Team, Im trying to run the following script but Im caught in a catch 22 lol. #!/bin/sh ####### MDM fix ####### This script will delete all Profiles from the computer #### Than re-enroll in MDM management #### Than remove Earth from preferred wireless network list ####################### ##### Variables #####loggedinuser=ls -l /dev/console | awk '{print $3}'hardwareport=networksetup -listallhardwareports | perl -p -e 's/ / /' | grep -Eo 'Wi-Fi Device: en[0-9]' | awk '{ print $3}' ##### Delete Profiles ### profiles -R -p Identifier ##### Re-enroll in MDM Management ### jamf managesleep 30 #### Re-assigns Identity for Earth to new user cert and removes PEAP Auth #### security delete-generic-password -l "Earth"security set-identity-preference -c $loggedinuser -s com.apple.network.eap.user.identity.wlan.ssid.Earth rm -f /private/var/tmp/profilefix.sh Here are the steps: Remove MDM profilesRe-enforce MDM management Re-associat

How much bandwidth and/or system resources does running the update inventory policy take up? Are there concerns about the frequency you set? Does Casper have the ability to schedule hardware inventory and software inventory separately?

Hi All, The network home folder shows as a questions mark on the dock on my Yosemite clients.I tried re-doing my config profiles as I upgraded my JSS to 9.6 to no avail. I also tried excluding Yosemite clients from the config profile but with the same result.I tried removing the JSS framework manually, logged off/ log in and the Network home folder was back on the dock.I then re-enrolled the machine using Recon, log off/log in and it was back to a question mark. Anyone have any ideas? I don't have any other config profile in place, just the normal policies. Is this a bug on 9.6? Thanks in advance. Erwin

Read a great article by @rtrouton on multiple methods to set the background picture. I ran through the one to replace the desktopbackground.db file and was curious if there is a way to get it to take affect without needing to logout/logon. Any ideas?

Hey all, I'm running into some issues with how Casper handles FileVault 2 encryption, and I'm hoping the community can provide some suggestions. I'll list them in order of which I'd like to get resolved first: Macs enrolled (either via Imaging or QuickAdd) do not seem to reliably report their inventory information back to the JSS. Hardware, OS info, Applications and the such all appear to be reported accurately, but a Smart Computer Group with the criteria "FileVault 2 Partition Encryption State is Encrypted or FileVault 2 Partition Encryption State is Encrypting" is always empty as the partition encryption state always becomes "Unknown" once encryption has finished. However, I can still see the recovery key under the management tab for systems that have successfully encrypted via the JSS. The goal here is to have an ongoing policy to enable FV2, unless the computer is a part of the "already encrypted" smart group. In our environ

Recently we removed all student storage and network home folders from our SAN. We now point all student AD account home folders to an empty (or NULL) path. Since this change, all new mobile accounts on devices show with a blank (finder and self service only) dock. The default dock itself does not even load. I am under the impression that this is due to the change on the AD side, and the mac not finding the data it was looking for in the NULL directory. Anyone know an easy way (without replacing student home folders) to solve this issue? While I do not mind showing users how to populate their own docks, it would be far easier to have the default dock load for the younger children.

I'm having a hard time creating a smart group to push the latest Flash player version.All I want to do is create a smart group to the clients are missing the version installer I created and the "and/or" "is/is not" "like/not like" is confusing me. I also don't know how to "future-proof" the smart group... Meaning I dont want a user manually upgraded to a newer version to be downgraded for any reason if I flush history...Can someone please post an example of what a smart group would look like if I wanted all users to missing the latest Adobe Flash 11.5.502.146.I'm new to all this so if something isnt clear please let me know.Thanks for any assistance.

HiI have setup a profile that forces the user to change his local account password every 30 days. This works perfectly fine except for the situation where the machine is in Screensaver in the moment the password change request is initiated. When this is the case the screensaver can't be unlocked with the password and the only solution is to force reboot the machine or connect over ssh and set a new password. Like this it setting is really causing serious problems to the users. Any solutions to this problem?

Is there a way to limit a Self Service item to be visible under a local admin account only? We do not want to require log in to Self Service. I would like licensed applications to be able to be installed by technicians when logged into the local admin account. I have tried to set the policy to Self Service, and set the scope to All Computers with a Limitation to LDAP/Local User with the local admin name selected, but it does not show up when logged in as that user.Thanks!

Hi All - I am currently running an 8.71 JSS environment and would like to test the Mavericks update via self service. I have attempted to use the method that was proven to work for 10.8 - Copy installer local, call installer via policy, and have the user click through the installation options. With the Mavericks install, when the installer launches, i receive a prompt for admin credentials. Has anyone tried this process with Mavericks? I know 9.2 will offer a much more streamlined way to provide self service OS updates, but I am uncertain when I will be able to upgrade our server. Thanks!

Anyone having issues communicating with DEP in JSS recently? Getting errors in contacting https://mdmenrollment.apple.com when trying to make adjustments in PreStage. We had some trouble with our Computer PreStage, and its now gone to mobile devices.

So, working on ad binding in terminal on 10.9.2, though I am not sure flavor would matter that much. Right now I have dsconfigad -add -username "username" -p "password" Now, I am trying to use an admin password my whole group uses, but it does not work. However, mine does. Both have access for joining the domain and if I leave out -p "password", when I hit enter, it asks for the password and it works fine. It just will not work as part of the command. As a test, I changed my password to contain special characters such as @ or $ and it fails now too. Is there a way to allow the password to work with special characters? This will end up being a short script applied to macs after imaging with deploy studio.

We didn't have any issues with OS X 10.8.4 and Casper v. 8.x but now our Config Profiles are not acting as expected. While using Casper Suite 8.x when scoping out Config Profiles, notably the login access level, the groups that could be assigned access was determined by group GUID (as guided by the JSS to provide the groups GUID). Casper 9.11, it seems as it that doesn't make the distinction of GUID or group name. I've tested both and I can't get either to work for allowing certain groups admin access to workstation. From the Login Window Payload (access tab): Login Window WindowOptionsAccessScript Allow The users and groups that can login at this computer User 5EFED968-9B4E-48A0-87AD-83A875682774 D812524D-C03D-4A6A-9F95-B05E08E40A2A The payload has successfully pushed down to test workstations, but it doesn't appear to be applying any setting. We're also scoping admin access to disable restrictions on login, and that seems to be not working wit

So not sure this is the best way to deal with this, but I thought it'd be better than starting a mini event!Last night off the plane I had to do a hard shut down of my MacBook pro and now it won't boot up, I'm recently up to Yosemite and I log in, but then get a progress bar that stops halfway thru. Anyone feel like meeting up here at JNUC to help me fix it? Text me: 919-818-7786 Thanks!

Hi All, For those doing symbolic links from Core Services to Utilities, Screen Sharing and Directory Utility has been moved to the Applications folder. You may want to update your Firstboot scripts. ln -s /System/Library/CoreServices/Applications/Screen Sharing.app /Applications/Utilities/Screen Sharing.appln -s /System/Library/CoreServices/Applications/Directory Utility.app /Applications/Utilities/Directory Utility.app Supressing iCloud still works on first login but the "Send Apple Diagnostics" is still coming up.Any ideas on how to supress that one as well in Yosemite. For anyone who has noticed other changes can you comment below?(scripts, settings, etc..) Thanks.

Hiya, How do you guys tackle a scenario where you have all your machines bound to AD, you keep all the 'User & Location' fields up to date, a user has two machines (desktop & laptop) and you have a policy that runs 'Once per user'? For example, we have a policy that runs once per user which manually triggers a list of preference scripts for when we setup a new machine. However, if this user exists in the JSS it already accepts the fact it has run on their other device when we set it up. The same would likely apply if I changed it to 'Once per week' as it would be like tossing a coin as to what machine the policy will run on once a week. The last option it to set it to on-going but that defeats the purpose. Any ideas on this would be great! Ta

Never mind. Is there not a way to delete posts? :-)

Hallo JAMFnation, Has any one changed their JSS FQDN name ?We are about to move from a Windows Server 2008 R2 to a CentOS 6 server and would like to use a splitdns with a different FQDN name. Does anyone have a checklist that i can use with the things i need to do ? Some information : We run a full JSS which is windows and a limited JSS which is linux. We got 50 OSX and 50 iOS managed clients, the iOS clients i will re-enroll to the new JSS URL how should i handle the OSX clients ?We use self-signed certificates and PKI. ( our AD guy will generate a new certificate for us for the new FQDN )We also use MDM and APN Thanks

Hey guys - We just moved up to 9.32 for Yosemite and Im doing some testing. From what I can see, I have no issues with any of the Casper tools( Composer, Remote, etc.) except for Casper Admin. When I try to launch Casper Admin, I get the following: external image link Anyone else getting this or have any ideas? We are slated to move to 9.6 next week(don't ask me why we went in 2 progressions -_-) Just wondering if this is specific to us, or a possible bug with Yosemite and Casper Admin. Ive already tried re-downloading the applications, and tried using on another machine... Just kind of stumped now

I googled "JAMF Yosemite" and got a link to Make the transition to OS X Yosemite gracefully. Clicking that I got the following error: So is there no graceful transition? It seems when users upgrade, the local accounts get locked out and the only workaround is to rebuild the device. The cached version isn't very helpful either. All it says is that the Casper suite will help in the transition.

We have a manual install of the JSS on Red Hat 6.Our production server is running 9.31 while debug was running 9.32.Upon testing the 9.32 upgrade to 9.52, again using the manual install procedures, we got a failed upgrade. The JSS URL returned a 404 error. We also set up another test from 9.31 just to be sure and experienced the same issue. It seems like there is something missing in the 9.52 manual installer that it expects to be there either on its on or from a previous upgrade. Perhaps we have to go to 9.5 first, then 9.52? Ideas?I'm also waiting on a response from our support contact.

I've just deployed around 80 iPads and quickly found out that each one is asking for an Apple ID user/pass whenever they open apps that were downloaded through Self Service. All of these apps were distributed using the "in house" method to avoid having to have an Apple ID when installing them (I do not want an Apple ID on any of these iPads). However, requesting the Apple ID when a user opens the app completely defeats the purpose. Am I just missing some option somewhere? Is there any way around this issue? Thanks for any help.

It appears that VPP invitations can only be sent to users with JSS accounts. However, we'd like to avoid creating user accounts for everyone in our LDAP. The option to send invitations to users in LDAP does not exist unless a user has been added to the JSS or has been assigned an asset. In order to send out VPP invitations, I will have to manually assign every user in our AD to a device. That isn't helpful. Is there a way to to match machine users to their AD accounts and have the hardware automatically assigned? Also, JAMF does not pull the e-mail address field from AD. It pulls the user logon name and appends the domain. In our case, the internal domain ends in .internal, so JAMF thinks that everyone's e-mail address is: john.doe@example.internal. It never actually looks at the e-mail field for AD, or at least it won't prefer the AD e-mail field over the logon name + domain name format that it keeps so dear. Questions:1.) Is it possible to send invitations to a

Hi folks, Its early days where I am on the Casper front, so as much as I'd like to I can't use it to help me here. I need to create a hidden local admin, I'm fully aware of the script required for this and have that all in place, my one issue is that I really don't want to embed the password as clear text in the shell script. My thoughts are to obstruficate with Platypus, its not 100% secure, but its better. Before I attempt to re-invent the wheel, I thought I'd ask, just in case I've missed a trick. Thanks, j.

I am having issues with Adobe Packages created using Creative Cloud Packager after they have been replicated to other file share distributions points. Essentially permissions to access the pkg files are lost. The actual permissions shows as being the same for other working pkg and dmg files however, somehow the OS will not allow for copying them from the CasperShare. The original files as they exist on the primary distro point work fine. Is there something I am missing. Would anyone have insight into why permissions will fail only on Adobe PKGs upon replication? Edit: The Distro points are AFP