Hi Folks, I have written a launchdaemon and I believe it is executing on first boot. However, I would like to wait until the second boot, as first boot after Casper Imaging, Casper is running its own tasks and I suspect the system is being restarted before my tasks are complete. How do I detect Casper's post-boot activity to avoid this conflict? Here is the code of my launchdaemon. I called it com.orgname.firstboot instead of my actual institution's name just for illustration here. [Edited this post and removed LaunchOnlyOnce switch. I got some excellent feedback on that already.] <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict> <key>Label</key> <string>com.orgname.firstboot</string> <key>Disabled</key> <true/> <key>

Has anyone else seen the new Office 14.4.5 update quit out of Google Chrome without warning? I just added the Microsoft distributed package directly to Casper Admin and created a policy to push out on the recurring trigger. As soon as it begins, without warning, it quits out of Google Chrome and Microsoft Office Apps. Office makes sense, but Chrome? Is there some sort of integration between the two applications now that I am unaware of? Thank you in advance

I am using the JSS ability to create configuration profiles a lot. I push them over the air and it simply works.Now I have some machines not connected to the internet - not reachable by APN.I tested using the "download" button from the JSS` configuration profiles GUI. The downloaded .mobileconfig I installed with "profiles -I -F /path". It looked good - the profiles show up as they should. They are also device profiles as they should, but strangely enough they do not work!e.g. I tested a simple .plist: com.microsoft.office 14/FirstRun/SetupComplete=1 It is the same payload generated with JSS but one time OTA - one time downloaded and manual installation.Thank you for your thoughts!

Maybe I'm just not seeing the forrest through the trees, but I can't find the options for restricting software for specific users as we used to. (All my old settings still show up based on user accounts). But all i see for scope/targets are computer/computer groups/buildings/departments. Am I losing my mind or have users been removed as an option? If it can still see my old rules for scoping to various user names then the feature must still exist. Gabe ShackneyPrinceton Public Schools

Has anyone made the changes to the Palo Alto Wirelurker detector script so it can be used as a Extension Attribute? Thanks.

I'm wondering if anyone has any experience creating a redirect for "~/Library/Application Support" and whether or not this redirect would negatively impact anything. My assumption is that I would create a configuration profile with custom settings: Preference Domain:com.apple.MCXRedirector Property List File:{LogoutRedirection=[{action=deleteandCreateSymLink, destPath=/tmp/%@/Library/Application Support, path=~/Library/Application Support}], LoginRedirection=[{action=deleteAndCreateSymLink, destPath=/tmp/%@/Library/Application Support, path=~/Library/Application Support}]} If anyone has a better suggestion (or a warning of why not to do this), I'd love to hear it. Also, if anyone can convert that to a plist file for me I'd be appreciative. Thanks!

We are attempting to put our "site licensed" version of Inspiration 9 on Self Service(9.6) so we can make available for our students. I made a package and a .dmg with Casper Composer(9.6) but both failed. I punched in all of the "serial numbers" on the package creation, as well. Any ideas how I can get this to work? Has anyone else attempted to put this application on Self Service?

I recently upgraded to 9.4. One of the more annoying problems is when you search computers and put in a partial name. For example, "A103" to show a list of computers that have "A103" in the name, like A103A1, and so on. Casper reports 'No results found'. I have to clear the search field and click Search which gives me all computers in the JSS, then sort them and scroll and scroll until I find the one I want. This is using the web interface to the JSS, under the Search inventory > section. Presumably this is an easily fixed bug. Just add % signs around the search term and use LIKE. ;)

Hi All, If you're using the open-source Ruby gem I presented at JNUC 2014, please note that once you upgrade to Casper 9.61, the current version of the gem (0.5.5) will error out when it tries to connect to the Casper API. The reason is that Casper 9.61 addresses the "Poodle" SSLv3 security exploit by disabling support for SSLv3. I'll be pushing out a new version to address this soon, but there's a caveat: The fix requires a newish version of the ruby rest-client gem, which itself is only compatible with Ruby v1.9.2 and higher This means that using the jss-api gem with Casper 9.61 and higher will not work if you're still using Ruby 1.8.7 (Apple provided only Ruby 1.8.7 until Mavericks, which has both 1.8.7 and 2.0.0. Yosemite has only 2.0.0) Please let me know if you have any questions. I'll update this thread when I push the fix to jss-api, along with notes about how to update it and how to install the older version if needed. Cheers,-Ch

Hi all, So I'm working on a policy to run when no user is logged into their machine. We run 24 hours here and desks are randomly filled. I have the logic of determining if a user is logged in or not already handled via a shell script. What I need, is some way to determine if a script should run or not depending on the result of the script *in real time*. I can run this as an extension attribute, but those only update at specific intervals. Smart groups are also dependent on the recon. I was thinking about doing this via a cron or something else outside of JSS, but I'd prefer to keep it inside the JSS and it's framework if at all possible. Any suggestions? Perhaps a feature set I'm overlooking or somewhere where somebody has already done something similar?

So for one reason or another (usually an OS update) our users will lose their saved password to our private network and end up on our public network. This means they can't print, access internal resources, etc. I'm trying to come up with a way to put something in Self Service that will get them back on our private network. Our JSS is externally facing, but not our Casper share so I was trying to do something that could utilize the Files and Processes > Execute Command policy on. I was trying to use the "networksetup -addpreferredwirelessnetworkatindex" command because in one line I could get the wireless network in and make sure it was at the top of the preferred list...and I could do this without a script, and therefore without a share. However, I've been unable to get it to work. Does this not work in Yosemite anymore? Any other thoughts on how I can accomplish this? Thanks for any help!

I know I misspelled "Lossing"....dang it..... We are experiencing a situation where our new MBA fail to keep the same IP address after we deployed them this last week. They continually receive an error message about someone else using their IP address. I used a policy that ran after the image was completed to add the local Wifi connection information. However, now I am wondering if this policy could be causing this issue that we are facing. We have been able to track down a "rouge" device that is "acquiring" between 75 - 100 of our IP address at the same time. Our IT dept. has cleared all of the old IP address from 2009 MB that are no longer in circulation, but we continue to have the same issue. Could a policy I created and placed on each of the laptops create this issue? If not, any ideas on how to find a rouge device that "steals" your IP address? Anyone have any ideas? 13' MBA Early 2014OSX 10.9.4JSS 9.3

8.73 here with no experience running encryption yet, version 9 upgrade imminent. If I had to start encrypting laptops now with our 8.73 JSS, are there any areas of interest or concern when we upgrade to 9.x in a month or two? The process of key creation, configuration a deployment appear mostly the same as best I can tell from the white papers.

Currently we are using casper to control student iPads into focus for teachers. The issue we are starting to see more often is casper focus will completely close out back to the home screen. It is random, although mostly crashing at the start of it loading. We have uninstalled the app multiple times, rebooted after uninstalling it and installed. Only thing we have not done as of yet as we had a short time to look at it is reload the iPad itself. The version we are using is 9.6, on iPad versions 8.0.2 and 7.1.2, both crashing the same way.Also we are running jss 9.52 Has anyone else encountered this issue, and have possible ideas to fix this? Thanks!

Hi everyone, Is anyone else out there testing BYOD MDM on any android devices? I've tested it a few times but hit some road blocks with getting divide to work correctly. I was just curious is anyone else has tried. Let me know if you like it or hate it or don't think I should bother.

Does anyone know how to do folder redirection of a users Documents and Pictures folders to a folder in Google Drive if it is installed? I'm thinking of creating a symlink via script but I wanted to know if anyone has a method that has worked for them.

I've got a CentOS VM (yes, I know, not actually supported) with JDS installed. When I try to enroll with the JSS, I get this error in the log: 2014-09-27 02:13:34,352 INFO Creating configuration file for https://casper.lynda.com:8443/ 2014-09-27 02:13:34,932 INFO Starting Enrollment 2014-09-27 02:13:34,939 ERROR Communication error with the JSS 2014-09-27 02:13:34,939 ERROR (77, 'Problem with the SSL CA cert (path? access rights?)') Traceback (most recent call last): File "<string>", line 1143, in _perform error: (77, 'Problem with the SSL CA cert (path? access rights?)')

Hi All, I have a policy that runs on logout that runs a script to delete all users except the local admin user. I thought this was working fine but I was told by some students that there work was still there when they logged back into the machine. I went back and checked the logs and it indeed shows the policy as failing. Here is the script that runs: for dir in /Users/* do if [ ! "$dir" = "/Users/admin" ] && [ ! "$dir" = "/Users/viscom" ] && [ ! "$dir" = "/Users/Shared" ] ; then echo ${dir} rm -R $dir dscl . -delete $dir fi done exit 0 The error that is showing in the log: Executing Policy Delete User Script...Running script Delete User on Logout...Script exit code: 0Script result: /Users/pereve DS Error: -14009 (eDSUnknownNodeName) delete: Invalid Path Any help would be greatly appreciated as I am not very well versed in this. Thanks,Pete

Is there a way to have programs only show up in Self Service if the program is not currently installed? Here is what I have tried so far: I created a smart group for computers that did not have Firefox. Made a policy for Firefox to be in the self service store (scoped to the new smart group). Firefox appeared properly. I than uninstalled Firefox and waited for the next check-in, but Firefox did not reappear. I than forced an inventory update on the computer but Firefox still did not reappear. I know I could flush the policy from the computer to make it show up, but I am looking for a way to automate it.

Team, Im trying to run the following script but Im caught in a catch 22 lol. #!/bin/sh ####### MDM fix ####### This script will delete all Profiles from the computer #### Than re-enroll in MDM management #### Than remove Earth from preferred wireless network list ####################### ##### Variables #####loggedinuser=ls -l /dev/console | awk '{print $3}'hardwareport=networksetup -listallhardwareports | perl -p -e 's/ / /' | grep -Eo 'Wi-Fi Device: en[0-9]' | awk '{ print $3}' ##### Delete Profiles ### profiles -R -p Identifier ##### Re-enroll in MDM Management ### jamf managesleep 30 #### Re-assigns Identity for Earth to new user cert and removes PEAP Auth #### security delete-generic-password -l "Earth"security set-identity-preference -c $loggedinuser -s com.apple.network.eap.user.identity.wlan.ssid.Earth rm -f /private/var/tmp/profilefix.sh Here are the steps: Remove MDM profilesRe-enforce MDM management Re-associat

How much bandwidth and/or system resources does running the update inventory policy take up? Are there concerns about the frequency you set? Does Casper have the ability to schedule hardware inventory and software inventory separately?

Hi All, The network home folder shows as a questions mark on the dock on my Yosemite clients.I tried re-doing my config profiles as I upgraded my JSS to 9.6 to no avail. I also tried excluding Yosemite clients from the config profile but with the same result.I tried removing the JSS framework manually, logged off/ log in and the Network home folder was back on the dock.I then re-enrolled the machine using Recon, log off/log in and it was back to a question mark. Anyone have any ideas? I don't have any other config profile in place, just the normal policies. Is this a bug on 9.6? Thanks in advance. Erwin

Read a great article by @rtrouton on multiple methods to set the background picture. I ran through the one to replace the desktopbackground.db file and was curious if there is a way to get it to take affect without needing to logout/logon. Any ideas?

Hey all, I'm running into some issues with how Casper handles FileVault 2 encryption, and I'm hoping the community can provide some suggestions. I'll list them in order of which I'd like to get resolved first: Macs enrolled (either via Imaging or QuickAdd) do not seem to reliably report their inventory information back to the JSS. Hardware, OS info, Applications and the such all appear to be reported accurately, but a Smart Computer Group with the criteria "FileVault 2 Partition Encryption State is Encrypted or FileVault 2 Partition Encryption State is Encrypting" is always empty as the partition encryption state always becomes "Unknown" once encryption has finished. However, I can still see the recovery key under the management tab for systems that have successfully encrypted via the JSS. The goal here is to have an ongoing policy to enable FV2, unless the computer is a part of the "already encrypted" smart group. In our environ

Recently we removed all student storage and network home folders from our SAN. We now point all student AD account home folders to an empty (or NULL) path. Since this change, all new mobile accounts on devices show with a blank (finder and self service only) dock. The default dock itself does not even load. I am under the impression that this is due to the change on the AD side, and the mac not finding the data it was looking for in the NULL directory. Anyone know an easy way (without replacing student home folders) to solve this issue? While I do not mind showing users how to populate their own docks, it would be far easier to have the default dock load for the younger children.