # Rich Trouton, created August 20, 2014 # Last modified 11-21-2014 # # Set Time Zone /usr/sbin/systemsetup -settimezone "America/Anchorage" # Set Network Time /usr/sbin/systemsetup -setusingnetworktime on # Set Time Server /usr/bin/systemsetup -setnetworktimeserver "time.nsbsd.org" # Configure Finder to always open directories in Column view /usr/bin/defaults write /System/Library/User Template/English.lproj/Library/Pr

Good Morning All, I was preparing an experimental policy sequence this morning using the smart group scope/exclusion method, when I realized that the smart group set as scope had accidentally not been populated with any criteria. Apparently this defaults to include all machines within the JSS, and while my policy was only SS based and didn't do anything adverse, I can't help but imagine doomsday scenarios. Does anyone know if this is expected behavior/a bug or if I should just submit a Feature Request instead? Thanks!

I am rsyncing data from a users old laptop to a newly issued laptop and I want to prompt the user with a script in Self Service that asks for the username and pass it as $nuser. Using that variable to rsync the correct folder. Here is some the script I built so far which works great to pull all user folders but I just want to the user folder for the 1 user who we get the input for: #!/bin/sh #################################################################################################### # ## May 2016 # #############!/bin/sh #echo "Checking for passed paramaters..." echo "Remove Cache from Macintosh HD 1" echo "Remove user home folder cache..." sleep 1 rm -rf /Volumes/Macintosh HD 1/Users/"$nuser"/Library/Caches/* sleep 2 echo "Emptying user Trash..." rm -rf /Volumes/Macintosh HD 1/Users/"$nuser"/.Trash/* sleep 2 sleep 1 echo "Working..." sleep 1 echo "Initializing Migration Assistant..." s

Hello Jamf-Community, Since a few days, we are use Casper Suite. We are useing a Active Directory but we have a problem with the AD Connection at the Login. How I can conntect to the WiFi in the Login Screen? At the moment we need a Ethernet Connection to get all Policies. If the Macbook is not connected by Ethernet, he use the Mobile Account and after the login he connected to the Wifi. Befor we can start the enroll we need to fix this issue, that we get a Wifi Connection on the Login Screen. We use a WPA2 Enterprise Wifi, it is connected to our AD for a easy login. Maybe everyone can help me to fix this issue? Many ThanksChristian