when does this actually happen? after the OS has been installed? I want this particular script to be the last thing that runs in this particular configuration, after the OS and all other applications/Scripts that my configuration has in it have run. i have other scripts to run AT REBOOT and applications with Priority of 10/15.

Hello everybody,Newbie in here and I really need help from this great community.We're in the process to evaluate the possibility to publish our JSS in the DMZ.My environment is set up as follow: JSS 9.7 on a Win2012R2 vm hosted on hyper-v (internal.mycompany.com) 3 distribution points across the offices (geographically far one from each other). 1 SUS (internalsus.mycompany.com) Everything now is working great but we would like to move our JSS to the DMZ in order to be reachable (policies and packages) by our Mac laptop clients from everywhere (external to our LAN).What would be the best way to achieve our task and access/managing everything with external.mycompany.com?We’re following this guide and as far as I understood we should place in the DMZ a second and “limited” JSS server + another DP. The database would continue to rely on our internal JSS server, accessed only by the JSS in the DMZ. Apart issuing a new SSL certificate, correctly register our DNS and set up the HTT

I built a pkg using Platypus that is designed to run an unattended install using the following script: #!/bin/sh sudo installer -allowUntrusted -verboseR -pkg "/path-to-pkg" -target / I added the following line to present the users with a notification when the installation was complete: #!/bin/sh osascript -e 'tell app "System Events" to display dialog "All Done!"' When I tested, I kept getting mixed results. Sometimes the installation would complete successfully. But, most of my tests were unsuccessful. The application appeared to "install" in a matter of seconds. When I looked in the system log, I kept seeing the following error "sudo: no tty present and no askpass program specified" The users on these particular machines are admins and should be sudoers. Is there a way to prompt them for their password and pass that through a script? I tried something like this: #!/bin/sh CURPASSWORD="$(osascript -e '

Hi all,Anyone have a quick and easy method to say block a specific version of an app from executing as opposed to a blanket "all versions" of the app? Just wondering about how to do this in light of the Transmission 2.9 ransomware incident. Thanks!mezzo

Anyone already create a script to return what kind of drive is installed? Just looking to group machines by SSD or non-SSD. Gabe ShackneyPrinceton Public Schools

My JSS is running 9.81 and I have been reading a lot about custom triggers and how useful they can be. I am in the process of a few tasks that would very much benefit from this use. However despite my efforts to simplify the workflow as much as possible, I am still receiving the same generic error. Result of command: This policy trigger is already being run: root 1583 4.4 0.2 2508272 19008 s000 U+ 4:49PM 0:00.27 jamf policy For some context on the two specific policies, please see below. I am happy to provide the script provided in the second policy but at this point, I do not think there is much benefit as that portion of the workflow does not even run. The "Reset Computer Name" policy which does successfully complete it's primary task to change the computer name to what is listed in the JSS performs correctly but again as mentioned above, fails to kickstart the custom trigger "NameChange." @ericbenfer and I were working on this together and despite our efforts, kept receiving t

I Inherited our jamf/jss management and wasn't here for the provisioning. Our server certificate in IIS that enables https downloads in Jamf is expiring next month. I see there's a Renew... option, but I'm not sure how to renew it. (options include renew an existing cert, create a renewal cert, or complete cert renewal). Clicking renew an existing asks for an online certification authority -- where do I find this? I'm assuming once I renew it, I'll also need to update the configuration profile to push out the new cert?

We are currently in the process of migrating our staff to AD from local accounts. I am using the script from here The issue that is coming up is that the local user loses rights to update applications and applications break as well and need to be reinstalled. After migrating a user, I found that the applications installed by the previous user is now owned by a UID (502). I tried to chown all the 502 applications to the AD account, however, the applications are still breaking. Has anyone experienced this issue while doing AD migrations? If so, how did you tackle this issue? We are trying not to reinstall every broken app from updates.

I am noticing that while still largely successful, most of the trigger-based policies in my environment produce failed or otherwise unsuccessful push attempts on client machines within the specified scope. Take for example the case of a Dropbox update that I created this morning. This policy is scoped to an existing Smart Computer Group for those requiring the most recent release of the application. The total scope of machines started an hour ago was targeted at 428 clients. As of right now, 115 clients have successfully installed the update while 16 have failed. All 16 clients are failing with the following error code. Executing Policy Dropbox 3.14.7 Push... Downloading Dropbox 3.14.7.pkg... Downloading <JSSPackageLink>... The network connection was interrupted while downloading the package from <JSSPackageLink>. Attempting to reconnect... Downloading Dropbox 3.14.7.pkg... Downloading <JSSPackageLink>... Error: Dropbox 3.14.7.pkg is not available on the HTTP se

My organization has just changed intranet platforms and is now heavily leveraging SharePoint and Yammer. Does anyone have any ideas for how to pre-populate sites into the trust settings for the Safari SharePoint Plugin? Yes, I know there are security implications with doing this, but right now we're looking at can we do this and then will circle back around to whether or not we should. Effectively I'm trying to find a way to prevent users from getting the "Do you want to trust the website “intranet.mydomain.org” to use the “SharePoint Browser Plug-in” plug-in" popup. Thanks!

Hey guys, I have a strange problem with customers NetSUS since a few days. When I try to enable an update via the GUI, the update is still deselected after clicking "apply". Using "./repoutil --add-product all $BRANCH" from the CLI adds all updates and works as it should. I can remember that someone else had a similar problem a few months ago, but I didn't find the discussion and Google wasn't my friend in this case :)As I remember this had something to do with the PHP upload limit. I checked this, but the upload limit is set to 1024M. Has anyone had a similar problem or a hint for me? Thanks,Michael

I used a configuration profile to require FV2, and to create an individual recovery key. When I scoped it to my test Mac the config profile did its thing and it encrypted the drive using FV2. I watched it finish, I rebooted and had to log in through the FV screen, as expected. So it's definitely encrypted. Verified by the FileVault tab on the target Mac, which says "FIlevault is turned on for the disk Macintosh HD". If I look at that Mac in the JSS, under FV status it says 0/2, meaning the JSS doesn't think either of the partitions are encrypted (regular partition + recovery partition). And it shows up in my smart group that looks for FileVault 2 status is Not Encrypted. What am I missing? Test Mac is a Macbook Air, running 10.11.3, JSS 9.82

I've noticed that if I create a policy to add or remove dock items, it only effects current user accounts. I created a policy to remove a bunch of dock items (mail, contacts,itunes,app store,maps,ibooks etc...). If a new user logs in, AFTER THE POLICY ALREADY RAN, they are given the default dock with all the items. is this how it is supposed to work ?

Hi all, I'm flumoxed on this one! Yesterday i noticed that any policies that download pkgs or dmgs from the JDS were failing, (Self Service and recurring), policies that do not download are successful. I've tested on 4 different Macs at different sites and all get the same errors. There are a few threads saying that spaces in the file names can cause a similar issue and it was fixed in 9.72, we're using 9.72 and these have been working 100% for the last few years up till yesterday. Looking at the JSS logs i get 40+ lines of Downloading https://fqdn/CasperShare/Software Update.pkg... Error: Could not connect to the HTTP server to download Software Update.pkg if i trigger the same policy from Terminal the error is this Downloading https://fqdn/CasperShare/Software Update.pkg... 2016-02-26 10:22:09.563 jamf[95462:5647] NSURLConnection/CFURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9814) Error: Could not connect to the HTTP server to download Software Update.pkg If cop

I have been working on an extension attribute to display the size of the Outlook identity on client macs. I have taken some cues from the posting here , and although that script works for me it generates a list of all users and the directory names. I would like to simply get the size of the folder for the currently logged in user, as I am not interested in the Outlook folder sizes for our local admin or shared accounts. Here's what I have so far: #!/bin/bash echo "<result>" if test -e /Users/$USER/Documents/Microsoft User Data/Office 2011 Identities ; then du -sh /Users/$USER/Documents/Microsoft User Data/Office 2011 Identities | cut -f1 else echo "Not Found" fi echo "</result>" exit 0 When i run this script locally, it returns 591M Which is what i want. However, in the JSS, it always returns "Not Found". Any ideas on what is wrong here? It is probably something small and obvious, as I am fairly new to scripting

I have a Configuration Profile with a number of Restrictions set, but I am having problems with the Desktop tab. The wallpaper is set to /.corp/Wallpapers/Staff-Standard.jpg, but the Lock Desktop Picture option prevents users from changing the wallpaper even when it's unchecked. Ideally we'd like for the corporate wallpaper to be set by default, but give people the opportunity to change it if they wish to (leaving the decision up to individual managers). Having the Lock Desktop Picture option unchecked should do this, but it's not working. Any ideas?

Hi all, I have a strange issue regarding reimaging of an existing Mac that is present in the Casper database. What I normally do is that I delete the machine from the database so that Casper doesn't know it already exists and then image it so that the enrollment policies run after the initial Imaging process is complete (my triggers are based on a Smart Group that checks the date that the machine is imaged on). However since a week or so when I image an existing Mac (my last attempt was last week when a failed Yosemite upgrade needed a fresh install) the enrollment policies are never triggered. The machine gets Imaged, reboots, shows up in Casper, gets his Configuration Profiles and I see a pending entry in all the enrollment policies that should be executed next but this never happens. (I do have a working network connection.) Manually triggering the policies in terminal with the jamf -policy -event -enrollmentComplete command results in "no policies where found for the

Hello, I have a script which I run at first user login to the mac. It searches Active Directory and populates JSS based on the results. Everything works fine with the exception of the -realname field. I understand that when sending -realname from the command line that you need to have a after the first name and before the last name. This is due to the way Macs read whitespace. sudo jamf recon -realname Rafe Moody will populate JSS with Rafe. sudo jamf recon -realname Rafe Moody will populate Rafe Moody in JSS. In my script I am concatenating the first name and last name variables. When I echo the result for my full name, it displays correctly Rafe Moody but when it is passed to JSS, it results in Rafe . The second variable is missing. I have tried every combination I can think of to get the information to pass. I have tried escape characters for the but haven't found the correct combination. I know my bash syntax is not great but I don't know why it is echoing correctly

Hi All, Stuck on the following. Anyone have any ideas of why its not making the edits on the .plist? Any feedback would be greatly appreciated! Thanks guys! #!/bin/bash user=$( ls -l /dev/console | awk '{print $3}' ) defaults write /$user/Library/Preferences/com.microsoft.Lync acceptedSLT143 -bool true defaults write /$user/Library/Preferences/com.microsoft.Lync UserHasRunMessenger143 -bool true

I've been deploying software updates by smart groups, which normally include 200-300 users at a time. Our networking team is saying that we're using too much of our network bandwidth, so I need to find a way to deploy to a smaller group of people at a time. As an example, I created a smart group for "Microsoft Office 2011 is NOT on the latest version".The smart group returns with 300 machines. I'd like to deploy to 50 of these machines at a time. Is this possible?

Hi Guys, Just been playing around with Recon on Windows and tried to get the Windows machine to join a Smart Group based upon its OS and it will not join. Have tried using the full OS name, OS version, and the build number but none of them work. It was added both via manual enrolment and then also later via a quickadd to see if that made any difference. Does anybody have any ideas or comments? Many ThanksK

Ref: https://jamfnation.jamfsoftware.com/discussion.html?id=4075 Short story: we just set up uniFlow set up at our organization so I was tasked with packaging the Secure Print drivers and printers (which I've done). When I install our printers manually (via its SMB share) I am not prompted for credentials. The problem is that after using Casper admin to upload these printers to JSS, the users are being prompted for their AD credentials. The link I posted above is what I am trying to follow and I believe I have everything in-place (com.318cupswatcher.plist and the Launch Agent). However it doesn't seem like the Launch agent is running and if I try to manually invoke it: launchctl load -w /Library/LaunchAgents/com.318cupswatcher.plist Terminal returns: "Service cannot load in requested session" (sudo makes no difference). Am I on the right path? Any advice as to what I'm missing? Thanks all,

I would very much like to pull some reports that include the Local User Account information (specifically the UID and Admin) status.When creating an inventory search, choosing to display Local User Accounts from the Assets tab returns nothing in the resultant search.What’s up with that?

Doing some initial testing of 9.82 before production deployment. One thing I like to do is create Quick Add packages for our support staff. When I go into Recon and choose to create a Quick Add package, as I put in my criteria (acct/pass) and options, there are no sites listed. It shows item 1, item 2, item 3 as my options. If I choose the Local Enrollment option it shows all the sites as it should. Is the a new bug in 9.82? Anyone else tried this yet?

I have a scenario where Kerberos is not working as desired. An User is working with a valid kerberos ticket and end of the day s/he closes the laptop instead of log off or shutdown. When the user enters the password and tries to mount a smb share or use a browser if the ticket is expired, it doesn't generate a new ticket. Is there a way to generate kerberos ticket when it is expired without the user doing it manually?