I know this topic has been brought up many times, but I still have not found an ideal solution to our particular situation, so I wanted to get some input from you folks. I know it's not exactly a jamf issue but... We do not allow our users to set their own passwords. The reason for this is that we have multiple services our teachers and students use and we manage, and some of these use LDAP while others require us to set the password for the user. To keep things consistent and avoid daily "I forgot my password" situations, we control the passwords for all users. I realize this is not ideal from a security standpoint, but it is necessary for our situation. We change passwords for teachers once a year. As you all know, OS X displays a cryptic (to most users) dialog prompting them to update their keychain password after an AD password change. We do not want to panic our teachers, so right now we are thinking that we will try to communicate the steps they need to tak

I am trying to use a mobileconfig on my macs that have 10.0.2. The issue is that when I set the password policy allow simple or not allow simple and set a 15 character password along with expire times and repeatability. I apply the profile at the computer level and any local user I have prior to the install I can set the password according to the password restrictions. Any new local users I cannot set a correct password thusly no creation. If I remove the password restriction from the computer level config and implement the password restriction with a user level config for just the password. I get the message that the password was not changed as it did not meet complexity requirements. This is being done for testing by creating the Profile in JAMF and downloading it then applying the profile to a new OS build that has no other policies applied.

Maybe this is actually a feature request, but maybe there is a way to do this and I just don't know about it. When you run a policy it is real easy to look at the logs and see if it was unsuccessful on certain machines. If you have a configuration profile that you have scoped out to a number of machines it will show you in the dashboard exactly where it is at. It will say how many have completed, how many to go, and there often might be a red slice in that pie that says there were errors on 8 machines. On a policy you can easily find out what 8 machines the errors were on. For a configuration profile is there a way to figure out what machines the errors occurred on so you can go and correct the issue. Maybe there is an easy way and I'm just not seeing it.

Hello Nation! I'm very new to LaunchAgents and wanted to set one up. Currently I'm using a login script that works fine, but I want to move away from login scripts. What I want to happen: Launch a non-Apple app at login. I tried a configuration profile but as soon as I typed in .app, it would disappear. Here's my plist, I'm more than likely doing something wrong and would love if something guided me in the right direction!~~~~ <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.ntware.teststation5</string> <key>RunAtLoad</key> <true/> <key>ProgramArguments</key> <array> <string>/Applications/UniFLOW/MacClient.app</string> </a

I'm utterly stumped on this one. Push notifications work on enrolled devices INSIDE our firewall but not outside. So i'm in the middle of a replan and reimplement our JSS architecture. I've got a master JSS sitting inside the firewall. I've another restricted JSS sitting in the DMZ. There's a split DNS address that feeds both servers. You get the DMZ JSS if you're external to our network and vise versa. I've already made sure ports 2195, 2196 and 5223 are open on both servers to the *.push.apple.com DNS names. So i've got a test laptop with a valid current MDM profile. If it's inside our network on either ethernet or wifi and I push a lock command to it, within five minutes it's locking itself. Try the same thing outside our network and nothing. I even exposed the test laptop on my home router (and put it in it's own DMZ) and still nothing. What else should I be doing?

JAMF has an excellent article that covers how to deploy AAMEE generated PKG installers by wrapping them in DMGs and using a script to mount/install...JAMF deserves a ROCK-STAR awared for that!!! https://jamfnation.jamfsoftware.com/article.html?id=161 This works flawlessly when pushing via policy (not sure if HTTP is still an issue when using DMG?), and also Self Service works like a charm. So what about deploying these DMGs at imaging time? When I pull up the DMG in Casper Admin, I don't see a "run this script" option... So is it possible to deploy these AAMEE PKG installers that are wrapped in DMG during imaging time? Happy 4th of July! Applogies to the UK list members...LOL. Don

Has anyone been successful in implementing a configuration profile (or anything else that works) that fills in the Proxy settings information for ethernet connections, like Thunderbolt and USB? So far, I am having to manually enter this information into the image before I pull it with Casper.

I do a policy that will run script for user to shutdown/restart their laptop if the uptime is more than 7days.The script is like this: set question to display dialog "The machine has not been shut down or restarted for more than a week. Please shut down or restart the machine by clicking on Shut Down or Restart." with title "System Event by Andres Cheah, MCM" with icon stop buttons {"Shut Down", "Restart", "Cancel"}set answer to button returned of questionif answer is equal to "Shut Down" then tell application "System Events" shut down end tellend ifif answer is equal to "Restart" then tell application "System Events" restart end tellend ifif answer is equal to "Cancel" then returnend if I test in the machine it is working fine, but when i put into the policy; there an error below: Script exit code: 1Script result: 2013-09-23 10:15:47.576 osascript[

when i upload a .pkg .dmg .sh file to Casper Admin, who should be the owner of that file prior to uploading it? and what should be the permissions? so if i am logged in as a standard or administrator and create the file under this user, does it matter if this user uploads the file? do i have to chown root:wheel ./file ?do i have to chmod 744 ./file ?

Does anybody have any suggestions on how I can create a smart computer group based on enrollment date/time? What i am trying to do is have a smart group to look at newly imaged machines (within the last 24 hours) so our JSS can run a policy to add icons to the dock like Microsoft Outlook, Microsoft Lync. etc....

Does anyone have the most recent JAMF CCA course book or know how I can obtain a copy prior to attending the course?

Hello JAMF Nation! We created an SMB share hosted on Windows Server 2012 last week and temporally made it our master distribution point. I replicated our AFP share to SMB and it worked great for two days before Casper admin/Imaging (Netboot for imaging) started refusing to mount it. In Casper Admin, I have to log off my account and log back in for it to mount even though I'm not connected to any shares. We have four accounts plus a security group in AD that has access to smb://servername/CasperShare:1) casperadmin with RW2) casperinstall with RO.3) My Windows admin account with RW (only person in the security group)4) Our Windows Sysadmin's domain admin account I can easily mount/access smb://servername/CasperShare in OS X and Windows without a problem, Casper is the only thing having an issue with it. Does it matter that we have two other folders inside smb://servername? Example: smb://servername1/Folder1 | smb://servername1/Folder2 | smb://servername1/CasperShare T

I feel like I'm going crazy, so someone please correct me if I'm wrong, but these are the steps we've used since 10.9 came out for making Casper Imaging images:1. Obtain OS X installer from Apple2. Drag OS X installer to Casper Admin3. Let Admin do it's thing, then save the package as an OS X installer4. Create a new configuration with that ESD file, configure for admin account, etc on those tabs & add our hide recovery HD script and our custom preconfig script5. Compile For 10.9.2, 10.9.3, and 10.9.5 this worked perfectly. 10.10 comes out and I follow the exact same steps - seems fine. Go to enable FileVault and there's no Recovery HD. So I ran it over and over and over - one out of five times, it created a Recovery HD. I know I can use another program to create my own image with Recovery HD, but I'm just curios if I'm going crazy or if other people are seeing this same result?

So I have 105 new macbook pro's I am setting up. I pulled one out of the box. Set it up with apps,binding,printers,settings etc. I then target booted it to my imac and launched composer. I then created a new base image and captured the macbook hard drive. I then loaded it to casper admin. Categorized it as a Base Image with a priority of 1. At this point all should be ready. I opened a second machine never booted and did a netboot to Casper. Chose the base image I made and chose to erase the current HD. The process goes through but after reboot I get a circle with a line through it. I was able to 'fix' this by going to internet recovery and running disk utility. I then ran a permission repair and a disk repair and reboot. It then restarted to my working image. Where did I mess up?

As a new institution to the JAMF Casper Suite I would like to enable machine log on through wireless to Macs that are bound to the domain. The goal is to try to mirror the wireless log on that is achieved on the Windows side by specifying through Group Policy the secure hidden wireless network (WPA2 Enterprise PEAP (MSCHAPv2)).So far I have configured a payload that specifies the Network settings that includes:• SSID• Hidden Network• Automatically Connect• No Proxy• Security Type• Use as a Login Window Configuration• Protocols o Accepted EAP Type is set to PEAP o Use Directory Authentication• Under Trust Allow Trust Exceptions is checked but nothing else is specified here Just this configuration alone displays an option on the log on screen to select the WiFi SSID specified or “None”. I can see that the wireless icon lights up for a moment then the log on fails. I have attempted to configure the AD Certificate without any luck the configuration profile fail

Hey all, so we recently moved away from a pair of Reposado servers to point our clients back out to Apple for their Software Update needs. I have a client that is stuck with the old setting and I can't get it to check Apple SUS. So the preferences for the SUS settings were being set by Managed Preferences. I removed the MCX, then ran a script that deleted the /Library/Managed Preferences/ directory and called jamf -mcx to rebuild another others that might be needed (none are being used now) I've run the jamf removeSWUSettings command and the softwareupdate --clear-catalog commands and still when I check for Software Updates it tries to connect to the local reposado server (which doesn't exist anymore.) From what I can tell this is working just fine on most computers, but a few are being stubborn. Any help or fresh ideas are welcome.

Doing a dry run in the lab, I installed 9.65 and restored our 8.73 database. Not too surprisingly at first launch of the web interface I'm getting a Startup Suspended, error updating the database schema. Being 24 updates behind, should I consider an incremental update or two prior to the current release? 9.2 --> 9.4 --> 9.65 ?

Hi Everyone, Has anyone seen an issue where computers get renamed to "localhost" on 10.9.2 and the latest version of the JSS? I saw this thread here: https://jamfnation.jamfsoftware.com/discussion.html?id=5078, but I'm not sure it still applies. The .plist file it references isn't present in my base image that I created with AutoDMG. Any thoughts that people have would be great!

Hey guys, I´ve got a Problem with my MS Office 2011 14.4.8. My Office Apps Word/Excel/Powerpoint are crashing when there is CS6 installed.When i don't install CS6, Office is running with no Problems. This report appears when i open an Office App: Microsoft Error Reporting log version: 2.0 Error Signature:Exception: EXC_BAD_ACCESSDate/Time: 2015-03-11 11:39:49 +0000Application Name: Microsoft WordApplication Bundle ID: com.microsoft.WordApplication Signature: MSWDApplication Version: 14.4.8.150116Crashed Module Name: MicrosoftMenuLibraryCrashed Module Version: 14.4.8.150116Crashed Module Offset: 0x00007165Blame Module Name: MicrosoftMenuLibraryBlame Module Version: 14.4.8.150116Blame Module Offset: 0x00007165Application LCID: 1031Extra app info: Reg=en Loc=0x0407Crashed thread: 0 After i log out and log in, Office runs for this User.But with another User, Office crashes again. The CS6 Paket was created with AAMEE 3.1. I think it´s a font Cache Problem, because after I use ´

Happy Friday! Anyone using irapp or other products/methods to provide remote mac services?http://www.coderebel.com/products/irapp-terminal-server If so, how did you find the experience? Do you recommend it?

I have just received our new test Macbook Pros. I am testing the application installs. The applications show as installed under JAMF but they do not show under finder or in the LaunchPad. However if I search for them under Spotlight , they are found and work. The apps were created on Yosemite 10.10.2 and installed on Yosemite 10.10.2.. However I did have issues with this machine and just reinstalled user the Apple recovery as I am in the process of setting up the Yosemite images. I installed using Self Service. I have never had this issue before?

We are new users of the Casper Suite here and have begun testing Yosemite upgrades and have run into some serious issues. Our test machines are iMacs running 10.9.5. We are able to deploy the Yosemite upgrade package via Casper Admin without any issues. The upgrade completely successfully and our users are able to log back in and use the machines normally However, at some point, usually within 24-48 hours of the upgrade, the machines completely hang up during use to the point where they need to be hard rebooted, during reboot they hang at the Apple Logo and never finish booting booting to Single-User Mode and running Disk Repair returns no errors in some cases we are not even able to boot to Safe Mode Has anyone run into these sort of issues?

Hey nation, I'm testing some student iPad restrictions and it seems like no matter what configuration I apply, just having the restrictions enabled under Mobile Devices > Configuration Profiles > New > Restrictions causes App distributions to be met with a login prompt asking for the user's AppleID password. If the user logs in, the App comes down. If they don't login then, they don't get the App. Has anyone had any experience with this? We would like for Apps to appear on the iPad with no user intervention whatsoever.

Hi all, Is is possible to trigger profiles based on location ?The idea here would be to restrict iPads when students are within school boundaries.iBeacon? SSID? Network Segment? Router itself? If not possible from a technical standpoint, how do you deal with that ? François

Is it possible to install packages via Casper v 9.6 to a machine that is encrypted using FileVault 2 and has been rebooted and stuck at the "login window" FV2 throws up there? Has the OS loaded enough to install packages from Casper? Thanks in advance.