Does anyone know which plist this option for Apple Remote Desktop lies "Allow control of this computer when this application is running". I would like to create an MCX to make that option active. Thanks!

Hello, I have a ticket with JAMF open. We have been having a large amount of issues lately, and I decided to drop our old Casper infrastructure and do a total overhaul. So I have a brand new manually installed JSS (on rhel). The main issue I'm having at this point is that the tomcat cert isn't seeming to work properly. What I mean by this is that I have created a new java keystore and have imported signed tomcat and root certs signed by my AD CA. Browser-wise everything seems to be working fine, however I start to see things fall apart when I try enrolling my JDS and running the jamfds policy command. It says that the cert is bad... the server name either does not match, or it isn't signed. The other place I see a problem is in the Tomcat Settings page where there should be specifics about the cert, see attachment. Has anyone run into this issue? Do you have any suggestions?

It seems that I can no longer get the security-mode from the following methods on Yosmemite: echo "<result>nvram -p | grep security-mode</result>"orecho "<result>system_profiler | grep security-mode</result>"or echo "<result>/Library/Application Support/JAMF/bin/setregproptool -c</result>" I use the setregproptool placed in the JAMF/bin folder to set the EFI password using a policy at first login. The machine asks for the EFI password when option booting, but I just need the output for reporting/compliance. Is anyone else seeing this issue?

Hello folks, I hope everyone is doing well and that all the school system admins out there are having a smooth transition back. I am having a problem with some of our Self Service policies in OS X. The ones in question will display "Gathering Information..." along with a very quick progress bar when the user attempts to install them. Nothing actually gets installed on the machine and no policy logging event is generated by the action. I thought something was possibly corrupt with these policies or their packages until I removed their AD group limitations and set them to "All Computers" or "Specific Computers" only. When the AD limitations are gone, they work like a charm through Self Service. Has anyone else experienced this? Any ideas? Thanks as always!

I did some searching and couldn't find much about this feature. Does it work to help to distribute downloads over multiple servers? Is anyone else using it? I'm just using standard SMB/HTTP file shares that I sync manually with CasperAdmin, not a JDS. Thanks, ~Ted

For background, we are using DEP and want to force a password change to the users account once we deliver the machine. So we create the account out of the box, the machine logs in and policies apply, and then when we deliver the machine they have to change their pw. The policy runs a simple script: sudo pwpolicy -u $USER -setpolicy "newPasswordRequired=1" The script works great and when you reboot the user is forced to change the password. The problem is that we are getting popups at login for "talagent wants to use the "Local Items" keychain," "Messages Agent wants to the use the "Local Items" keychain," and "cloudpaird wants to use the "local items" keychain." This is a persistent error until removing ~/Library/Keychain/reallyLongString which isn't a viable solution, especially since the string is different every time. Are other people seeing this issue? Or are you forcing a pw change via a different met

Two weeks ago, we made our master DP a JDS instance running on Ubuntu 12.04LTS. Everything was working great until this morning when Casper Admin started prompting that "The master distribution point could not be mounted". I rebooted the JDS server and receive the same error. There doesn't seem to be much documentation for the JDS, so I was hoping someone could point me in the proper direction for troubleshooting why all of a sudden we are no longer able to mount the DP. Any suggestions are welcome! Thanks,Matt

Hi Guys; finally got this working (SSID, WPA2 Enterprise, TTLS & PEAP protocols and MSCHAPv2). Logins are taking between 2 and 3 minutes. any tips to getting faster logins TIA LS

Hi all, Hoping someone can help me here. We're going to be deploying crashplan ProE out to our org soon. In the installer script on the local machine there is a variable for %CP_USERNAME% (or similar) which needs to be the individuals email address. Is there anyway to pipe the casper $EMAIL variable into the Crashplan username variable? We do not have AD/LDAP to perform this function unfortunately. Once again, thank you all in advance.

We recently set up Box as an HTTPS only distribution point. The good news is this works flawlessly. The bad news is that since Casper Admin can't replicate to it, every file change currently has to be done by hand. I've been trying to work around that limitation. My goal is to create a simple script that mounts the webdav Box drive, runs rsync, and then unmounts it. I want to either schedule this to run every couple of hours or anytime the contents of the JSS folder changes. The machine it's running on is a Mac server running 10.10.5. So far, the only thing I've managed to get working fine is syncing(via rsync) to the Box distribution point if the share has been manually mounted. That's good, but it requires a user to be logged into the server at all times and manually running something. I'd like to automate it. From what I've been reading, the best thing to do would be to write up a small shell script and schedule it to run. This should ba

We have setup Block Adult Content on students ipad using configuration profiles. We need to know how does it work. Why the websites like below are blocked when we turn on this setting https://aifs.gov.au/cfca/publications/corporal-punishment-key-issues.

On Windows machines, I've always gone into the volume licensing center to download a copy of Office. For Mac, is it okay to download the installer from outlook.office365.com and use this .pkg to deploy to all the machines in my company?

Quick add.pkg adds administrator hidden account, but I also want to add a seperate administrator account through a policy, this account will not be hidden. On macs I am currently enrolling this unhidden admin account is already created and was manually created prior to Casper. If an add a user policy is run on a Mac that already has that user created, what will happen?New macs deployed via Casper imaging will get the hidden management account, along with the Unhidden admin account (probably add unhidden admin account via Casper imaging custom section).

I would like to deploy an in-house app via both the "Install Automatically/Prompt Users to Install" and Self Service methods. Some devices should get the app automatically. Some should have the option in Self Service. I have the app in the JSS and scoped appropriately for auto-install I then tried to create a second instance of the app for scoping to Self Service, but the JSS complained that "An app with the filename "APP-NAME.ipa" already exists." This would also be valuable for App-Store apps. Is there a way to do it? Thanks,-Dan

I've been seeing an issue with Casper Imaging. As part of a nuke and pave imaging workflow, I created a package from the app CreateUserPkg that creates my primary admin account. I was using ID=499. However, on first boot after Casper Imaging I kept getting a dialog box stating "OS X needs to repair your Library to run applications. Type your password to alow this." I would find the home directory was missing important folders such as Desktop, Pictures, Music, Movies and what there was of the home directory had incorrect permissions. I would end up booting in single-user mode, mounting the file system for writing and deleting the home directory to force a clean creation on next login after rebooting. After changing the account ID to 501, the first "normal" ID in OS X, all is well. The only thing I modified in the admin account creation package was the account ID. The app chose a new UUID, of course, and I didn't bother to make it the same as it doesn'

Hi.. We're using DEP in an AD environment.When setting up Mac for first time, the user is prompted to create a local account via the setup assistant. We have Casper run a policy that binds computer to AD and then restarts allowing user to login with their domain credentials. What we'd like to do is have Casper run a script that once user is logged into Mac with AD account that will search for and delete the local account that was created using the setup assistant upon first boot. Since people will no doubt create a local account with any name they want, I thought maybe we could run a DSCL command and find any local accounts with a Unique ID of "500-something" and then delete it. I thought maybe I'd build off of @donmontalvo instructions here, but I'm not a scripting whiz.https://jamfnation.jamfsoftware.com/discussion.html?id=5437 Whatchoo think? Maybe there's another way?

Hi, I've got my DEP working a treat with Casper but I can't see how I get the scope of the prestage enrollment to automatically include any new devices. At the moment I am having to go into the scope and edit it to tick the new devices. Sure I am missing something simple! Thanks

I have written a script to gather a bunch of fairly generic information from System Profiler and various log files, write it to a text file, and then zip up the text file in preparation for uploading to a drop box (write only) folder on an OS X file server. I need to figure out how to programatically authenticate to the file server and copy the zip file over. I can't seem to get scp to work, as it would require a public/private key pair, and wont simply let me pass username and password into the command. This command needs to be totally hands-off for the user, as we are running this in the background. There is nothing sensitive or of security concern in the zipped up text, so I don't mind it being passed unencrypted to the file server. The user to be used for the copy would be write-only. Ideas?

Does anybody know if there is a way to set firefox as the default user agent for safari. I know I could do a default write to the safari plist. I just don't know what to write to it. Any help would be appreciated.

Hi Folks, I know a number of people here have done interesting things creating small NBI files. I would like to create something that will boot the target Mac (from USB) and issue this NetBoot command and force an immediate reboot from the NetBoot server: bless --netboot --booter tftp://10.101.118.10/NetBoot/NetBootSP0/CasperYosemite.nbi/i386/booter --kernel tftp://10.101.118.10/NetBoot/NetBootSP0/CasperYosemite.nbi/i386/mach.macosx --kernelcache tftp://10.101.118.10/NetBoot/NetBootSP0/CasperYosemite.nbi/i386/x86_64/kernelcache --options "rp=nfs:10.101.118.10:/private/tftpboot/NetBoot/NetBootSP0:CasperYosemite.nbi/NetBoot.dmg" Due to imaging problems yesterday I have a number of iMac units that have no operating system on them. Rather than trying to boot from Internet Recovery Mode and type all this into Terminal, I was thinking it should be easy to create a minimal recovery style OS X on a USB stick whose only job is to issue the above command and reboot. I've been p

Not sure if anyone else is doing this.. but on occasion it would be handy for me to image MacBook Airs over WiFi (no not often) at remote sites where Thunderbolt ethernet adapters seem to disappear. I have no problem getting an OS vanilla autoDMG loaded down... but getting a temp wifi config profile is proving strange. I've made a unsigned profile that expires in an hour, as the proper network settings will come down via MDM once the Mac is enrolled. It's rolled into a pkg that deploys to /var/db/ConfigarationProfiles/Setup It's installed during the imaging process on the target volume (I have verified it's there before Casper 1st boot) .. but YoYo ain't loading it automatically, so the Mac then doesn't enrol and the provisioning process then falls over. Same pkg when installed on to test Mac (working, not vanilla AutoDMGed) works perfectly. Imports, joins WiFi then expires in an hour. Is anyone else doing this? Am I missing some thing... or am I nuts?

Running OS 10.10.4 with JSS 9.73. I have a few managed preferences that seemed to be working fine. I installed PaperCut and ran the "install-login-hook.command" so as to make PaperCut to start up and have the user not be able to quit it. Would that have caused my managed preferences to stop working? I also have a policy run a script for a message to the user once they log in. That stopped working as well. I used to get the "Applying Managed Preferences" window but that is not coming up anymore either. I tried removing the PaperCut login hook and still no luck. Any ideas? Thanks,Pete

Does anyone know if there is a version of Auto Update Magic/AutoPkgr for those of us that use JSS in the cloud? I was digging around yesterday and couldn't find much info on it. Thanks!!!

I have a policy in my console, that when I click on it, it just spins trying to load. If I change the "o" option to U in the URL, it still spins. If I change it to L I get the logs fine. How can I delete this policy from the console since it's bad? I know the delete button requires confirmation and I haven't found a way to get to the confirmation form the URL. Using option V, I get the buttons on the bottom and can click edit, clone, logs etc, except Delete still doesn't work. Spinning around: Option V:

We're changing our wireless key and to prepare, I'm using Tim Sutton's excellent script (https://github.com/timsutton/make-profile-pkg) to package and deploy the new config before the cutover. Using this same method, the package installs the profile and reports success using our current wireless key. When I test with the new key (which isn't active yet), the install fails. I was expecting to at least see the profile installed in Sys Prefs > Profiles. Anyone know if this is expected behavior? (A config doesn't take if the SSID/authentication fails?)