Short time reader here, newbie Jamf admin to boot. Stood up JSS 8.6 and upgraded to 9.1.1 and just tonight to 9.2, have a large org with lots of devices and complex network. Most networks are analogous to buildings which usually contain one or more specific departments, such that the departments are often (but not always) unique to each building. Almost every building also has a server that can act as the jamf distribution point. I've defined the buildings, departments, distribution points, and network segments. It sounds like I can run recon on a network segment manually and get it to apply the building and department values to discovered devices. That's generally undesireable as I have hundreds of network segments. Can a recon also assign dept/building to an already discovered device? (At best my reading of the docs suggests maybe.) It seems like the "override" checkbox in the Network Segments should provide what I am looking for - to automatically assign b

In testing, everything worked great for us. After that phase, we rolled it to a couple users in production and now all machines including our test ones don't work so great. I take a machine that is bound to our AD domain and add a 802.1x profile so that the device connects via Wi-FI adapter. This works great. I then enable "create a mobile account at login" and logout. I login as an administrative AD user, and as expected the Mac creates a local account. I then enable file-vault and reboot. At this point, the Mac sits at the un-encrypt login prompt (as is normal for a FV machine) with the AD user I just created the mobile account for. I authenticate, and the machine begins to boot. Once I get to the user's desktop, I am not connected to my 802.1x specified network, and as such I'm not connected as an AD user. My local user no longer has admin privileges (since it is derived from AD group membership). To make it work, I logout from this failed session (not reb

While troubleshooting http errors when running a cache policy I noticed no web server root directory /library/server/webDoes this mean Apache tomcat did not install correctly when JSS was installed?HI see the /library/jss/tomcat

Hi. I tried to fetch the current users UID for a script echo "checking Users UID"UID=id -u $loggedInUserecho "$UID" The output is: Desktop/user_info.sh: line 44: UID: readonly variableFurther there was the idea to check if this is a UID between 501 and 1000 to display if it's a local or AD/OD account. It would be nice if anybody has an idea how I could approach that?! Thanks,Maik

I missed Charles' presentation yesterday, is there any info about "Bushel" online yet?

[D-008217] Fixed an issue that prevented Casper Imaging from creating multiple partitions when imaging a drive that has core storage enabled. http://resources.jamfsoftware.com/documents/products/documentation/Casper-Suite-9.65-Release-Notes.pdf

I am trying to find the right options for a limited user to be able to pushout a FileVault configuration. It works fine as an admin user, but so farwith the limited user account when I attempt to push the FileVaultconfiguration I get the error "there was an error creating resources on the JSS"I have tried this solution with no joy so far https://jamfnation.jamfsoftware.com/discussion.html?id=8235

When checking Inventory, under 'local user accounts' I see some of the inventoried iMacs/MBPros/MBAirs displaying both the 'LOCAL USER ACCOUNTS' & 'HIDDEN LOCAL USER ACCOUNTS' so under the local user accounts it will have a total around 80. While on other iMacs/MBPros/MBAirs it is just displaying the 'LOCAL USER ACCOUNTS' only for a total of around 4 (whatever the computer has). Has anyone else seen this?computers are all getting enrolled the same way, quick add.pkghow would i get those 'HIDDEN LOCAL USER ACCOUNTS' not to display in the inventory? it doesn't seem to be a big deal, but I don't like the inconsistency. thanks

Hey folks! I'm looking for a way to easily determine if a software update package from Apple requires a restart. Since I always have a battle with my users to get them to restart and run updates, I'd like to start forcing updates of items that don't require a restart. So, any ideas short of writing my own SQL query? Thanks! Steve

Dear all, As title, can jss send a command wipe the device data and then automatically re-enroll?

It appears Apple no longer offers Xcode through their dev site, when you go to download it, it links back to the MAS. Are we back to the old method of putting MAS in Debug mode?

Hey guys, I'm a bit stuck at this place. I need to make the preference pane Date & Time available for everyone without admin privileges. I know that this has to be done with the authorization DB. I found the respective key here: system.preferences.datetime http://www.dssw.co.uk/reference/authorization-rights/index.html Regardless what I changed in the authorization, I didn't get this working. Does anyone have had a similar problem and / or knows how to deal with the permissions in the authorization DB? This isn't very well documented from Apple. These are the links I found but unfortunately didn't help me in any case... https://www.afp548.com/2013/10/22/modifying-the-os-x-mavericks-authorization-database/https://derflounder.wordpress.com/2014/02/16/managing-the-authorization-database-in-os-x-mavericks/ Thanks,Michael

Ok, I've seen a few posts on aspects of this but I'd like to get some feedback from JAMFNation on how they deal with the following requirement. We are working on a 10.8 deployment for a development project. All of the developers will be using Xcode, Ruby on Rails, Java, Python, MySQL and other tools. Our security team has a number of requirements, the primary 2 being "no local admin rights" and "restrict ALL software installs to Self Service". So we have a logon script that adds the console user to the _developer group by default. But we keep running into elevation problems. For example, the first time you launch Xcode and create a new project or install the SDKs, you need admin rights to continue. Other examples are Ability to stop/start MySql, change network settings (toggle proxy and modify proxy bypass mostly) and more. I've spent the last couple of days working on understanding the syntax for the sudoers file but have come to realize th

Hi Guys, Is anyone else experiencing these issues with mounts through Self Service with the Open command. None of our shares are mounting.

The Apple Configurator 1.7.1 is giving error that it couldn't allocate resource while trying to Supervise the iPad.

Hey all, I work in a small school district & I'm working on our new images (10.7 for WhiMacs & 10.10 for all of the aluminum models) for deployment this summer. I was hoping to start using configuration profiles a little more heavily. We tried doing this last year and couldn't get it to work, but I could've sworn I saw something in one of the previous JSS version release notes that said they'd fixed scoping to local users... We've just recently upgraded our JSS to 9.62. So, here's the dealio. Our image has 3 local users (student, teacher & hidden admin). I'm mostly concerned with the student account. Specifically, I want to be able to "lock down" both the student dock & desktop background (and a few other things). The problem is, I also am not allowed to lock down these items for the teacher user, so I need to scope only to the student user. We have (in previous years), set the "system immutable" flag on t

Anyone have an extension attribute or something that can tell if the security patch that was applied yesterday to fix the FREAK vulnerability has been applied or not?

Hi,I'am using JSS 9.31. I'd like to send an VPP invitation. When the user got the email he has to login with an user account and an password. From where do I get the information which user account or which password has to be filled in.The user has the name testuser. The Invitation form of the JSS comes in via email with this username. S.b. told me to fill in the account data of the apple id the user of this ipad usually uses. This doesn't work.Knows anybody help?

Hello, thank you for looking at my post. I have been working on the issue with /Private/Var/Folders growing in size. I took another members advice and am currently using this script: #!/bin/sh userList=`dscl . list /Users UniqueID | awk '$2 > 1000 {print $1}'` echo "Deleting mobile accounts…" for u in $userList ; do dscl . delete /Users/$u done echo "Deleting all user cached files…" rm -f -R /private/var/folders/* shutdown -r now I have created a Smart Group that records all MacBook Airs with less than 60GB of storage available and created a policy to run the above script on logout. If I leave the script "as is" it works fine. It removes what I need and reboots the machine. My only concern is under the "Logs" it states "Pending". If I remove the reboot command and execute the policy again the log shows "Completed". I'm pretty sure Recon is not running and submitting the inform

Hi guys How are you managing Acrobat Pro X that came with CS6? I can't use the Acrobat customisation wizard to disable updates because I use AAMEE enabling updates. I've tried the fix with the bUpdater false plist but that didn't work. I've resorted to renaming the Updater plugin within the app bundle.

I am running a Windows 2008r2 Server to host my JSS, I have setup a CasperShare based around this article... https://jamfnation.jamfsoftware.com/article.html?id=325 When I open up Casper Admin it tries to connect to the share but says it cannot mount distribution point.. So I went to mount it manually on my Macbook Air and I can mount the share just fine with both my read and my write account. I have triple checked the username and password settings in the JSS. Everything should be working as far as I can tell.

I have a mid 2010 Macbook Pro OS X 10.9.5 that is encrypted with FV2 and has a bad video board (no display or external monitor). Can I swap out the encrypted HD with a simialr "Good" MBP and then access that drive from the new computer? Or does it need to be decrypted in the original MBP first? I get the feeling that pre-boot is tied to EFI and some interaction with the recovery drive. If cannot swap the drive then access in good hardware, could I do this in Target Disk Mode? I do not have it in my hands yet. Any advice would be very helpful. Thanks in advance.

We use VMs to build our packages and do our installation testing because they’re easy to roll back and all that. An unavoidable side effect, though, is that I then lose the packages that I had in Composer under the SOURCES caption on the left. At first I thought this wasn’t a huge deal since I can simply drag the package back in to Composer and do a “Convert to Source” on it, right? Wrong. Every time I do this, even with a package that I JUST MADE IN COMPOSER, I get the following two error messages: Converting to source failedCommand failed with error code (1): '/usr/sbin/ installer' (null)and Command failed with error code (1): '/usr/sbin/installer' Clicking OK on both boxes takes me back to the Composer window, and I’m no closer to being able to modify or view the package than I was before I started. My question is this – is there a way to save the “guts” of the package as with programs like Iceburg or Packages, or do I just need to have a VM that I never

Wanted to know if anyone here is managing Flip4Mac I wanted to enforce these Flip4Mac browser plug-in settings under System Preferences -> Flip4Mac on all 10.9.5 clients we support- enable "Launch Flip Player"- enable "Always show movie controller" I have found out that it uses a plist net.telestream.wmv.plugin.plist. I created a profile out from the plist and I can see that it is pushed out to the clients under the path /Library/managedpreferences but it does not set the above. Flip4Mac version is 3.0 Phil

Hi, We have started rolling out Yosemite this week (10.10.2) and an employee mentioned that he can't use new the extensions features like the calculator widget in the today bar and the share menu in safari (It displays No Service). The default extensions simply aren't available in System Preferences. The extensions tab however is accessible. After some testing I came to the conclusion that this behaviour occurs when I set access restrictions in System Preferences and push the Configuration profile at a user level to the device. Even when I don't block anything (just select the payload) the extensions aren't there. The only two things that I want to block are the Profiles and Sharing tab. Anyone else on this? We are running the latest Casper version (9.65). Cheers