Hello JAMF! At the moment we have about five devices in our JSS, before we get to big we would like to move the JSS to Server 2012. The part I'm slightly confused about: Our current URL is https://jss.domain.more:8443. Can I install the JSS on Windows, set it up with the same URL then shutdown the old JSS without it causing problem? Or will two URL's that match cause a problem? Thank you for reading!

I am attempting to add an active directory account to all of our Macs using the Local Account task in a policy in JSS. It adds the account fine on the mac but only adds it as a standard user, despite the fact I checked the box to allow the account to administer the computer. If anyone else has had this issue, I would greatly appreciate any help available.

I have file vault 2 computer configuration going on computers. User logs out and gets prompted to enter password for file vault 2 to turn on et.... I have a smart group with the criteria: FileVault 2 Individual Key Validation is 'valid' the only computer that shows up in this group is a single computer running 10.9the computers running 10.10 do not show up in this smart group. has anyone else encountered this ?

I'm wondering what everyone's thoughts are regarding whether UPS units are enough to protect sensitive electronics such as Mac Pro towers, iMacs and server room equipment. A couple of weeks ago I was researching UPS systems to replace an aging Belkin UPS of mine. With this UPS I am protecting a 2010 Mac Pro and RAID. I read that UPS systems don't really provide much power protection beyond that which a $30.00 hardware surge protector would provide - they just offer protection from data loss caused by improper shutdowns. As usual I settled on an APC BackUps Pro 1500. Now fast forward a few days to a client of mine. They have had a few lightning strikes in recent weeks that have caused some big disruption. The phone system needed to be rebooted. Their Fiery was effected to the point that the technician thought it might need to be replaced, but in the end it came back to life. And now two brand-new Mac Pro towers have gone schizophrenic. One to the point that Apple is go

The additional character in 10.10 has broken another script we use, but I'm not sure how to fix this one due to my limited scripting skills. I tried to remove the if statements referring to OS type since we have nothing older than 10.7 in use, and even they will be gone shortly, but I just ended up breaking the script in different ways. The unmodified script that breaks on 10.10: #!/bin/bash AP_NAME="NETWORK" AP_SEC="WPA2E" INDX=0 AIRPORT="" ALLINTERFACES="" IFS=' ' SW_VER=`/usr/bin/sw_vers -productVersion` if [ `echo "if(${SW_VER%.*}>=10.7)r=1;r"|/usr/bin/bc` -eq 1 ]; then APNAME="Wi-Fi" else APNAME="AirPort" fi # # Look for AirPort interface # for intf in `/usr/sbin/networksetup -listnetworkserviceorder | grep "^(H"`; do IFS=':,)' set $intf if [[ ($2 =~ ${APNAME} ) ]]; then AIRPORT=$4; fi done if [ `echo "if(${SW_VER%.*}>=10.6)r=1;r"|/usr

So this happened a few version ago & I was hoping it would just fix itself. The Self Service Description of all policies has gone misaligned. The close button is off in the upper right corner. Is there a way to reinstall the Self Service on the jss or edit some css etc...?

Has anyone been able to successfully connect to the JSS web interface using Mac OS X 10.11? We are unable to connect to the JSS via the web or when using Apple Configurator 2. Based on the error messages we are receiving it looks like the JSS does not adhere to what Apple has deemed as "best practices" for web security. I'm sure JAMF is working on this, but it makes it very difficult to test the upcoming releases. From Apple's technote on App Transport Security: App Transport Security is a feature that requires secure connections between an app and web services. The default connection requirements conform to the best practices for secure connections. Apps can override the default behavior and turn off App Transport Security. App Transport Security is available on iOS 9.0 or later, and on OS X 10.11 and later. and a little further down they outline what they consider best practices: • TLS requires at least version 1.2. • Connection ciphers are limited to those th

Hello, I need to gather Info on all " *.nsf files Lotus notes" on every mac. I want to be able to get full path, size, dates. They usually reside in /Users/Library/Application Support/IBM Notes Data/, but I want to do this for every user and then be able to run a report. Is this something I should create an EA or policy with a script maybe both? Thanks In advance. Chris

Has anyone noticed that as of 10.10.4, it is no longer possible to run the defaults write command to enable Secondary Mouse Click?? I have a login script that runs the command: sudo -u $3 defaults write com.apple.driver.AppleHIDMouse Button2 -integer 2 This has worked on all OS X versions so far however not currently working on 10.10.4. Its an interesting error as the Sys Prefs GUI displays that button 2 is set for Secondary Click but it is not working. If you go into Sys Prefs and manually change the option then put it back to Secondary Click, all is well however this is not an option when managing many hundreds of Mac's. I would be very interested to hear if anyone else has discovered this and of course if someone has a fix?

Dear JAMF friends, I wrote a script which users can run via the selfservice/policy. This script takes a long time to finish because i need to fetch several GBs from a server. Since there is some waiting time involved i'd like to give my users a popup notification like, 'your data is downloading', 'your data is extracting'. The jamf binary has those capabilities because it's able to give the cool transparent popups, and it would be awesome to use those in my script. Can give anyone an enlightening hint? Many thanks :)

Hey all, I'd like to be able to wipe a computer and start fresh with a new user, however I keep running into issues where policies that have a 'once per computer' execution frequency don't get triggered due to them being triggered before the wipe. I can't delete the computer in the jss because I need to preserve logs and any data attached to the physical machine, like purchasing info. If I use 'Once per user' I'm worried about running into conflicts where a single user has multiple computers. I don't want to clear logs individually because that is not a scalable solution. Get my drift?

Hi all, At School we have 2 Mac Labs for Art/Design with Epson IP Scanners. Currently, after imaging the lab, I need to manually add the scanner settings using a Local Admin Account. I'm looking for a .plist somewhere that stores the scanner details so I don't have to setup 40 machines with scanners every time I re-image the labs (currently every 3 months). The preferences must be system level as they carry across users, yet I can't find anything in /Library/Preferences or /System/Library/ Does anyone know where I can find such a plist or something I can package up to add to the imaging process so I can do zero-touch imaging? I'd like to avoid capturing a separate image if possible. Thanks in advance

I'm trying to create smart policies for distributing software packages based on location. I have a main office that handles about 80% of our total employees that sits under a single static IP address, perfect candidate for a network segment. I also have a few dozen remote users that have constantly rotating IP addresses. I'd like to be able to set policies for software distribution that says if you are on IP 1.1.1.1, use the local distribution point. All other IP addresses, mostly unknown, should use our cloud distribution point. I've been unable to set Network Segments for IP ranges, or 'All IPs but 1.1.1.1'. Is this possible? What other work arounds exist if it isn't?

I am new to JAMF and will be attending training soon, but I want to get a head start on getting setup on the Casper suite. I have read through a lot of documentation and forums, but there are still a few things puzzling me. First I have this issue, I created a Configuration Profile to bind my computers to AD, which appears to work fine, except the 'Namespace' option that I configured is not being applied to my machines. I can manually change the Namespace on my clients manually with a dsconfigad call, but I don't think I should have to. My second issues comes from troubleshooting that issue, I cannot find any logs that provide any useful information as to why my profile is applying all but that one setting. The impression I get from forums is that Casper does not currently have very good client logging capability. Is this accurate? Finally, from this issue, I am curious if people are more using Policies, to bind their clients, or Profiles?

We're starting to get reports of some machines failing to be able to connect to the internet after installing the 10.10.4 Delta update. One of the people affected is my boss, whose machine somehow started dying in the middle of our team call. sudo killall -HUP mDNSResponder returns a "no such process" error;ps -e | grep mDNSResponder shows no process running on his machine, whereas on mine it shows /usr/sbin/mDNSResponder. Is anyone else seeing this? This is potentially very bad for our people...

We've been having some serious issues with our master distribution point (windows server) since upgrading to 9.72. When uploading a file larger than 200 MB (approximately), Casper Admin and Finder will both lock up and we won't be able to upload the file. This is using Casper Admin on both 10.9.5 and 10.10.3 and small files upload fine which shows us that the share is mounting correctly and the s-casperadmin and s-casperinstall accounts seem to be fine. Anyone else seen this?

Hello people of JAMF Nation! My question has to do with Casper imaging and the JAMFHelper splash page that reads "The Imaging Process is finishing installing software". I currently have a recurring Adobe CC 2015 policy that kicks off during that splash page. My issue is that Casper Imaging reboots the machine (immediate restart) halfway through the policy, before some of the software is finished installing. This means that the software has to finish installing at the login window (not ideal). Is there a way to delay the reboot until the policy is completed? Or, can I manually trigger the splash page via "At Reboot" policy then have a command at the very end to reboot? The reason I want to do this is that Adobe CC fails to install without someone logged in. At the JAMFHelper splash page, the account "adobetempinstall" is logged in. Thank you all! Immediate Restart after Splash Page:

VPP account, DEP enrolled iPads, Supervised devices, apple ID is set to allow free apps without password, require password set to every 15, and auto download is on for app updates. Can Licensed VPP apps without a sheet of codes be pushed to iPads? Can VPP free apps be pushed silently? I am aware that I can "purchase" free apps via VPP and have them show in self service and if I add them via the apps page in the JSS I can push silently. I do not want to buy them in VPP then turn around and download the app, edit it, then upload it to the JSS. I am pretty sure that if I want silent push it will only happen with free apps added to the JSS from the app store and licensed VPP apps cannot be pushed silently. Please correct me if I am wrong, thanks!!

I am just testing out Target-Disk Mode and I'm running into an issue that I'm sure is just my inexperience with the OS X side of Casper.. When I image a Mac in Target-Disk Mode, the images and packages all come down fine, but the local account and WiFi enable script are not being run. At least I can't login with any local account in the configuration and WiFi is not enabled. Netbooting works fine. Caper 9.72. SMB mount point. Thanks for any help!

Hey Guys,We are implementing Wifi auth (Device) with TLS through Aerohive.Has anyone out there configured auto enrolment of your OSX devices to your Enterprise PKI (Windows Server 2008 R2), eg so they all get their own unique device certificate installed in the local keychain?All our machines are domain bound currently.Cheers,

Hello All, I am attempting to begin the process of testing deployments of Mac OS-X 10.8 client version within our environment. Currently we are running 10.6 server with OD and we were running our SUS on our 10.6 server. I need to find a solution to patch and maintain 10.8 in our environment and want to use the SUS Appliance from Jamf. I have the 1.02 NetSUS server up and running in VMware, as well as 2 branches created and all items synced (99gig worth) from Apple. In Workgroup Manager, I went in and created a new group. I then went in and created a preference for Software Update and pasted in the URL of one of my branches and saved changes. I am not getting an error message on one of my clients when I attempt to check for updates. "the certificate for this server is invalid etc. etc." My question is will this work when pasting the URL and deploying the setting via OD? Should I be deploying this through casper instead? Joe

We're starting to encrypt all Macs with FileVault 2, and I'm curious how other people approach the project, specifically in regards to shared workstations. For single-user computers, FileVault is no problem, since you can just enable the one user. However, working at a University, we have many computers that are shared - an iMac that multiple student workers can login to, for example. Typically, we control authentication to the shared workstation via Active Directory Group - if the user is part of the correct group that's been given access to the computer, they can login. However, for FileVault, I can't enable a group, only individual users, and FileVault can't communicate with my domain server. This means that an IT admin would have to go and enable each user for FileVault, and get them to enter their password, and do that all over again each semester as student workers change. So, do you encrypt every computer no matter what? Or do you only target single-user computers? Or on

Is it possible to unmanage a device from the server end without deleting it from JSS and without doing the task on the computer itself?We have a situation where a computer has been pulled aside by our legal department pending some investigations. It is currently turned off and locked away in a safe. The legal team would like to turn the computer on at some point soon to begin their investigation and they don't want files on the computer to change from their current state. Since this computer has been turned off for quite some time, there are a LOT of updates that the computer needs and when they turn it on, it's going to download lots of updates and apply lots of policies. I'd rather not have to change the scopes on all the policies from "All Computers" to "All Computers except this one". I just want to be able to click a button that tells the server to stop managing it so the legal team can do their thing without files being changed. When they are

We've been running casper for 6 months or so and we're moving past basic MDM and machine imaging to more advanced use of scripts and packages to upgrade and reconfigure machines. These forums have been great for most of my questions but there's one I really haven't found a good answer to. We're a game developer with Web and C++ devs working on macs and one of our major software deployments is GIT clients and development environments. All of these tools require basic configuration and I'm trying to move from having users do this to dropping config files in with the packages from self service but I haven't found a method I really like. 2 Situations as I see itA config file needed by a PKG when it runs. Such as kaspersky antivirus which has a dmg, a config file and a.sh script to chain it all together properly. For this I end up making 2 packages 1 to put the config file and script in /user/shared then the preflight script in the cached casper instal

an uninstall policy uninstalls an application, it is no longer advertised in /Applications. Afterwards on some computers the application icon is gone from launchpad while on some other computers the application icon is still present (question ? over it). Is there a script or something that can check afterwards to somehow trash the icon?