Following an upgrade to our JSS, a Filevault policy was pushed down to a bunch of machines that shouldn't have it. Now, after every log out or restart they are asking for a password to enable filevault. I have removed them from the policy but they are still trying to enable filevault. Is there any way to remove the policy from the machines and stop this from happening?

Is anyone else having trouble connecting to free wifi at the Guthrie? My colleague and I each have 3 devices and none of them will connect. Is the wifi infrastructure here really so insufficient, or are we both doing something wrong?

I have my Casper Test server OFF. I turn on on enrolled client computer and then turn on the Casper Test server, the client server does not check-in, i do a jamf checkjssconnection and get no connection, but client is able to ping server. . I then restart the client computer and now the client sees the Casper test server and checks-in as intended. Should the enrolled client be able to see the casper server regardless of the server being turned on after the client ?

I have a script that I'm running that installs new certificates into keychain. The only issue I'm running into is that it prompts the user for local admin credentials when we remove the old configuration profile and when it adds the new configuration profile to save the certificate into the keychain. The script has to run as the local user so that it downloads the certificates as the user. Anyone know of a way to do this? Thanks! find current user logged in currentuser=stat -f "%Su" /dev/console profile1=su "$currentuser" -c "/usr/bin/profiles -Lv | grep LC-802-1x-User"profile2=echo $profile1 | awk '{print $4}'echo $profilename if [[ $profile2 == "LC-802-1x-User" ]]; then su "$currentuser" -c "/usr/bin/profiles -R -p 04D1878B-BD77-4593-BAA4-4EB5AAE99304" else echo profile not found fi run profiles command as current logged in user su "$currentuser" -c "/usr/bin/profiles -I

Hello, Firstly- please excuse my noobishness. I recently got CCT'd, and I'm mostly a lurker so not used to posting on forums in general. That in mind: Our institution has decided that, as a fallback, all administrative staff should be able to connect to our network via Ethernet. With that in mind we just bought a whole bunch of USB3 -> Ethernet adapters (we mostly run MacBook Airs). What I'm wondering: is it possible to get the properly configured adapter settings from one laptop and add it to all administrator laptops via a script? Or something of similar effect? I want to do a touchless install/configuration. Any suggestions are appreciated. Thanks in advance! The adapter:- Linksys USB3GIGv1- Requires a *.pkg install................................................................done- Requires usual 'Network Preferences' configuration....................TBD (what I'm asking about)

Hello, Once we upgraded to Yosemite for the school year, our Energy Savings Profile stopped working. I confirmed with the logs that it wakes up in the morning, but does not shut down. When I go to System Preferences to confirm that the profile being pushed was received on the client end, I see the profile. I tried changing the settings around, and see that the Mac gets the change, but it still does not shut down. Our Macs are on 10.10.3 and up, and we are on JSS 9.63.

Hi all, I'm looking into enrolling our company into the DEP program, but current availability being what it is we've got some things to figure out. At current we leverage a layering approach enrolling the Mac and kicking off a configuration workflow by way of our "compliance package" that installs on top of the native OS. I'd like to move us away from the compliance package option and towards a touchless DEP-type of enrollment experience. The biggest hurdle so far is lack of DEP in countries like South Africa or India. Has anyone here adopted DEP, but had similar hurdles with lack of availability in some countries where you have offices? If so, how did you solve this, if at all? My current thought is that we'll have to adopt a hybrid approach of DEP where available and the compliance package where DEP is unavailable, but I'm eager to hear other ideas.

Hi JAMFNation! I've recently created an Adobe Package using the Adobe Packager tools, pretty standard. Using a post install script by rmaldon, link is here if necessary. [https://jamfnation.jamfsoftware.com/discussion.html?id=13232](script listed here by the user rmaldon.) Works perfectly, except for the build still has our Adobe Admin account signed in (as pictured). Anyone have a suggestion on how I can remove this sign in? Thank you greatly!R

We have the Yosemite installer blocked but are now looking for a way to block the entire notification all together, as users are still clicking on it and downloading it only to find out it's blocked. Anyone know how to suppress the upgrade notification????

User has a personal device and needs access to a district purchased app. We do not allow BYOD enrollments into JSS. Can I just make a manual user object with his email address in JSS and send out the invite and assign the app? Or is enrollment of a device a requirement?

So, in iOS9 it is possible to install apps on iOS devices without Apple IDs. I was wondering how the Self Service app would work that? Currently we use DEP, and then once the setup screen is completed, it prompts to have an AppleID entered before installing the self service app. But if I were to assign apps to devices in the JSS, rather than an Apple ID, how would I get Self Service installed? Anyone tried to do this?Thanks

I am now seeing this in a policies log after it runs, what is going on ? policy that adds a driver/printer in the same single policy. Custom event calls policy that installs driver and then a couple commands that modifies permissions. Driver installs successfully (as seen in driver install policy log), in the add printer log, I see the 'Inventory will be updated when all queued actions in Self Service are complete' I have other printer policies setup the same way and do not get this 'Inventory will be updated when all queued actions in Self Service are complete'. anybody else get this? not sure if it is a concern or not

in order to get a xerox stapling feature to work so users can print and have the xerox staple pages together (via xerox features), I have to install a 10.6 xerox driver. (i am running no computer lower than 10.10) When I manually ran the driver (to setup the printer for casper admin upload), i get an initial prompt from 'gatekeeper' for unidentified developer, so I just right click open and accept it to install. It went through its installation process and finishes. When i print for the first time i receive; The software for the printer was installed incorrectly. Would you like it to be repaired? I accept it to be 'repaired', enter admin privileges, repair takes place, and now i can print. now the printer has been uploaded, driver uploaded also. I created a self service policy and run it, the printer gets added. The policy log shows that the driver installed successfully on the client computer. I then print a document and get the same; "The software f

Hi all, I've got a bean counter wanting to add firewalls, switches etc. as Peripheral Types. And she wants the device admin credentials added to the Peripheral Types. My question is whether this is secure. Ugn I wish I hadn't opened my mouth about Peripheral Types!

I'm trying to setup 802.1X Wireless using Configuration Profiles and machine-based auth using root CA certificates. I decided to create a new Certificate Template in AD-CS based on the one we use for our Windows laptops, but this time with the ‘Service Principal Name’ option checked rather than ‘DNS Name’. I followed the advice here (see last post) Clients receive a certificate just fine using the profile I created and I see an X509 cert in the Keychain. However, the system still doesn’t connect to our 802.1X network - when looking at the RADIUS server logs, I see connection rejections and suspect this might be because the user name presented is still in the form DOMAINhostname$, whereas I believe it should be host/fqdn, as that’s what I see on successful connections from Windows laptops. I was hoping the new template would ensure the username is presented in the correct form, does anybody know what I'm missing?

Looking for a new script that I can run on log in to update username status in Casper. Thanks

We were running JSS 9.65 on a Windows server until I decided to upgrade to 9.81 in preparation for El Capitan. I upgraded. It seemed to go ok. When it finished I logged in to make sure everything looked OK and then ran jamf policy on my Mac to get the new binary. I ran Self Service to make sure that worked because of some of the reports I saw here. Self Service works fine. I then tried to test Casper Admin and it fails to replicate to any of our distribution points. I get the dreaded "Server could not be mounted" error. However, /Volumes does list the share point as mounted: CasperShare, CasperShare 1, CasperShare 2... I originally had this problem when I upgraded from 9.62 to 9.65 but I worked around it by substituting the server FQDNs with IP addresses to get around the *@#&$ kerberos problem that caused it. I would also sometimes use Casper Admin 9.62 since it never had a problem connecting. I figured I'd try using the IP address entries for the servers again no

Hey all, I was wondering if there was a way to update the NetSUS appliances that are currently in place? I am currently running 7 NetSUS appliances and would rather not have to take them all down and rebuild them just to update them. Anyone know of a way? Regards,TJ

I have noticed a couple of apps will not get the check box under the VPP tab for device assignment. This morning I purchased 6 apps from the VPP site, and 5 of them worked perfectly but 1 of them still will not show the device assignment check box. Is this something that maybe the developer hasn't enabled?

I'm having limited success using the Uninstaller.pkg created with AAMEE and the Adobe Cleaner Tool does not eliminate all of the necessary folders/files associated with the programs. With CS4, I used the RemoveCS4 script available in the JAMF Resource Kit written by Nick Amundsen. Nick, you still out there??? Has anyone modified this script to work with CS5 or 5.5 or have something similar? Can you please share if so?

Hi All, New user to the Casper Suite here and have a little issue with AD & Inventory... As it stands, if we thin image using Netboot, our inventory doesn't update based on who's logged into the machine (we don't swap machines, a single machine is assigned to one person) I have to manually go into inventory and type in the username and click the blue magnify glass... We are looking at reimaging 200 Macs and can't really do this for every machine. If I enrol a machine via the webpage then I can assign a user to the machine and the inventory is correct, though this defeats the object of the NetBoot image which automates enrolment. Any help would be great. Thanks Bill

I have used configuration profile to setup restrictions as to which system preferences items students can access. Works perfectly fine however if I login as the admin those restrictions are restricted as well. There's no Ldap/local users exclusion option in configuration profile to add my local user admin account to bypass the restrictions. There's an option in Managed preferences to exclude Ldap/local users. Does anyone know why no option in configuration profiles or should I just use Managed preferences? Is there's a way to make it work with configuration profiles? I'm using jss 9.81 and osx 10.11 on the computers Cheers

We use Casper Suite to manage devices at our school district. Today, we discovered that students are finding other student devices using the Network list and enabling a Screen Sharing session, connecting with the student victim's username and password (attained previously), and causing issues with taking over their computer, etc. We are now tasked to disable the Network visibility all-together for the student MacBook Airs so they can't even see other devices on the network. I do not see the option in the Finder configuration profile definition. Is this something that can be done with built-in JSS functionality, or will I have to upload some type of MCX to config profile file into a Config Profile? We do have Apple Remote Desktop client and VNC client running on each of these computers. See screenshot for the sidebar item we want to hide and disable:

I'm trying to execute a profile where all of the Macs (15) in our lab, shutdown at 3pm everyday. I have created the profile under Energy Saver to do this, but it isn't working. Before 3pm everyday, all of the Macs go into sleep mode. I need this because we have dirty power coming into the school at night, and random rooms experience brown outs - I'm not too sure when the power issue will be fixed. Plus we have (hopefully) El Nino showing up soon, and if we get even the smallest of rain showers, everything starts to trip. Thanks

Hi All, Completely new to Casper and currently testing a trial supplied by Jamf. When I try and use remote enrolment i get an every message every time ------------------------------------------------------------------------------------------------------Recon failed to submit to the JSS. Downloading the JSS CA Certificate There was an error. Error enrolling computer, unable to establish trust with JSS - could not connect to the JSS------------------------------------------------------------------------------------------------------ I have looked through the internet and followed some advice on recreating the CA certificate and restarting Tomcat, but no luck. I am using the built in cert. Any help on this would be great Thanks