Can anybody offer any insight as to how to go about scripting Keychain First Aid? I would like to add it as a Self Service Policy to repair keychain issues. Thanks!

So, we have a client that is going to be using "Foundstone" software to scan Macs/PC's for vulnerabilities. The client needs to be setup with a hidden account which is a normal user given SSH rights in order to scan/report on software, etc. One of the requirements is to leave the firewall on while turning off Stealth Mode - easy enough. sudo defaults write /Library/Preferences/com.apple.alf stealthenabled -int 0 The problem is that after flipping the Stealth Mode off, we can not get the ability to ping - and therefore scan the Macs - until after a reboot. We tried all sorts of things suggested here and elsewhere to get this to work, and so far, only a reboot does the trick. We're testing on 10.10.2/.3 at the moment and will likely have to run this on all the Macs going back to 10.6. I've love to find a way to get this setting flipped and not require a reboot as the client is highly averse to such things (don't ask). We've tried flipping this o

I know that this has been asked many ways but not sure how to do this specifically. I have 2 admin accounts on each machine. They are both added with the quick add package and I have have a script that regularly checks for and re adds the secondary account. The secondary(non casper management account) is actually the one that gets manually added on original images. I need to change that password.. How should I change the password or what is the best method.

Seeing some strange errors appearing when trying to use AutoCasperNBI with Casper 9.65. trying to create the NBI on a I7 iMac with a 1TB Fusion drive OS 10.10.2 we get the following in the logs: Thu Feb 26 10:55:22 AEDT 2015 NetBoot Name: 10.10.2.AutoCasperNBIThu Feb 26 10:55:22 AEDT 2015 Trying to get JSS versionThu Feb 26 10:55:23 AEDT 2015 Received JSS versionThu Feb 26 10:55:23 AEDT 2015 Checking JSS Version from https://<server>:8443/Thu Feb 26 10:55:23 AEDT 2015 JSS is: 9.65Thu Feb 26 10:55:23 AEDT 2015 Pre-Reqs met, Options & Build enabled.Thu Feb 26 10:55:23 AEDT 2015 NetBoot description enabledThu Feb 26 10:55:23 AEDT 2015 NetBoot description set to 'Mac OS 10.10.2 (14C109) with Casper Imaging 9.65 pointing to JSS https://<server>:8443/. Created by, <user> on: Thursday, 26 February 2015.'Thu Feb 26 10:55:26 AEDT 2015 Selected path to create .nbi is: /Users/<user>/Desktop/Thu Feb 26 10:55:26 AEDT 2015 Trying to get the Total size of '

Does anyone know of a way to prevent OS from checking for/receiving software updates? We're having a problem with 10.9.5 iMacs that are connected to external AV systems (these are iMacs set up in classrooms). After both 2015 security updates the on-board graphics freeze and require the mini-display port dongle to be disconnected and reconnected for the iMac display to "unfreeze." Essentially, I'm tired of re-imaging the machines once a week. Upgrading to Yosemite is currently not an option (that's Apple's official advice). I'm wondering if I can set a configuration profile to point at a nonexistent SUS to "prevent" any updates, but I don't know if this will just cause it to fail over to Apple's SUS. I have confirmed that a base 10.9.5 without the 2015 security updates do not have the frozen display issue and relayed this to Apple (who's stuck in the "upgrade to Yosemite" rut). Any ideas are greatly appreciated

Hi -- We are in the process of consolidating our Exchange environments to one. Part of that requires updating settings in outlook. I was successful in getting the Win side updated, but am having a hard time finding a tool to do this on the mac side. Essentially, the URL is changing from mail.company1.edu to mail.company2.edu. The users mail has been mirrored in both environments. Any help is greatly appreciated!!

I'm using a launch daemon based script to create a mount point and use "mount -t smbfs" to mount a common DFS share. The script works fine, however the issue I'm encountering is. The first user to login after imaging creates the mount point the permissions on the directory are preventing subsequent users who login from mounting the common DFS share. A number of forum's I've visited all suggest that a logout hook script to umount the share is the way to go. I'd like to stick with local scripts as the next phase will be to modify the script to only Map drives when connected to specific wired/wireless networks. Is there a better way to map the common DFS share?Logout hook's I thought were deprecated. What's the preferred method to run a script at logout/shutdown? Thanks

I am trying to get an LDAP connection setup in JSS to our AD server and I cannot get it to work. I put in the hostname and domain, but on the next step it says failed to verify user account. I've tried two user accounts, both are in good working order, neither locked and one of them was my own which has a decent number of permissions. I have Casper on a linux box. It can ping the domain just fine as well as the specific AD Server I pointed it to. Also of note, we have a domain domain.company.com as well as an alias for the domain "Arbitraryname." If I point it at domain.company.com it says "Please verify the username and password." If I point it to Arbitraryname it doesn't give any errors, just blanks out the password and does not progress. Which permissions does the service account specifically need? Also, our domain is setup with load balancing, so should I just point it to domain.company.com for the host as well as the domain? When you ping do

Hi All, is it possible to query the API for completed status of a policy, Also, is there a way to see/get this information from the JSS mysql database? Thanks

I have a message via jamfhelper that users will see during a policy that runs at logout (shutdown triggers it also, so looks like if a user shuts down instead of logout, its the same as logout).I want to add an icon to the message, jamfhelper has the -icon argument that lets me do that. Testing the script locally with the icon in the same directoy works, so now I want to add the script and image to the JSS, but where would I put the image file? my file share distribution point is casperlocal/jssdist. where are the scripts stored? would i put the image in the same directory as these scripts?

Alright, I've run into a pretty big problem here. I have ~10,000 devices enrolled in the JSS. As of right now I have less than 24 hours to renew my Push Certificate or it will expire and everything will fall apart. The only problem is that our old director who made the Cert is no longer with us. I've exhausted my resources to find out which Apple ID it was and now I'm running out of time. Would I be able to cache a quick add package, or some other kind of enrollment method today in order to get devices re-enrolled by the user in the event that we need to make a new Push Certificate? Any help is greatly appreciated.

I've been asked to compile a list of the most popular third party applications on Macs with an eye towards adding them to Self Service. I can export a search by application, but since it is by machine, I have no easy way of counting the total number of copies of any given program. Is there a better way to generate a report that I'm missing?

Hi all,I've only started doing some basics with iPads and managed VPP distribution and I just encountered an issue. We bought 2 copies of Proloque2Go via the VPP and chose the managed distribution option not the code download. The ipad I enrolled months ago got the app just fine and it worked properly to install. I just enrolled another ipad and I tried to push the app and the management console is showing:"Apply Redemption Code for Proloquo2Go - Symbol-based AAC" "The redemption code is invalid." Since this is not using a "redemption code" what could be this issue? Thanks for any help! Gabe ShackneyPrinceton Public Schools

Hi everyone, We have a windows file cluster on which we share files through DFS. I use login script to map 4 shares on our OSX machines. This works fine however the names of the shares are all the same (dfs structure names the different shares based on the customer). Changing the share names unfortunatlyisn't an option. On the windows machines this isn't a problem since the shares are assigned different driveletters to differentiate them. I've tried using a applescript mount volume "smb://domain.tld/dfs/service/customer" and a shell script with the mount_smbfs command #!/bin/sh mkdir -p /Volumes/CustomerShareName; mount_smbfs 'smb://domain.tld/dfs/service/customer' '/Volumes/CustomerShareName' However the mounted volumes show up in the finder with the original sharename and can't be renamed. After some researching it seems the only way to achieve what I want is to mount the shares and create an alias so I can display them wit

Is anyone else seeing that the /mach_kernel is unhidden after the Security Update 2015-002 on Mavericks?

I'm new to Casper (6 months), and I can't seem to find a download link on support.apple.com/downloads. Can someone help me out? Is there also a better way of getting the pkg instead of waiting for Appe? Safari 7.14 for Mavericks.

Has anyone been able to successfully put 10.9.x on an Early 2015 Macbook?

I'm converting a law firm from Windows to Mac. Not going to pretend that Outlook on Windows is anything but a giant Rube Goldberg device. :-) Anyway, the users are POPing mail and have multi-gigabyte Outlook mail databases. First choice would be to migrate the mail from these Outlook accounts to Apple Mail. If that's going to be an experience akin to cage fighting then archiving will be fine. What are good ways of archiving Outlook mail to some kind of searchable format that can be stored on the Mac server? Thank you.

creating Adobe acrobat XI pro package for distribution via casper policyi want to combine these 2 feature lockdowns into 1, how do i do it. Not sure on the correct beginning and endings of where to put the <key></key> <dict><dict> in order to combine. I want to control application updates with update pkgs. provided by adobe. here is the website for the 2 feature lockdowns: (lockdown updater, and javascript api alert)http://www.adobe.com/devnet-docs/acrobatetk/tools/MacWiz/lockdown.html I want to combine both into the 1 plist <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>11</key> <dict> <key>FeatureLockdown</key> <dict> <key>bUpdater</key> <false/> </dict></dict></

We are currently running the above script (thank you Rob). This gives us the user field information. It works, mostly. We have 1300 +MBP and I only have 890 users in JSS. When I click on the User tab and search for "todd" for example I only get 1 response. When I click on Computers and search on Local User Accounts I get 4 responses (preferences for both show "contain"). We use Active Directory and the LDAP lookup seems to be working.What am I missing?

I am reaching out in hope that the community can collectively recommend an ideal method of creating a Mavericks Configuration. In the past, we followed @jhalvorson][/url instructions found at: [https://jamfnation.jamfsoftware.com/discussion.html?id=3841. These instructions no longer work w/ Mavericks because the InstallESD.dmg has changed (correct me if I am wrong). Appreciate any advice.

Hi there, We have a fleet of Macbook Airs deployed last September that we are looking to upgrade from Mavericks to Yosemite. This will be our first upgrade of this kind. Problem is, we have not since updated the laptops at all since this deployment due to time restrictions and frankly, lack of workflow knowledge. Context.. Casper 9.32 (to be upgraded to 9.65 beforehand). We have a Software Update Server set up and ready to go. All our clients are pointed to a dummy SUS via config profile, to be pointed to our real SUS when ready. I am seeking some help on a possible workflow to achieve the following: Upgrade from 10.9.4 (no OS updates at all bar those included in 10.9.4) to 10.10.2. In this process I am guessing we also need to install all the relevant Apple updates etc. It would be very much appreciated if someone can work with me briefly to develop a workflow. Thank you!

There was a similar-sounding issue for folks that have upgraded to 9.65, but that issue appears to involve $ signs in passwords. Basically our AD binding policy that has been working flawlesssly for three years just went kaput. We're on 9.61 and have had the binding fail on five machines so far (all in one location). Rebooted servers and laptops, recreated the binding, the log doesn't show an attempt to run the policy. Doesn't work on Mavs or Yosemite. Tried running the policy as a different user. Ideas? I suppose we could upgrade, but we were fine on 9.61 for now. TIA

Hi all I'm trying to create an extension attribute that checks all available network interfaces to see if a proxy is enabled or not, and then use the AE with a policy to disable or enable the proxy dependent on the Mac's building location. At the moment the script i have returns the status of each individual interface and when used as an extension attribute it will only show the status of the last port checked, can anyone advise how i'd get the script to look at all the results then echo "yes" if they are all on and "no" if any of them are off ? <result>on</result><result>on</result><result>on</result><result>off</result><result>on</result><result>on</result><result>on</result> = off and <result>on</result><result>on</result><result>on</result><result>on</result><result>on</result><result>on</re

Ugh - just a heads up to the nation. I went to download Adobe Flash Player 11.5.502.146 today from get.adobe.com/flashplayer, and rather than getting the standard disk image from Adobe, you now get this garbage Google Chrome install option that you have to uncheck, along with the a 'new and improved' Flash Player installer that has to download a payload from the Internet, and will fail if you don't close Safari first before it begins it's install. This is in comparison to a regular DMG you could just click and install in the past (and extract a .pkg from by just examining the contents of the installer executable.) I'm sure now we'll have to figure out where exactly the Adobe Flash Player.pkg package is being installed to and somehow save that, or we'll have to go back to creating Composer snapshots. Thanks Adobe. ~Ted