So were going through some testing on our macs and discovered that an individual (who doesn't have admin rights) can go into single user mode and esclate their permissions to admin. So the simple question is how do we disable a user from being able to go into single user mode. Searching on the web it referred to a /etc/rc.boot file. I don't see that file in our current build (10.10.1 and 10.10.3). I do see rc.comm, rc.imagin, and rc.netboot. So which one should I edit to disable single user mode, and more specifically - how. Is this the right file to edit, or is there another file? I'd like to avoid using a firmware password if possible at first to make life easier for users. What are you guys out there doing?

For anyone interested in updating to Yosemite, SmartNotebook 11.4 is no longer supported according to Smart Technologies. Smart officially is stating "one must upgrade to version 14.2 AND have an Advantage membership moving forward". This was not acceptable for me/us so i found this fellas workaround to restore SmartNotebook 11.4 for use in Yosemite: http://lkrms.org/running-smart-notebook-11-4-on-os-x-yosemite/

Hey Guys, I am trying to get the serial number of our thunderbolt docks with ioreg or system_profiler to have an extension attribute for the docks in Casper. So far I got this $ system_profiler SPThunderboltDataType Thunderbolt: Thunderbolt Bus: Vendor Name: Apple Inc. Device Name: MacBook Pro UID: 0x0001000F01673350 Firmware Version: 17,2 Domain UUID: 3F75FB1E-3A50-C95C-B5FC-0FF493EC3B19 Port: Status: Device connected Link Status: 0x2 Current Link Width: 0x2 Receptacle: 1 Cable Firmware Version: 1.0.16 Cable Serial Number: C4M435600SSF797A5 Link Controller Firmware Version: 0.11.0 Port: Status: No device connected Link Status: 0x7 Current Link Width: 0x1 Receptacle: 2 Link Controller Firmware Version: 0.11.0 Thunderbolt 2 Express Dock HD: Vendor Name: Belkin International, Inc. Device

I am starting to see this message when i look at my smart group of Yosemite computers. Does anyone have any information to resolve or has anyone experienced this message lately??

Why this script is removing just the last entry? tell application "rm - rf/Library/LaunchDaemons/com.vsearch.daemon.plist" "Library/InputManagers/CTLoader" "System/Library/Frameworks/v.framework" "System/Library/Frameworks/VSearch.framework" "Library/PrivilegedHelperTools/Jack" "Library/InputManagers/CTLoader" "Library/Application Support/Conduit/" "~Library/Internet Plug-Ins/ConduitNPAPIPlugin.plugin" "~Library/Internet Plug-Ins/TroviNPAPIPlugin.plugin" "Applications/Genieo" "Applications/InstallMac" "Applications/Uninstall Genieo" "Applications/Uninstall IM Completer.app" "Library/PrivilegedHelperTools/com.genieoinnovation.macextension.client" "~Library/Application Support/Genieo" "~Library/Application Support/com.genieoinnovation.Installer" "Library/Launch

Hi all File this under strange!! I have spent some of today scripting and the script is using a policy. I have had some strange results for a couple of machines during the day and when I looked closely at the script output, it appears to be using an older version of the script which contained a glaring bug that produced a vast quantity of text including line numbers and attempts to run commands in directories it shouldn't have. As I said, glaring bug! Anyway, the script itself was updated earlier in the day and I have seen a couple of machines in the last hour or 2 run the old script. After I flushed the log they ran the newer version! Confused. I am using 9.32 in production (soon to upgrade to 9.7x) and wondered if anyone had experienced this quirk. All I can think is that the machines took so long to process the script that they actually started before the updated version was done but it seems unlikely. But possible. I am using 9.32 on Linux with a couple of JAMF Fi

Has anyone had any luck with suppressing Silverlight update notifications? Inside ~/Library/com.microsoft.silverlight.plist the UpdateMode value that can be changed from 1-(on) to 2-(off). I tried to just package up a com.microsoft.silverlight.plist file with the value set to off, but after pushing out to a test Mac I find that the setting isn't respected by Silverlight Preferences, even though the new value is set in the target's plist file. Even if I just change the value directly on the test Mac Silverlight Preferences.app won't respect the change. Any help would be awesome. I've got a few delicate-flower type users that don't want to see the notifications. :-)

I'm working on our OS X 10.10 image (my first image build after taking over the process) and all is working fine, except a policy we have created to install 25 packages is not being allowed to run to completion. We run this same policy in our current 10.9 image with no problem. The policy for 10.10 is cloned from the 10.9 policy, with the only changes being all references to 10.9 changed to 10.10. The part of the script in question that is failing: Install Standard Software Set via Policy loginfo "Installing Standard Software Set via Policy"/usr/sbin/jamf policy -trigger Imaging_${OS} & Get the Process ID of the last command run in the background ($!) and wait for it to complete (wait) SUPID=echo "$!"wait $SUPID When I check the initialsetup.log that is created during the this process I see that this policy is given less than 60 seconds to run, not enough time to put down all of the packages and install. Some do work, such as our Identity Finder pa

One of the Macbooks from our students' Macbooks trolley has become headache for us. We have tried HD permissions and other stuff, cut the long story short, we suspected the firmware and sent it to Apple for firmware upgrade and Apple did that and now we have returned this Macbook fresh from Apple store. We tried first installing QuickAdd.pkg and then tried "sudo jamf enroll -prompt" and got the following errors respectively. The installation failed. The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. Error enrolling computer: CRUD operation Error - An error has occured while creating, reading, updating or deleting a device. If this remain unresolved then we would request Apple to replace this Macbook with another one. Please note that other Macbooks and iPads are going good with imaging and etc. There are no other issues like certificate expired etc.

Sort of newbie here to scripting so looking for some help! I want to get the hard drive etc to show up on users desktops as they update to Yosemite or get a new computer with Yosemite. I'll include portion of the script below, I'm sure it's an easy fix, just need some knowledgeable eyes. !/bin/bash Initial setup script for Mac OS X 10.10.x Last modified 05.27.2015 Show icons for hard drives, servers, and removable media on the desktop /usr/bin/defaults write com.apple.finder ShowExternalHardDrivesOnDesktop -bool true/usr/bin/defaults write com.apple.finder ShowHardDrivesOnDesktop -bool true/usr/bin/defaults write com.apple.finder ShowMountedServersOnDesktop -bool true/usr/bin/defaults write com.apple.finder ShowRemovableMediaOnDesktop -bool true

Hello everyone! I have been having a bit of a challenge in the last few days with one of my Pre-Stage setups. It will hang at 'Performing Block Copy' and will force quit Imaging - it looks like this is happening when Casper Imaging is trying to erase the target drive. Also, the drive will not unmount and erase when NetBooted, which leaves me to believe there is a problem with the NetBoot Image... I have checked here for some answers, but nothing has worked so far, not even editing the rc.netboot file and adding a RAMDisk. To be fair, this (the RAMDisk) fix did work prior to updating to 8.63, but doesn't seem to be working anymore. I am really at a loss here, does anyone have any ideas about what might be causing this problem? Thanks! EDIT: Also, when updating the NBI with the RAM Disk fix in the rc.netboot file, I am no longer able to netboot any computers, the computer will immediately shut off. Prior to updating the rc.netboot file, the destination drive was mou

I'm working to get a bunch of OS X machines discoverable on my work network so that they can be managed by SCCM/Parallels SCCM Plug-In. So far the best solution i have is to physically touch each machine and enable remote mgmt, vnc, and ssh. I have a shell script using kickstart that will do the remote management and vnc configuration, but i can't figure out what command in there would also enable ssh. Here's what I have so far: do shell script "/System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -allowAccessFor -allUsers -privs -all -clientopts -setvnclegacy -vnclegacy yes -setvncpw -vncpw ** -restart -agent" password "" with administrator privileges So... What is the command I can throw in there to enable SSH as well? Is there some other solution to what I'm trying to do that's much better? Thanks in advance!

Greetings i know this is less of jamf/casper issue, however we'd ran into a wall with this one. For a while now we have an issue in a couple of our offices with the combination of wifi and mac's.The symptoms: wifi connection drops, when trying to reconnect the ssid's are not visible. when inserting a usb-wifi dongle. that can connect fine to the same SSID's. when walking over to a other part of the building the ssids become visable again, and walking back the issue is (temporary) resolved. The symptoms are occurring on all kinds of mac's (air 2008 and above till current) ProRetina's till current, osx 10.8, 10.9 and 10.10. both casper imaged, and retail. ios devices running 6,7,and8) the environment: over 150+ap's multiple sites, in a WLC environment. ssid's with both 802 authentication and with wpa and without auth. all effected. Troubleshooting performed: - connected a mac to a usb wifi dongle: no further issues- bluetooth disabled, no eff

Does anybody else have issues with checkmarking updates in SUS? For one thing, when I "select all" and then hit apply, they all come back as unchecked when the page refreshes. For a second issue, I seem to only be able to checkmark 995 updates total. Any additional updates that are checked will not apply properly.

Those of you who were participating in the developer releases or public beta of Yosemite (or even the dot zero release) may recall that there was an issue with Outlook 2011 not displaying the main window if you had the disclosure triangle open to show your list of folders in your mailbox. Sad to say, the Office 2011 14.5.0 update has resurrected this issue. Outlook will launch, but the main window will not open. You can create new messages and events via the menus, but that's it. If you keep that disclosure triangle closed when you quit the application, it'll launch just fine again.

Is anyone else seeing casper imaging not correctly blessing the internal drive after imaging completes? We keep seeing (since 9.7) Casper Imaging (from netboot with the checkbox selected to reboot to target drive) after imaging completes, it then boots to a folder with a question mark (or tries to boot back to the netboot). Gabe ShackneyPrinceton Public Schools

we replaced our fleet of teacher laptops with new ones. the old teacher laptop will be going into carts for use in the classroom. we had pulled al the user/building/department info from AD, but now that they will be going into carts for student use all that info needs to be removed. thats where i hit the wall. i can fill this info in bulk, but how do you remove it? any help would be appreciated

Hi All how to manage and edit sidebar on self service? like below, how to add and remove an item on the sidebar?

I have a user that cannot receive Compressor via VPP. We are successfully using VPP with managed distribution for OS X and iOS. Recently we purchased a single copy of Compressor 4.2 for evaluation. I have created a VPP assignment, which contains just Compressor. When I scope the assignment to this user, the recalculation dialog appears. After some time, I click back onto the assignment and the recalculation has completed, however when I look in the App Store, while logged in with the user's Apple ID, Compressor is not part of the purchase history. Looking at the VPP Account itself in Global Management, the Compressor line shows Total: 1, In Use: 1, Reported: 1. If I unscope the user from the assignment the In Use number drops to 0. Meanwhile I can successfully assign Compressor to a different user. And I can successfully assign other software to the "problem" user. I have tried deleting and recreating the user, redoing the VPP invitation, deleting and recreating the assignment, an

I have a bit of a head scratcher that I'm hoping people may be able to assist with. Attempting to set a default desktop background in my lab. Created a policy that deploys a package with desired image and a python script. It is set to run once on recurring check-in. All machines report that the policy has run w/o problem. However, none of the machines have taken the new background. The package has been unpacked, as the images are in /User/Shared as I requested. If I flush the machine from the list, go to the physical machine and run 'sudo jamf policy' from the terminal, the script runs just fine, I get a new background, and everything is happy. Except me, because I don't want to walk around and touch every machine. If anyone has any thoughts, I'd love to hear them. Happy to provide any further information if it is helpful.

Hello all, Does anybody know how I can disable the computer to computer networks with either a script or mcx setting? Thanks,

Hi, We have implemented Casper as our imaging and update solution option about 1 week ago and I am learning to drive it but having a few issues that i cant find clarity around so I thought id post a question and would really appreciate anyone taking the time to get back to me. When we implemented Casper we were taken through the composer and had a lesson on creating dmg and pkg's. We had a clean machine and downloaded the latest version of flash and installed it before opening the composer and creating the dmg, This was then dragged into the Casper Admin application and saved. I then created a policy that included the flash dmg created in composer to scope to only my test machine and all went well. The dmg installed correctly. I then tried to simply copy the latest java update dmg into the admin app and follow the same steps but i notice that the java update doesnt install and it is simply copies to the hard drive of the machine in the scope - what am i doing wrong here? Im th

Hi all some input if possible please We need a way to send out emails to all our Mac users, i'd like to use the method ofchoosing Action > Send Email from a smart group but this doesn't give me the option of including attachments (please correct me if i'm wrong and you can add attachments, i'd like to be wrong!) I'm looking at a way of getting the email addresses from the smart group All Manage Clients,i've exported the web page to a pdf so i have all the addresses in text form. Automator has a PDF to text action which will produce an rtf from the pdf.Can anyone suggest a way of extracting just the email addresses from the pdf or rtf ? or point me to another way to create a mail group from the JSS ? Thanks!Andy

Hello! We just created a new Yosemite image. I just replaced 10.10.2 with 10.10.3. The images here are all basically identical except for a few minor items. However, our Yosemite image refuses to bind to AD while our Mavericks image continues to work perfectly. I am using the same bind for both. I can manually bind the Yosemite machines once they are imaged, but that defeats the point of having it in there in the first place. Without the bind, no profiles are pulled down. Also, the machines are not enrolling in JAMF probably for related reasons. I'm stumped. I'll redo the 10.10.3 DMG if I have to since it's the only variable, but I don't want to if it's not the problem. Any advice would be greatly appreciated. :) PS: I'm looking for logs on a local machine after it has completed its image process. Do they exist there or on the JSS server? Thanks,SGN

We've recently changed our URL for our JSS from a .local address to a .net to enable us to use a third party cert for our external JSS. However, as part of this the URI for the PKI is not available externally. To enrol externally it needs the CA Authority cert which it can't access so the enrol fails. I'm trying to look at ways to edit the QuickAdd with a preflight and: jamfremoveFrameworkThen install the CA (CN=CompanyName (London) JSS Built-in Certificate Authority.pem Has anyone else had any luck with this, or any ideas on how to make this better? CheersJonny