I'm trying to show a popup whenever a USB device is connected. There are a few suggestions to use a launchdaemon with StartOnMount, but this gets triggered every time a computer is unlocked from screensaver. Do you have any suggestions on how to approach this problem? Sample code below: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC -//Apple Computer//DTD PLIST 1.0//EN http://www.apple.com/DTDs/PropertyList-1.0.dtd > <plist version="1.0"> <dict> <key>Label</key> <string>com.company.popup</string> <key>ProgramArguments</key> <array> <string>sh</string> <string>-c</string> <string>/path/to/script.sh</string> </array> <key>StartOnMount</key> <true/> </dict> </plist> #!/bin/bash date >> /tmp/test.txt

Anyone got an EA that reports back the management account used? Or a way to smart group machines based on management account?

Greetings all! I am running JSS v9.81 in my environment with all client machines running v9.81 as well. I have about 20 machines that are in need of having a generic, local admin user created on them. For ease of discussion, let's call this user "test_admin." All 20 or so machines can be scoped in JSS using a Smart Group or Static Group so deploying this policy or script should be relatively easy. Any suggestions on getting this accomplished thru JSS?

Hello! I work for a school district with about 2500 iPad clients in our JSS. Currently, we let clients pull apps down from self service. All of the apps are nested under one category called "All apps". I want to start breaking down the apps into "Categories" by the building they are used in because our main category has 200-300 apps in it now and is cumbersome to use. We're having a hard time with apps that are available in multiple buildings. What if I distribute an app in 2 buildings out of 5 available? I can only assign one category to it, so I'm not sure whether to scope the app two different times or just have a category for multi-building apps. If you wouldn't mind - please share any insight into how you organize your self service store. Any guidance would be appreciated! Thank you.

is there a way for me to have auto lock instead of auto logout configuration profile ? some users come back and they have been logged out, thus closing there browsers, documents etc... I told them to avoid this from happening, to click there name at the top right of the screen and choose 'login window' when they return from meeting or whatever, they can log back in and there browser, documents etc.. will still be there.

I've been trying to get auto-logout to work on 10.11 machines. Officially, this should be really easy as it can be set locally and through a configuration profile. Neither of those work. Does anyone have a graceful way to force the logout since the official and obviously labeled ways do not function as expected? All of my searching brings me to forums of people wanting to do the exact opposite(disable auto-logout) of what I'm trying to get set up(auto-logout after 15 minutes idle). For what it's worth, the machines are running 10.11.2, on domain, and are set(locally and by configuration profile) to auto-logout after 1 minute idle. I'll extend that 1 minute idle time to 15 once I get it actually logging out like it's supposed to. I've also tested it with 3, 5, and 15 minutes idle time with no luck whatsoever. There is a screensaver that starts up after 20 minutes if someone is logged in and 5 minutes if at the login screen.

Hello, I am building an integration to Casper with our IT Asset Management database. I am connecting directly to the MySql database and will need to run queries to retrieve asset data. Where can I find a schema map of the Casper database? I would like to see a map of the tables and attributes that are in the jamfsoftware database. Has anyone used Casper in this manner or have written any MySQL queries to pull asset data? Thanks,

Hi - we generate policies for various software titles predominately aimed at our non-admin users. An example of this is Google Chrome which doesn't self update for these users. While we're pretty good at packaging, testing and making available version updates, sometimes we might be a week or two behind. As a result, some of our admin users are complaining that they see and install an "update" made available through Self Service, which actually rolls them back to a previous version, when they have manually updated these. Is there a method to use greater than or less than to drive the enrollment of a machine into a smart group? I'd like to only make a Google Chrome policy available if the user has a version below xxx. If not, how are other people handling this use case? Thanks, JJ

Good Day All, So we already have Parallels Desktop Business Edition deployed to a number of our clients but when it was deployed none of the settings were locked down. Our users are not admins but currently they can still create virtual machines as they please. I want to change the settings in Parallels to only allow administrators to have the ability to create new VMs and add existing VMs. Basically, I want to check all of these "Require Password" boxes on: I found this older script on the Parallels website and I am able to modify it to do what I want, sort of. Here's the script I'm working on: #!/bin/bash vmdirectoryfile="/Library/Preferences/Parallels/vmdirectorylist.desktop.xml" #Locking Snapshots stringA='<CommonLockedOperations dyn_lists="LockedOperation"/>' stringB='<CommonLockedOperations dyn_lists="LockedOperation"> <LockedOperation>24</LockedOperation> <LockedOperation>8</LockedOperation> <LockedOperation>7</LockedO

I have a policy set for custom trigger, which installs a large package - It can take an hour to install.The logs within the policy show nothing whilst the install is running - just "pending". I assume it will only return the success/fail and all steps in-between once it has finished processing. Are there client side logs that show the progress so I can check that something is happening?Self service show all steps (i.e. mounting share, copying package, installing, etc), but I can't see this within the jamf.log when a custom trigger sets off the installation.

So we are seeing an issue where every now and then certain computers are asking for an admin name and password to allow it to continue printing. It almost seems it happens when the printer pauses or has an error and then requires the admin credentials to resume but I'm not positive about that yet. Im trying to figure out if its related to me pushing printers to the computers using casper remote, or if its related to printers being on a configuration profile for that group of computers. We currently only seem to see this on 10.9.5 student use computers. I also lock them down so students cannot add other printers as this tended to cause unwanted printouts in various classrooms. The weird part is this only seems to affect random machines, not the entire classroom. In the meantime I set a policy to remove all printers and then re-add them each day. Thanks for any suggestions! Gabe ShackneyPrinceton Public Schools

We have an iPad stuck on a focused app (notability.) This iPad has since lost WiFi connection and now we can't remove the focus. How do we fix this please? I believe this happened before the break. Thanks

I am running in to a roadblock with a script which I have written to automate some of the steps in our Entourage to GMail conversion process. This script is being run via a policy in Self Service, which is when I started having issues killing off a process (BigHonkingText) which I am running to notify the user of the script's status. When I ran the script locally as root with "killall BigHonkingText" to kill off an instance of BigHonkingText set to "-p 0" (as I want it to run for the entirety of the run of an AppleScript via osascript) it worked just fine. Once I put the script up in a policy and ran it via Self Service, the instance of BigHonkingText would not longer die when the "killall BigHonkingText" command was run. I tried working around it by gathering the PID of BigHonkingText, and then "kill -9 "$THEPROC"", however, it still won't die. Here is the snippet of the code which I am having trouble with (please note

All - using the following script we are giving the user local admin rights. It is set for Login, once per user per computer. #!/bin/bash loggedInUser=$(stat -f '%Su' /dev/console) evaluate=$( /usr/sbin/dseditgroup -o checkmember -m $loggedInUser admin ) echo $evaluate case $evaluate in *yes* ) echo User is already an admin on this mac;; *no* ) /usr/sbin/dseditgroup -o edit -a $loggedInUser -t user admin;; * ) echo Something went wrong;; esac We're seeing an issue, intermittently, where the user isnt getting the rights. In the logs, it looks like its triggered when _mbsetupuser is logged in, and not the actual user we are using... What is _mbsetupuser, and does anyone know why this might be happening? Thanks!Ben

We are using Open Directory for our network users, and we are planning to change them to syncing mobile accounts rather than pure network accounts. We would like this change to be as seamless to our users as possible, so we would like to see if there is a way to automatically set the settings for home sync conflicts. We would like to select the option to "Keep the most recent modification date" and also check the checkboxes that say to resolve all future conflicts this way as well. Our goal is to set this setting without the user seeing this popup. We are using a Casper configuration profile to set the Mobility settings that create the mobile account. Thank you for any assistance you can provide.

does anyone know how i can stop this account used when someone is upgrading to El Capitan from taking over the Users and Location section? I've now manually deleted the account from the JSS 5 times and it keeps coming back anytime someone upgrades.

I have a policy for iMacs and Mac Minis that does Software Update @ re-curring checkin NOT between the hours of 7am - 9:30pm.I have 2 questions; 1 - Should this install updates on a computer whether a person is logged in or not ? I also have the policy set for both when no one is logged in and if a user is logged in to 'reboot the computer if the package or software update require reboot' 2 - How do i know if a computer was rebooted ? all i see is after the policy runs, it does its recon, but i do not see anything telling me that computer rebooted.

Hello all, I will be taking the CCA course next week. I've been doing preparations for the learning and especially more so making sure I pass the exam. Any suggestions, guidance, materials (besides the Admin guide) that would further help with this endeavor. Thank you & much appreciate it.

Hey guys, I'm wondering if anyone found a solution for this yet.We have environments where Xcode needs to be run without granting admin privileges. We used to manage this with creating a custom Xcode installer. The contents are the following: Xcode downloaded from the developer portal CLI tools downloaded from the developer portal enable devtoolsecurity to make Xcode work without being an admin a postinstall script which runs the following actions: Agree license agreement, install the "additional required components" that Xcode wants to install when first launched #!/bin/sh defaults write /Library/Preferences/com.apple.dt.Xcode.plist IDELastGMLicenseAgreedTo -string "EA1327" defaults write /Library/Preferences/com.apple.dt.Xcode.plist IDEXcodeVersionForAgreedToGMLicense -string "7.2" installer -pkg /Applications/Xcode.app/Contents/Resources/Packages/MobileDevice.pkg -target / installer -pkg /Applications/Xcode.app/Contents/Resources/Packages/Mob

Is there a way to search for a VPN Configuration profile, if I know the name? Basically, I need to find the iPads with this VPN configuration installed, and delete it manually. Thanks.

This feels like i'm missing something simple but I can't put my finger on it. I'm trying to create a local hidden admin account via a policy. The directory we will say is /private/var/USERNAME. With that said, it's not creating the account it's returning a policy error. No issue creating non /private accounts. Any thoughts? I currently have to deploy a hidden user with a directory and some key files. Yes I could probably do it with a script BUT I can't due to security reasons with the password. So the end results was to push the admin account then push the directory folders to it later.

I'm looking for a little guidance on the new firmware password binary. Even Google can't provide much more than the man page: Usage: firmwarepasswd [OPTION] ? Show usage -h Show usage -setpasswd Set a firmware password. You will be promted for passwords as needed. NOTE: if this is the first password set, and no mode is in place, the mode will automatically be set to "command" -setmode [mode] Set mode to: "command" - password required to change boot disk "full" - password required on all startups NOTE: cannot set a mode without having set a password -mode Prints out the current mode setting -check Prints out whether there is / i

Hello I'm just wondering if there is an possibility to modify some XML or .conf file to replace wrong LDAP servers. Once my corporate colleagues turned off old domain controllers I lost ability to access JSS website due to LDAP connection error. According to this I'm not able to make a change via JSS website. Therefore, I am curious if there is an option to change configurations via XML, .conf or JAVA settings directly on JSS server. My JSS is working on CentOS 6.6, JSS is in ver 9.65 I would be grateful for any suggestions!

We installed a new SSL Wildcard certificate to our JSS on Monday. We've just realized that the iPads are no longer checking in. Any ideas what might be causing this? We used this method to import the certificate: https://jamfnation.jamfsoftware.com/article.html?id=138 Don't know too much about certificates but I guess the certificate needs to be installed on the iPad?

HI All, I know this has been mentioned several times but after trying all the suggestions it still isn't working 10.10.4 clientsCurrently I can get machine based certs from AD fine using profile managerWhen I add a network payload configured :Network Interface : EthernetPROTOCOLSEAP type: TTLS - PEAP, this is taken from when I manually connect as a userUsername and PW blank, although I have tried many things including: %AD_ComputerID%, host/ Machine MacComputer(AD Template) all in the UN field and leaving PW blankIdentity Certificate : AD Certificate pre configured and verified workingInner Auth : MSCHAPv2Outer Identity BlankTRUSTInstalled every possible certificate I can get my hands on including, Domain, Root, 3 radius serverstrusted Server Certificate names: I added each of the certificate names here separately, then added all of them together, left it blank. Hopefully someone has some ideas on how I can get this working. I have confirmed with our network team that I should