So for one reason or another (usually an OS update) our users will lose their saved password to our private network and end up on our public network. This means they can't print, access internal resources, etc. I'm trying to come up with a way to put something in Self Service that will get them back on our private network. Our JSS is externally facing, but not our Casper share so I was trying to do something that could utilize the Files and Processes > Execute Command policy on. I was trying to use the "networksetup -addpreferredwirelessnetworkatindex" command because in one line I could get the wireless network in and make sure it was at the top of the preferred list...and I could do this without a script, and therefore without a share. However, I've been unable to get it to work. Does this not work in Yosemite anymore? Any other thoughts on how I can accomplish this? Thanks for any help!

I know I misspelled "Lossing"....dang it..... We are experiencing a situation where our new MBA fail to keep the same IP address after we deployed them this last week. They continually receive an error message about someone else using their IP address. I used a policy that ran after the image was completed to add the local Wifi connection information. However, now I am wondering if this policy could be causing this issue that we are facing. We have been able to track down a "rouge" device that is "acquiring" between 75 - 100 of our IP address at the same time. Our IT dept. has cleared all of the old IP address from 2009 MB that are no longer in circulation, but we continue to have the same issue. Could a policy I created and placed on each of the laptops create this issue? If not, any ideas on how to find a rouge device that "steals" your IP address? Anyone have any ideas? 13' MBA Early 2014OSX 10.9.4JSS 9.3

8.73 here with no experience running encryption yet, version 9 upgrade imminent. If I had to start encrypting laptops now with our 8.73 JSS, are there any areas of interest or concern when we upgrade to 9.x in a month or two? The process of key creation, configuration a deployment appear mostly the same as best I can tell from the white papers.

Currently we are using casper to control student iPads into focus for teachers. The issue we are starting to see more often is casper focus will completely close out back to the home screen. It is random, although mostly crashing at the start of it loading. We have uninstalled the app multiple times, rebooted after uninstalling it and installed. Only thing we have not done as of yet as we had a short time to look at it is reload the iPad itself. The version we are using is 9.6, on iPad versions 8.0.2 and 7.1.2, both crashing the same way.Also we are running jss 9.52 Has anyone else encountered this issue, and have possible ideas to fix this? Thanks!

Hi everyone, Is anyone else out there testing BYOD MDM on any android devices? I've tested it a few times but hit some road blocks with getting divide to work correctly. I was just curious is anyone else has tried. Let me know if you like it or hate it or don't think I should bother.

Does anyone know how to do folder redirection of a users Documents and Pictures folders to a folder in Google Drive if it is installed? I'm thinking of creating a symlink via script but I wanted to know if anyone has a method that has worked for them.

I've got a CentOS VM (yes, I know, not actually supported) with JDS installed. When I try to enroll with the JSS, I get this error in the log: 2014-09-27 02:13:34,352 INFO Creating configuration file for https://casper.lynda.com:8443/ 2014-09-27 02:13:34,932 INFO Starting Enrollment 2014-09-27 02:13:34,939 ERROR Communication error with the JSS 2014-09-27 02:13:34,939 ERROR (77, 'Problem with the SSL CA cert (path? access rights?)') Traceback (most recent call last): File "<string>", line 1143, in _perform error: (77, 'Problem with the SSL CA cert (path? access rights?)')

Hi All, I have a policy that runs on logout that runs a script to delete all users except the local admin user. I thought this was working fine but I was told by some students that there work was still there when they logged back into the machine. I went back and checked the logs and it indeed shows the policy as failing. Here is the script that runs: for dir in /Users/* do if [ ! "$dir" = "/Users/admin" ] && [ ! "$dir" = "/Users/viscom" ] && [ ! "$dir" = "/Users/Shared" ] ; then echo ${dir} rm -R $dir dscl . -delete $dir fi done exit 0 The error that is showing in the log: Executing Policy Delete User Script...Running script Delete User on Logout...Script exit code: 0Script result: /Users/pereve DS Error: -14009 (eDSUnknownNodeName) delete: Invalid Path Any help would be greatly appreciated as I am not very well versed in this. Thanks,Pete

Is there a way to have programs only show up in Self Service if the program is not currently installed? Here is what I have tried so far: I created a smart group for computers that did not have Firefox. Made a policy for Firefox to be in the self service store (scoped to the new smart group). Firefox appeared properly. I than uninstalled Firefox and waited for the next check-in, but Firefox did not reappear. I than forced an inventory update on the computer but Firefox still did not reappear. I know I could flush the policy from the computer to make it show up, but I am looking for a way to automate it.

Team, Im trying to run the following script but Im caught in a catch 22 lol. #!/bin/sh ####### MDM fix ####### This script will delete all Profiles from the computer #### Than re-enroll in MDM management #### Than remove Earth from preferred wireless network list ####################### ##### Variables #####loggedinuser=ls -l /dev/console | awk '{print $3}'hardwareport=networksetup -listallhardwareports | perl -p -e 's/ / /' | grep -Eo 'Wi-Fi Device: en[0-9]' | awk '{ print $3}' ##### Delete Profiles ### profiles -R -p Identifier ##### Re-enroll in MDM Management ### jamf managesleep 30 #### Re-assigns Identity for Earth to new user cert and removes PEAP Auth #### security delete-generic-password -l "Earth"security set-identity-preference -c $loggedinuser -s com.apple.network.eap.user.identity.wlan.ssid.Earth rm -f /private/var/tmp/profilefix.sh Here are the steps: Remove MDM profilesRe-enforce MDM management Re-associat

How much bandwidth and/or system resources does running the update inventory policy take up? Are there concerns about the frequency you set? Does Casper have the ability to schedule hardware inventory and software inventory separately?

Hi All, The network home folder shows as a questions mark on the dock on my Yosemite clients.I tried re-doing my config profiles as I upgraded my JSS to 9.6 to no avail. I also tried excluding Yosemite clients from the config profile but with the same result.I tried removing the JSS framework manually, logged off/ log in and the Network home folder was back on the dock.I then re-enrolled the machine using Recon, log off/log in and it was back to a question mark. Anyone have any ideas? I don't have any other config profile in place, just the normal policies. Is this a bug on 9.6? Thanks in advance. Erwin

Read a great article by @rtrouton on multiple methods to set the background picture. I ran through the one to replace the desktopbackground.db file and was curious if there is a way to get it to take affect without needing to logout/logon. Any ideas?

Hey all, I'm running into some issues with how Casper handles FileVault 2 encryption, and I'm hoping the community can provide some suggestions. I'll list them in order of which I'd like to get resolved first: Macs enrolled (either via Imaging or QuickAdd) do not seem to reliably report their inventory information back to the JSS. Hardware, OS info, Applications and the such all appear to be reported accurately, but a Smart Computer Group with the criteria "FileVault 2 Partition Encryption State is Encrypted or FileVault 2 Partition Encryption State is Encrypting" is always empty as the partition encryption state always becomes "Unknown" once encryption has finished. However, I can still see the recovery key under the management tab for systems that have successfully encrypted via the JSS. The goal here is to have an ongoing policy to enable FV2, unless the computer is a part of the "already encrypted" smart group. In our environ

Recently we removed all student storage and network home folders from our SAN. We now point all student AD account home folders to an empty (or NULL) path. Since this change, all new mobile accounts on devices show with a blank (finder and self service only) dock. The default dock itself does not even load. I am under the impression that this is due to the change on the AD side, and the mac not finding the data it was looking for in the NULL directory. Anyone know an easy way (without replacing student home folders) to solve this issue? While I do not mind showing users how to populate their own docks, it would be far easier to have the default dock load for the younger children.

I'm having a hard time creating a smart group to push the latest Flash player version.All I want to do is create a smart group to the clients are missing the version installer I created and the "and/or" "is/is not" "like/not like" is confusing me. I also don't know how to "future-proof" the smart group... Meaning I dont want a user manually upgraded to a newer version to be downgraded for any reason if I flush history...Can someone please post an example of what a smart group would look like if I wanted all users to missing the latest Adobe Flash 11.5.502.146.I'm new to all this so if something isnt clear please let me know.Thanks for any assistance.

HiI have setup a profile that forces the user to change his local account password every 30 days. This works perfectly fine except for the situation where the machine is in Screensaver in the moment the password change request is initiated. When this is the case the screensaver can't be unlocked with the password and the only solution is to force reboot the machine or connect over ssh and set a new password. Like this it setting is really causing serious problems to the users. Any solutions to this problem?

Is there a way to limit a Self Service item to be visible under a local admin account only? We do not want to require log in to Self Service. I would like licensed applications to be able to be installed by technicians when logged into the local admin account. I have tried to set the policy to Self Service, and set the scope to All Computers with a Limitation to LDAP/Local User with the local admin name selected, but it does not show up when logged in as that user.Thanks!

Hi All - I am currently running an 8.71 JSS environment and would like to test the Mavericks update via self service. I have attempted to use the method that was proven to work for 10.8 - Copy installer local, call installer via policy, and have the user click through the installation options. With the Mavericks install, when the installer launches, i receive a prompt for admin credentials. Has anyone tried this process with Mavericks? I know 9.2 will offer a much more streamlined way to provide self service OS updates, but I am uncertain when I will be able to upgrade our server. Thanks!

Anyone having issues communicating with DEP in JSS recently? Getting errors in contacting https://mdmenrollment.apple.com when trying to make adjustments in PreStage. We had some trouble with our Computer PreStage, and its now gone to mobile devices.

So, working on ad binding in terminal on 10.9.2, though I am not sure flavor would matter that much. Right now I have dsconfigad -add -username "username" -p "password" Now, I am trying to use an admin password my whole group uses, but it does not work. However, mine does. Both have access for joining the domain and if I leave out -p "password", when I hit enter, it asks for the password and it works fine. It just will not work as part of the command. As a test, I changed my password to contain special characters such as @ or $ and it fails now too. Is there a way to allow the password to work with special characters? This will end up being a short script applied to macs after imaging with deploy studio.

We didn't have any issues with OS X 10.8.4 and Casper v. 8.x but now our Config Profiles are not acting as expected. While using Casper Suite 8.x when scoping out Config Profiles, notably the login access level, the groups that could be assigned access was determined by group GUID (as guided by the JSS to provide the groups GUID). Casper 9.11, it seems as it that doesn't make the distinction of GUID or group name. I've tested both and I can't get either to work for allowing certain groups admin access to workstation. From the Login Window Payload (access tab): Login Window WindowOptionsAccessScript Allow The users and groups that can login at this computer User 5EFED968-9B4E-48A0-87AD-83A875682774 D812524D-C03D-4A6A-9F95-B05E08E40A2A The payload has successfully pushed down to test workstations, but it doesn't appear to be applying any setting. We're also scoping admin access to disable restrictions on login, and that seems to be not working wit

So not sure this is the best way to deal with this, but I thought it'd be better than starting a mini event!Last night off the plane I had to do a hard shut down of my MacBook pro and now it won't boot up, I'm recently up to Yosemite and I log in, but then get a progress bar that stops halfway thru. Anyone feel like meeting up here at JNUC to help me fix it? Text me: 919-818-7786 Thanks!

Hi All, For those doing symbolic links from Core Services to Utilities, Screen Sharing and Directory Utility has been moved to the Applications folder. You may want to update your Firstboot scripts. ln -s /System/Library/CoreServices/Applications/Screen Sharing.app /Applications/Utilities/Screen Sharing.appln -s /System/Library/CoreServices/Applications/Directory Utility.app /Applications/Utilities/Directory Utility.app Supressing iCloud still works on first login but the "Send Apple Diagnostics" is still coming up.Any ideas on how to supress that one as well in Yosemite. For anyone who has noticed other changes can you comment below?(scripts, settings, etc..) Thanks.

Hiya, How do you guys tackle a scenario where you have all your machines bound to AD, you keep all the 'User & Location' fields up to date, a user has two machines (desktop & laptop) and you have a policy that runs 'Once per user'? For example, we have a policy that runs once per user which manually triggers a list of preference scripts for when we setup a new machine. However, if this user exists in the JSS it already accepts the fact it has run on their other device when we set it up. The same would likely apply if I changed it to 'Once per week' as it would be like tossing a coin as to what machine the policy will run on once a week. The last option it to set it to on-going but that defeats the purpose. Any ideas on this would be great! Ta