I'm looking to configure all of our software deployments and updates done via policies to be managed via Smart Computer Groups. The policy would be set to ongoing and the group would essentially be telling the policy whether to do something or not. We're running 9.6 and in trying to work with the groups I can configure a group to check for systems that don't have a particular piece of software and a group to check if a system needs an updated version but when I try to combine that into one group, I'm having trouble making that work. Has anyone done this? Yes, I could setup and use the two groups but I was hoping to reduce the number of groups. We have a number of different apps so the more we can keep the number of groups down, the better.

Is there a way to filter across multiple logs to check the status on a certain computer across multiple policies? For example, I have many policies running and I want to quickly see what policies have completed, failed or have not yet completed on one particular machine without going into each individual policy.

Just curious what others experiences are! :) Thanks!

We collect an extension attribute to display browser versions for Firefox, Chrome and Safari. I'd like to create a Self Service policy so users can determine their browser versions in a single pop-up window (either jamfhelper or Cocoa Dialog). Anybody have something like this they'd like to share?

? [D-006627] When restarting a computer that has been imaged using Casper Imaging, the computer fails to enroll if attempting to connect to the JSS via an Apple Thunderbolt to Ethernet Adapter This seems like a pretty major bug. What's everyone doing for a work around?

I just upgraded from 9.31 to 9.5 and apparently Self Service no longer parses HTML in the description field. Just wondering if anyone has a workaround or if support for HTML has just been removed altogether.

In previous version of OS X, I was able to edit the /Library/Preferences/com.apple.dockfixup.plist file to remove any persistent dock apps that I did not want in the dock for newly created users. Items like iBooks and Maps are not necessary for us. In Yosemite, I no longer see the com.apple.dockfixup.plist file. It's replaced with a file called com.apple.dock.plist. When I look at that file, I see the following: 1 entry called: DesktopAdminImageGenerationNumber ( this is a Dictionary class)It has another key called: GenerationNumger with a string of 2 Not sure what any of this means. I also tried editing the default plist located in the dock application: System/Library/CoreServices/Contents/Resources/en.lproj/default.plist Still no good. iBooks and Maps still show in the dock. Any thoughts would be greatly appreciated. Thanks Keith

I have a cocoadialog script that runs after a package is installed. So, when i have the latest java is installed/updated, a bubble will appear for the user notifying them that Java has been installed/updated. The problem i run into on occasion is that the package fails to install but the script runs anyway. Is there any way around this without having multiple policies and smart groups? Here's a feature request for this that i've created:https://jamfnation.jamfsoftware.com/featureRequest.html?id=2107

Has anyone deployed VMware Fusion 6.0.2 on a Mavericks environment? I read through the documentation provided by JAMF yet it was publish at 2009. The paths mentioned in the documentation doesn't match the current VMWare. I was successfully able to create the VMware Fusion app bundle with our volume license. Created this as a package in Casper Admin. I also was able to create a VMware image that sits under /Users/Shared/Virtual Machines and made a package. The only area where I can't get around is the VMWare App Settings to kick in. Its basically the preference file that indicates VMware that the image file is located under /Users/Shared/Virtual Machines. I dropped the /Users/~/Library/Preferences/com.vmware.fusion.plist and VMware Fusion file into composer, verified the permissions, created a dmg package, uploaded it to my distribution point, set the options to FUT & FEU. When I create a policy and add all 3 packages VMware App, Image and Settings packages all w

Student set a passcode and turned off WiFi. The device is supervised and running iOS 8.1. When it is plugged into a computer, iTunes will not connect to it until the passcode has been entered. I'm open to wiping it, but not sure how to make that happen without WiFi or iTunes.

Hi, For a department I need to run the Wirelurker script i found in this topic: https://jamfnation.jamfsoftware.com/discussion.html?id=12494 This is a python script. I need to download the script via a curl -O command, and then run it with python. Locally on my Mac this is no problem but I want to automate this in JSS if possible. I want to make a smart computer group to see whether or not an infection has been found.I know I can run scripts in JSS, but I havent found the best way to do it for this particular script. I don't want the user to be able to do this via self service. Hope somebody can put me on the right track. Any help is greatly appreciated.

Has anyone had problems removing Configuration Profiles manually (using the profiles command from Terminal) on machines upgraded from Mavericks to Yosemite? Apple is telling me that the error I'm receiving is due to the profiles that are pushed via the JSS have PayloadRemovalDisallowed set to true and no password which apparently prevents the removal of these profiles manually in 10.10. I've also noticed that my fresh Yosemite machines are not deploying Configuration Profiles at all so this may be related. I'm on JSS 9.2.

Hi all, I'm working on a script that will pop up a dialog using the standard AppleScript dialog box to the user to prompt for installing software updates. This script works perfectly fine if run locally (sudo ./SUSUpdate.sh) or if I run it using a custom trigger (sudo jamf policy -trigger SUSUpdate). But when it runs in a recurring check-in trigger, the dialog box fails to display and an AppleScript error is thrown. Here's the section of the script that's throwing the error: prompt=`sudo osascript << EOT tell app "System Events" Activate display dialog "A critical update for your computer - $ForceUpdateRequired - addresses a significant security vulnerability and needs to be installed. Do you want to install it now?" with title "Software Update Required" buttons {"Not Now", "Install"} default button 1 with icon file "Library:Application Support:JAMF:bin:Software

Can anyone explain precisely what this profile management setting does precisely? I understand that if you enforce FileVault encryption though profile manager you need to use this, but will it redirect a recovery key of an already encrypted machine to the JSS?

Hey everyone! My job wants to send me off for some training in something/anything I'm interested in. I'm trying to figure out what I want and I'm asking for your suggestions. Some day I want to make iOS apps/games and I know Objective-C is the way to go. I'm not sure if Objective-C is really pertinent to my job as a Mac admin though. Maybe a Python class would be the most useful. I'm okay with shell scripting but could always learn more. What do you think I'd benefit from the most? - Jamie

Hi Folks, I have written a launchdaemon and I believe it is executing on first boot. However, I would like to wait until the second boot, as first boot after Casper Imaging, Casper is running its own tasks and I suspect the system is being restarted before my tasks are complete. How do I detect Casper's post-boot activity to avoid this conflict? Here is the code of my launchdaemon. I called it com.orgname.firstboot instead of my actual institution's name just for illustration here. [Edited this post and removed LaunchOnlyOnce switch. I got some excellent feedback on that already.] <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict> <key>Label</key> <string>com.orgname.firstboot</string> <key>Disabled</key> <true/> <key>

Has anyone else seen the new Office 14.4.5 update quit out of Google Chrome without warning? I just added the Microsoft distributed package directly to Casper Admin and created a policy to push out on the recurring trigger. As soon as it begins, without warning, it quits out of Google Chrome and Microsoft Office Apps. Office makes sense, but Chrome? Is there some sort of integration between the two applications now that I am unaware of? Thank you in advance

I am using the JSS ability to create configuration profiles a lot. I push them over the air and it simply works.Now I have some machines not connected to the internet - not reachable by APN.I tested using the "download" button from the JSS` configuration profiles GUI. The downloaded .mobileconfig I installed with "profiles -I -F /path". It looked good - the profiles show up as they should. They are also device profiles as they should, but strangely enough they do not work!e.g. I tested a simple .plist: com.microsoft.office 14/FirstRun/SetupComplete=1 It is the same payload generated with JSS but one time OTA - one time downloaded and manual installation.Thank you for your thoughts!

Maybe I'm just not seeing the forrest through the trees, but I can't find the options for restricting software for specific users as we used to. (All my old settings still show up based on user accounts). But all i see for scope/targets are computer/computer groups/buildings/departments. Am I losing my mind or have users been removed as an option? If it can still see my old rules for scoping to various user names then the feature must still exist. Gabe ShackneyPrinceton Public Schools

Has anyone made the changes to the Palo Alto Wirelurker detector script so it can be used as a Extension Attribute? Thanks.

I'm wondering if anyone has any experience creating a redirect for "~/Library/Application Support" and whether or not this redirect would negatively impact anything. My assumption is that I would create a configuration profile with custom settings: Preference Domain:com.apple.MCXRedirector Property List File:{LogoutRedirection=[{action=deleteandCreateSymLink, destPath=/tmp/%@/Library/Application Support, path=~/Library/Application Support}], LoginRedirection=[{action=deleteAndCreateSymLink, destPath=/tmp/%@/Library/Application Support, path=~/Library/Application Support}]} If anyone has a better suggestion (or a warning of why not to do this), I'd love to hear it. Also, if anyone can convert that to a plist file for me I'd be appreciative. Thanks!

We are attempting to put our "site licensed" version of Inspiration 9 on Self Service(9.6) so we can make available for our students. I made a package and a .dmg with Casper Composer(9.6) but both failed. I punched in all of the "serial numbers" on the package creation, as well. Any ideas how I can get this to work? Has anyone else attempted to put this application on Self Service?

I recently upgraded to 9.4. One of the more annoying problems is when you search computers and put in a partial name. For example, "A103" to show a list of computers that have "A103" in the name, like A103A1, and so on. Casper reports 'No results found'. I have to clear the search field and click Search which gives me all computers in the JSS, then sort them and scroll and scroll until I find the one I want. This is using the web interface to the JSS, under the Search inventory > section. Presumably this is an easily fixed bug. Just add % signs around the search term and use LIKE. ;)

Hi All, If you're using the open-source Ruby gem I presented at JNUC 2014, please note that once you upgrade to Casper 9.61, the current version of the gem (0.5.5) will error out when it tries to connect to the Casper API. The reason is that Casper 9.61 addresses the "Poodle" SSLv3 security exploit by disabling support for SSLv3. I'll be pushing out a new version to address this soon, but there's a caveat: The fix requires a newish version of the ruby rest-client gem, which itself is only compatible with Ruby v1.9.2 and higher This means that using the jss-api gem with Casper 9.61 and higher will not work if you're still using Ruby 1.8.7 (Apple provided only Ruby 1.8.7 until Mavericks, which has both 1.8.7 and 2.0.0. Yosemite has only 2.0.0) Please let me know if you have any questions. I'll update this thread when I push the fix to jss-api, along with notes about how to update it and how to install the older version if needed. Cheers,-Ch

Hi all, So I'm working on a policy to run when no user is logged into their machine. We run 24 hours here and desks are randomly filled. I have the logic of determining if a user is logged in or not already handled via a shell script. What I need, is some way to determine if a script should run or not depending on the result of the script *in real time*. I can run this as an extension attribute, but those only update at specific intervals. Smart groups are also dependent on the recon. I was thinking about doing this via a cron or something else outside of JSS, but I'd prefer to keep it inside the JSS and it's framework if at all possible. Any suggestions? Perhaps a feature set I'm overlooking or somewhere where somebody has already done something similar?