Running into an issue that honestly has me ready to pull out some of what little hair remains. ;) Have an upgrade policy for a specific app which fails on MOST, but not all of our systems. I can't determine why. Have a very simple package which simply places a large installer script into /private/var/tmp Next, I'm running the install command via "Execute Command" under "Files and Processes". Essentially, the package places a script in the location, which is then executed. The script itself is too large to deploy via Casper's normal script process (approx 7-8mb), thus this particular approach. Now - in all of my initial testing, we had success. When deployed to production, on approximately 2/3 of the systems, I get the following in the logs when it attempts to execute the script: Result of command: /bin/sh: ./private/var/tmp/install.sh: No such file or directory On the remainder, it executes perfectly. I've tried both .dmg and .pkgs for

Hi. We have an SSL cert installed on our NetSUS appliance, which protects the management interface. However, we would like to deliver software updates over SSL, using the NetSUS appliance. Is this possible - I notice that when the URLs to the catalogs no longer display when you prefix them with https:// Has anyone managed to achieve this? Thanks, Ian

Hi all, We're running into an unusual problem that I can't seem to find anywhere else. We, by default, rename "Macintosh HD" to "System" (it's a callback to the way things were done before I came along). We also encrypt all of our machines with FileVault 2, obviously requiring a Recovery HD partition. Starting with our 10.10.3 image, we've found that, after imaging, option-booting the machine shows two "System" partitions - ostensibly one for the encrypted partition and the second for the recovery partition. Clicking on the left HD sends the user to the login screen to unlock the encrypted drive, the right gives us the prohibitory symbol. We have verified that booting while holding Command-R (or pressing Command-R at the option-boot screen) does indeed load the recovery partition, but we would like to either not see the recovery partition on option-boot at all, or see it properly named (a diskutil list on the booted partition sees Recovery HD named correctly). N.B. I used a 10.10.4

I have been to MacIT twice and I am considering going to MacAdmins instead this year. How many of you have been to both and which do you think has more value? Things I consider are the session relevancy and networking opportunities.

Hey all; I'm attempting to build a NetBoot image for Casper, for use with OS X Server. I got OS X Server set up, and I'm attempting to build a clean NetBoot image that will allow me to boot Mac clients and run Casper Imaging. I ran through the instructions here, I built a minimal base OS, I used Composer to create a .dmg, and I used Casper NetInstall Image Creator to create the .nbi and load it into the correct folder and make it the default boot image, etc. The issue is that when I do it that way Mac clients will not boot from the network. If I use System Image Utility to create a NetBoot .nbi folder based on the El Captain installer, it works to boot Macs from the network. Then the issue is that it's a full OS and isn't customized for Casper at all, doesn't have Casper Imaging on it, etc. Is the issue possibly that Casper NetInstall Image Creator is out of date or incompatible? Looks like it hasn't been updated in a while. I'm setting this up fo

Having a challenge configuring X-forwarding for multiple IP interface elastic load balancing. The service generates multiple load balancer IP addresses/interfaces and registers a DNS A record with all. I'm attempting to configure the RemoteIPValve x-forwarding on the JSS' and I've configured the "Enable Remote IP Valve" setting under Apache Tomcat Settings and edited the "server.xml" file on each JSS to include the RemoteIPValve element for internal and trusted proxies fields. However, the internal and trusted proxy addresses in the "server.xml" seem to only honor one IP address for a load balancer. Example in server.xml:<ValveclassName="org.apache.catalina.valves.RemoteIpValve"internalProxies="172.1.2.3"trustedProxies="172.1.2.3"remoteIpHeader="x-forwarded-for"remoteIpProxiesHeader="x-forwarded-by"protocolHeader="x-forwarded-proto"/> DNS A record:JSS.hawks.com has address 1

I am using the script provided by at this locationhttps://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/disable_apple_icloud_and_diagnostic_pop_ups(I changed the upper part to include Non_localized/)it is part of a policy that installs a cached OS X.9 installedesd.dmg. The script in the policy is set to run AFTER everything else, but when logging in (after the upgrade is complete) the iCloud popup is present. I assume the script is not installing at the correct time, here is the log of a computer that completed the upgrade. It should be installing sometime after the OS is upgraded and when it reboots, is this not happening? Executing Policy Install Cached Upgrade to OS X Mavericks...[STEP 1 of 3]Mounting MAC Software to /Volumes/CasperShare...[STEP 2 of 3]Installing SNHS-Install OS X Mavericks InstallESD.dmg...Preparing for in-place OS upgrade...Closing package...[STEP 3 of 3]Running script SNHS-DisableiCloudPopUp.sh...Script exit code: 0Script result:Blessing

Hi all, I'm having difficulty seeing my NetBoot server in the Startup Disk pane, even though I've completely disabled SIP. It boots fine holding down Option. Systems are running 10.11.3. Am I missing something obvious? Thanks!

I'm having an incredibly annoying issue crop up with an increasing number of my users based around logging in after the screensaver locks their computer. The computer logs in but when they hit the main GUI all of the applications appear to be in the background (the application menu will usually just stay on whatever the last foreground app was or on Finder.) You can click on any elements you would normally be able to click in a background app (window modifiers, dialog buttons, etc) but you cannot type anything or get any meaningful use out of the machine. I'm running 9.82 and have a profile out for lock instantly after screensaver which I know is buggy right now. I rolled out the fix @kitzy blogged about with a manually uploaded plist in conjunction with the profile. I don't know the buggy profiles from 9.82 play into this or if something different is going on. Has anyone else seen this?

Hi all, In our school district we are seeing an issue with Java unable to be successfully detected in Firefox per the PARCC testing technical requirements. JSS is up to date. Firefox is up to date. Java is running the recommended version from Oracle. Is there a possibility that JSS is somehow obstructing the running of the Java Applet in Firefox in this particular instance? The last discussion I saw on PARCC was January of 2015, so I was hoping to reopen the conversation with our issue(s).

I am very new to using JSS and am trying to run a policy by using a script in another policy. The idea is to have a policy run a script every day that checks for certain parameters. If it finds what it is looking for, it triggers another policy, via custom event, and that policy runs a script that does what I need. Both script's logic is working with one exception: when trying to trigger the second policy with the script, I get an error. I have trouble shot it down to a single line of code and am unsure how to proceed. #!/bin/sh sudo jam policy -event nameOfCustomEvent If I comment out that line, I have zero issues. Obviously I am unable to run the second policy when doing so. I am using self service to run the policies manually for testing. "The error I get in self service reads: There was a problem installing nameOfPolicy. Contact your administrator." No other information is given. Any thoughts

Yes I know, the opposite of what most people are looking to do. My environment uses edirectory (not my choice before anyone comments on this), and the plug-in for replicating AD bound machines for it is buggy at best. I'd like to move all users off mobile accounts on to local accounts, but I'm not sure what the best method for this is. This is mostly directed at anyone who has done this in the past, and your experience with it, and how you handled user data.And at anyone else who might have ideas I would love input, I'm quite unsure of what path to take, as I would like to be able to have users re-using their username of their mobile account, and having access to their data.. Tricky for sure.

Recently I grabbed a script someone in the Mac Admin community created to check the configured remote management accounts on machines. We only have one account that we setup specifically to have remote management access. That script is our EA for which the output is set to string. I have a smart group which is set to add computers to this group if 1) there are no remote management accounts configured and 2) if the reported remote management account is not our configured account. All this is working fine except that our language lab computers have special software which add an additional remote management account to do what the software needs to do. Because of this, I need to add additional criteria so these machines don't unnecessarily populate my smart group. If I add an additional criteria such that the output is not like this additional account, this removes the lab computers from the smart group. But if I'm thinking about this right, even if I add an additional rem

I added the Firefox script made by Joe into my JSS. It worked great in my environment until a few days ago. Nothing has been changed in my JSS; it now pops up an error when running from self-service. There was a problem installing Mozilla Firefox. Contact your administrator. Stupid error message calls me out on my mooching. I created a new standalone pkg and replaced Joe's script for the time being. Anybody else seeing the same error with the script?

Hi All i've setup a SUS and push a configuration profile with branch URL to client mac. Is it possible for client to update 3rd party app from Apple Store? so far whenever client wants to update, it will go check the branch url, which containing apple patches, but what about the other 3rd party app update such as evernote on apple store? can SUS cover those updates as well or client can only update Apple patches with SUS thanks

is anyone having issues with VBA in Excel when running macros ? Method 'ADD' of Object 'CommandBarControls' failed run-time error '-2147467259 (80004005)' I have installed 15.17 and when check for updates, it says I am all up to date.

I’m trying to get a post-install script to run from a custom trigger. This seems like it should be fairly straight forward so I assume I’m overlooking something quite basic? And yes, I am a noob in terms of scripting so please go easy on me. Or not! I just can't figure out what I'm doing wrong... Following a suggested imaging Workflow on Macmule I’ve created postflight.sh like this: #!/bin/bash jamf policy -event postflightconfig Which has then been set to run at reboot as part of this imaging config: With the policy itself set to trigger at a custom event defined as postflightconfig, like this: Except nothing happens? If I make postflight.sh executable I can run it manually and the policy is successfully triggered so I know the trigger and policy are OK. I just can’t get it to run at reboot after imaging? JSS is 9.81 Thanks in advance...

We have to remove an old cert from all the Macs. We have the hash, so can identify computers that have the old cert. The cert might exist in /Library/Keychains/System.keychain or /Users/username/Library/Keychains/login.keychain or etc. In order to list the current logged in user's keychain(s), a script would have to capture the current logged in username, and then run with admin rights, to blast the old cert from either or both keychains. #!/bin/sh # Find current logged in username USER=`/usr/bin/stat -f "%Su" /dev/console` # Pull list of keychains /usr/bin/security list-keychains > /private/tmp/"$USER"_keychains.txt # Prune the list down to just paths /bin/cat /private/tmp/"$USER"_keychains.txt | tr -d """ | tr -d "  " > /private/tmp/"$USER"_keychains1.txt # Loop through each keychain and remove Cross Root Cert if it exists and send errors to /dev/null for keychain in $(/bin/cat /private/tmp/"$USER&

Does anyone have a well documented guide on how to setup HTTPS on the DP for the CasperShare, We have had so many problems with SMB and I really don't want to go back to AFP so I want to try HTTPS.

We have some mission critical service upgrades that are happening tomorrow and in addition to sending multiple emails, we'd like to remind people by sending notifications to their laptops multiple times a day. I remember seeing how to do this somewhere, maybe JNUC 2013 but can't find the documentation anywhere! Anyone have that information to share or another way to tackle this? Ideally, would love to have a notification that pops up once an hour with a few sentences to remind them of the service being down. Having the notification stay on their screen for 30 seconds or more would be great too if possible in addition to a larger window. I should be able to set this up pretty easily but for some reason I'm struggling with the policy set up! Thanks, Tom

I pushed the new chrome browser yesterday and since then I have reports coming in of PDFs only being partially viewable. Anyone seen this before? Gabe ShackneyPrinceton Public Schools

So we're trying to set things up to use Google Drive as an automagic backup solution here. I've used MacDropAny to set up my proof of concept, but I feel like that'll be too time consuming to set up on all our users' machines. I'm trying to write a script and deploy it via self service once the user's account is created, Google Drive is installed, and signed in. I've got the commands down to move the contents of the Home folder to Google Drive, then create symlinks back in the Home folder, but I'm having trouble getting it to run as local admin, as there's a few sudo's in the script and the account I'd be running it from would not have admin rights. I'm leaning towards ssh-ing into admin@localhost to get admin rights, but am stumbling on feeding the password to the script. Any help would be greatly appreciated!

Does anyone have a script that they use to run maintenance tasks on a system, such as a computer lab machine, that is used by multiple users and/or left on for extended periods of time? I don't have any specific things in mind at this time. I'm trying to rid my world of Deep Freeze, and I'm trying to come up with things that I'd need to "clean up" on a system that Deep Freeze currently does for me (by restarting after each logout). Our lab administrator is somewhat reticent to give up Deep Freeze, as (admittedly) this year has produced some of the lowest number of incidents from lab/classrooms. I'm trying to cover my bases by making sure the systems maintain themselves without the need for Deep Freeze.

I wrote a couple of scripts to ensure my managed macs were getting apple critical updates for XProtect and Gatekeeper.It is a set of attribute and policy script which handles the update and also ensuring the needed settings are set.https://jumpt.wordpress.com/2015/02/12/enforcing-critical-osx-system-updates-via-casper/Feedbacks are welcome.Cheers

Does anyone know if Connected Backup 8.8.4 has Java 8.x embedded?