I have a Configuration Profile with a number of Restrictions set, but I am having problems with the Desktop tab. The wallpaper is set to /.corp/Wallpapers/Staff-Standard.jpg, but the Lock Desktop Picture option prevents users from changing the wallpaper even when it's unchecked. Ideally we'd like for the corporate wallpaper to be set by default, but give people the opportunity to change it if they wish to (leaving the decision up to individual managers). Having the Lock Desktop Picture option unchecked should do this, but it's not working. Any ideas?

Hi all, I have a strange issue regarding reimaging of an existing Mac that is present in the Casper database. What I normally do is that I delete the machine from the database so that Casper doesn't know it already exists and then image it so that the enrollment policies run after the initial Imaging process is complete (my triggers are based on a Smart Group that checks the date that the machine is imaged on). However since a week or so when I image an existing Mac (my last attempt was last week when a failed Yosemite upgrade needed a fresh install) the enrollment policies are never triggered. The machine gets Imaged, reboots, shows up in Casper, gets his Configuration Profiles and I see a pending entry in all the enrollment policies that should be executed next but this never happens. (I do have a working network connection.) Manually triggering the policies in terminal with the jamf -policy -event -enrollmentComplete command results in "no policies where found for the

Hello, I have a script which I run at first user login to the mac. It searches Active Directory and populates JSS based on the results. Everything works fine with the exception of the -realname field. I understand that when sending -realname from the command line that you need to have a after the first name and before the last name. This is due to the way Macs read whitespace. sudo jamf recon -realname Rafe Moody will populate JSS with Rafe. sudo jamf recon -realname Rafe Moody will populate Rafe Moody in JSS. In my script I am concatenating the first name and last name variables. When I echo the result for my full name, it displays correctly Rafe Moody but when it is passed to JSS, it results in Rafe . The second variable is missing. I have tried every combination I can think of to get the information to pass. I have tried escape characters for the but haven't found the correct combination. I know my bash syntax is not great but I don't know why it is echoing correctly

Hi All, Stuck on the following. Anyone have any ideas of why its not making the edits on the .plist? Any feedback would be greatly appreciated! Thanks guys! #!/bin/bash user=$( ls -l /dev/console | awk '{print $3}' ) defaults write /$user/Library/Preferences/com.microsoft.Lync acceptedSLT143 -bool true defaults write /$user/Library/Preferences/com.microsoft.Lync UserHasRunMessenger143 -bool true

I've been deploying software updates by smart groups, which normally include 200-300 users at a time. Our networking team is saying that we're using too much of our network bandwidth, so I need to find a way to deploy to a smaller group of people at a time. As an example, I created a smart group for "Microsoft Office 2011 is NOT on the latest version".The smart group returns with 300 machines. I'd like to deploy to 50 of these machines at a time. Is this possible?

Hi Guys, Just been playing around with Recon on Windows and tried to get the Windows machine to join a Smart Group based upon its OS and it will not join. Have tried using the full OS name, OS version, and the build number but none of them work. It was added both via manual enrolment and then also later via a quickadd to see if that made any difference. Does anybody have any ideas or comments? Many ThanksK

Ref: https://jamfnation.jamfsoftware.com/discussion.html?id=4075 Short story: we just set up uniFlow set up at our organization so I was tasked with packaging the Secure Print drivers and printers (which I've done). When I install our printers manually (via its SMB share) I am not prompted for credentials. The problem is that after using Casper admin to upload these printers to JSS, the users are being prompted for their AD credentials. The link I posted above is what I am trying to follow and I believe I have everything in-place (com.318cupswatcher.plist and the Launch Agent). However it doesn't seem like the Launch agent is running and if I try to manually invoke it: launchctl load -w /Library/LaunchAgents/com.318cupswatcher.plist Terminal returns: "Service cannot load in requested session" (sudo makes no difference). Am I on the right path? Any advice as to what I'm missing? Thanks all,

I would very much like to pull some reports that include the Local User Account information (specifically the UID and Admin) status.When creating an inventory search, choosing to display Local User Accounts from the Assets tab returns nothing in the resultant search.What’s up with that?

Doing some initial testing of 9.82 before production deployment. One thing I like to do is create Quick Add packages for our support staff. When I go into Recon and choose to create a Quick Add package, as I put in my criteria (acct/pass) and options, there are no sites listed. It shows item 1, item 2, item 3 as my options. If I choose the Local Enrollment option it shows all the sites as it should. Is the a new bug in 9.82? Anyone else tried this yet?

I have a scenario where Kerberos is not working as desired. An User is working with a valid kerberos ticket and end of the day s/he closes the laptop instead of log off or shutdown. When the user enters the password and tries to mount a smb share or use a browser if the ticket is expired, it doesn't generate a new ticket. Is there a way to generate kerberos ticket when it is expired without the user doing it manually?

Hi All, Haven't seen anything in the documentation or the forum on how to do an upgrade from version 3 to 4 of the NetBoot/SUS. We have it on Redhat Server. Has anyone done it? Is it just a matter of running the script or are there some things to do before hand? Regards, David

Hi all, Simple issue turned nasty. I'm running JSS 8.71 on 10.8+ clients. The shares i'm working with are just standard Windows server based smb shares and we have AD logons in mandatory use. I've checked and we seem to have proper Kerberos tickets generated on the computer. The Apple AD plugin is mounting the user's home drive correctly. What I want to do is just mount a network share on logon. Here's what i've tried so far: Config Profiles. These work intermittently. They fail for some of the users on our test machines and work for other users on the same machines. They've been deployed to the two computers I have on my desk and have failed to install on either despite our JSS telling me that they're present. MCX Settings: Based on mcx settings i've found posted on jamfnation elsewhere, (actual link escapes me right now) I can get the shares to mount on login with the current user's AD credentials. Trouble is this then breaks the

I am looking for a script to remove admin access on 100 machines that are using AD accounts. We have a local admin that I want to remain, and be the only admin. Any ideas?

So we don't have LDAP and I want to fill in a User's name based on the Full Name of their login account. The issue becomes that I run the recon command and it takes spaces into account and only recons the first name. So then I thought I'd do two commands to determine first and last name and recon both of those together but I have no idea how to make a space between them. I'd prefer not to have a . separating first and last name. What am I missing? :)

I'm starting to migrate clients from our old JSS 7.1 to our new JSS 8.4 server and have an odd Managed Preference issue. On the JSS 7.1 server we had a managed preference for the Dock to always include Safari, Entourage and Self Service. After moving the client over to JSS 8.4, the application icons appear on both sides of the user's Dock (applications and files/folders). After some troubleshooting, I tried disabling the Dock pref on the JSS 8.4, but the client keeps applying the com.apple.dock.plist in the Managed Preferences folder. I've removed the client from the old 7.1 JSS InventoryDeleted the /Library/Managed Prefs/ folderCleared MCX settings from localhost In comparing the client to a "clean" install (Imaged to the JSS 8.4 server and not migrated), the migrated client has a /Library/Managed Preferences/com.jamfsoftware.mcx.plist file that the clean install doesn't have. The only data in the com.jamfsoftware.mcx.plist file is <key>version,

I just set up a managed preferences for 'Mobile Account and Other Options' payload and set the 'Mobile Account Time to Live' to 604000 seconds (one week). I scoped this to 1 test computer. When will this take effect? there is no trigger, and no execution frequency settings to set for this i'm not exactly sure how this 'managed preferences' works

Just upgraded our JSS from 9.81 to 9.82 but after a reboot of the server (which the installer said to do) the Tomcat7 service is not starting and manually trying to start it creates an error that says it couldn't be started. Anyone else had this issue? Matt

Hi all, Due to Apple's certs expiring, i've been having issues packaging the new drag and drop method for XCode. Any thoughts? Just composer I guess?

I didn't see a full write-up on this anywhere, so after working my way through this issue I figured I'd post the solution here for others. Problem: iPads supervised through DEP cannot have certain actions performed on them by Apple Configurator 2. For example, if you try to save the unlock token for clearing the passcode offline in the future, you will get the following error message from AC2:"Configurator could not perform the requested action because “iPad” is not supervised by an existing organization.Import an organization with the identity for the device or click 'Prepare' to erase and supervise the device. All content and settings will be erased. This cannot be undone." Solution: JSS and AC2 need to share a common supervision identity in order to both pass management commands to the iPads. You need to create a supervision identity in JSS, pass it along to the devices, and import it into any instances of AC2 that you want to be able to manage your iPads. Steps:1. Upgrade JS

I'm having issues enrolling and disowning devices in Apple DEP today? Anyone else having problems - just wondering before I contact Apple for help, as all of these devices were purchased after 2011 and were purchased directly from Apple. It's the "NOT_ACCESIBLE" error, on four different iPads tried so far...

We have begun encrypting laptops at my job and are using FileVault 2 for the Macs with an institutional encryption key. The recovery key is applied using a Self Service policy. What's happening (or not happening) is that in the computer inventory information FileVault status is showing as Not Encrypted and the Institutional Recovery Key shows Not Present. However, both this statuses are wrong. Any ideas what may be happening?

Hi, we are bringing Cherwell in as our new ITSM system, and we'd like to populate the CMDB with information from Casper. (We're doing the same with SCCM on the Windows side) There doesn't seem to be a built-in SOAP/REST/WSDL from casper that we can pick up, but I was curious if anyone else has been using the JAMF db to feed objects in a cmdb? Thanks!

when using Casper Remote to do a 'Screen Share' i am getting on a certain computer, while on other computers i do not get this and am able to screen share. test-M 192.166.225.15 Yes An incorrect Username/Password is entered for this computer what is the Username/Password it's trying to use ? is the the Management Account that gets created when computer gets enrolled ?is there a place i can check?is there a way i can change it?

In was testing a Dock layout for a few days. I decided to go back to the default settings I ran the command:defaults delete com.apple.dock; killall Dock The dock disappears but does not reset to default. Does anyone have any ideas hoe to reset to default? Guess I will have to create a dock package and push it.Any ideas would be apprciated

Hello. Does anyone know how to set the default display properties inside the app catalog? Right now it opens with all of my categories shown in expanded view. I'd really like to have the page display with all of the categories collapsed as a default. Thank you