Just wondering if there is a way to disable 'Find My iPhone' feature on ios devices using profiles or plist? I have seen a lot issues about cannot reactivate ios device after redeployment because find my iphone was not turned off by previous user - we wanted to avoid this.

I'm trying to make the transition from DeployStudio monolithic imaging to Casper imaging (both thin and not). Part of our normal monolithic image with DeployStudio are some LaunchDaemons that live in /Library/LaunchDaemons. I have a couple of questions. First of all, I notice that unless I use a command-line text editor and save the plist directly I always end up with some sort of file attribute (signified by the @ sign below) that I can't seem to clear with chmod -RN. (I put a couple of x characters where our college name normally appears): sh-3.2# ls -latotal 72drwxr-xr-x 11 root wheel 374 23 May 09:31 .drwxr-xr-x+ 71 root wheel 2414 22 May 14:36 ..-rw-r--r--@ 1 root wheel 490 23 May 09:31 ca.xxxcollege.clean-warn.plist-rw-r--r--@ 1 root wheel 481 23 May 09:31 ca.xxcollege.clean.plist-rw-r--r--@ 1 root wheel 383 23 May 09:31 ca.xxcollege.postimage.plist-rw-r--r--@ 1 root wheel 493 23 May 09:31 ca.xxcollege.reboot-warn.plist-rw-r--r--@ 1 root wheel 482 23 Ma

I'm looking to build a clustered instance jss behind a load balancer to improve uptime and scale a new Casper 9 deployment. The last time I did this, I had a networking team and a budget to get F5s in to handle the load balancing, and I could focus on getting the services running; however, this new project has a budget of my time and maybe some leftover coffee in the employee breakroom. Do any of you fine folk have recommendations for free/cheap load balancers and configuring them? Inquiring minds want to know.

We've run into a couple of issues and we're not sure if they're related. Our JSS is version 8.73 and it's running on OS X 10.6.8. First, our Tomcat Website Certificate has gone blank and says Self Signed. If we try to click the link "Replace with certificate from the JSS's built-in CA", we get an error that says "Could not write to /Library/JSS/Tomcat/conf/server.xml". This comes after spending a week or so at the beginning of the month re-issuing new certificates after the OpenSSL fun-times. As far as I can tell, the permissions on /Library/JSS/Tomcat/conf/server.xml are as they should be, although if someone can confirm for me that would be great. The second issue may or may not be related. We're not sure when the certificate issue began, but this issue started last night. All of our policies that download a script or package from the server are failing with the following errors: Downloading https://our.server.com:443//Package

The example below installs our Flash Player package on All Managed Clients. The Smart Computer Group and Policy is created in a way that allows us to re-install Flash Player on systems that have been re-imaged (without flushing the Policy Log) and update all existing clients to a newer version of Flash Player simply by replacing the package on the JSS and updating the Plug-In Version criteria in the Smart Computer Group. Components: +Flash Player.pkg+ Package +deploy_Flash Player+ Smart Computer Group +Install_Flash Player+ Policy Component Details: +**deploy_Flash Player**+, Smart Computer Group Plug-in Title does not have +Flash Player.plugin+ AND Computer Group member of +All Managed Clients+ OR Plug-in Title has +Flash Player.plugin+ AND Plug-in Version is not +13.0.0.206+ AND Computer Group member of +All Managed Clients+ +**Install_Flash Player**+, Policy Trigger: Recurring Check-In Execution Frequency: Ongoing Packages: In

Hello - I am looking to force a logout as part of my Filevault self-service policy configuration. I have done some research and have not found a straightforward way to do this. Any help would be appreciated. Thanks.

Is it possible to create a policy that executes a script when a target machine is removed from a Static Computer Group? For example: I have scoped a policy to install Firefox on any machine placed in a Static Computer Group called "Firefox". However I would like to execute a Script to remove Firefox from that machine in the event that it's ever removed from that group.

I know there probably has been a defect already open for that... but is there anybody who got to thin image fusion or SSD drives properly ? As soon as i try to thin image those drives casper imaging just goes straight through my packages like if it was installing very fast but no packages really installs... If i compile the whole thing it all works fine... works fine also with thin imaging on regular drives

Thought I'd share this for anyone who might find it useful. We have users whose FileVault2-encrypted Macs are backed up with Time Machine to un-encrypted external hard drives. This kind of destroys the point of securing the data on the internal drive, so we're changing our policies to require the external drives to be encrypted. As such I've been working on a way to encrypt the drive and add the password to the user's keychain so that they are not prompted to unlock the drive when it is connected. Eventually I'll work this into Self Service and prompt the user to provide a password. Here's what I have for now: #!/bin/bash #Encrypt Time Machine drive mountPath=`tmutil destinationinfo | grep "Mount Point" | awk -F ": " '{print $2}'` if [ "$mountPath" = "" ] then #Drive not mounted exit 1 fi diskutil cs convert "$mountPath" -passphrase "$PASSWORD" #Add password to u

Not seeing much on it, so I'm assuming it is but I want to make sure there isn't a better method first.

Hi, Running a diskless net boot image 10.9.2 . For some reason when it gets to the block copy of our image (10.9.2) it happens too quickly, just goes through instantly. Anyone seen a similar issue to this?

Hi, I have recently employed the following script to collect user info via AD, a script posted on these forums.#!/bin/sh loggedInUser=/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }' accountType=dscl . -read /Users/$loggedInUser | ?grep UniqueID | cut -c 11- if (( "$accountType" > 1000 )); thenuserRealname=dscl . -read /Users/$loggedInUser | awk '/^dsAttrTypeNative:original_realname:/,/^dsAttrTypeNative:original_shell:/' | head -2 | tail -1 |cut -c 2-userEmail=dscl . -read /Users/$loggedInUser | grep EMailAddress: | cut -c 15-userPosition=dscl . -read /Users/$loggedInUser | grep JobTitle: | cut -c 11-if [[ -z $userPosition ]]; thenuserPosition=dscl . -read /Users/$loggedInUser | awk '/^JobTitle:/,/^JPEGPhoto:/' | head -2 | tail -1 | cut -c 2-fiuserPhone=dscl . -read /Users/$loggedInUser | grep -A 1 PhoneNumber: | tail -1 | cut -c 2-userDepartment=dscl . -read /Users/$loggedInUser | grep "Company:" | cut -c 10-if [[ -z $userDe

A bit off topic - but putting this out there anyway... With 10.6.x the Kerberos Agent would pop up a polite GUI requesting password which could be called from a script as follows: echo '' | sudo -u $user kinit This could be used to automate prompting a user to re-authenticate and preventing ticket expiry. With Kerberos changes in Lion what are others using to prevent ticket expiry/renewal? Thanks, Lisa.

My Mac OS X clients have different errors that I see through the email notifications that are sent to me. Rather than manually resolve each computer, I wanted to have the JSS place the computers with particular errors in specific smart groups so I can use those smart groups to scope specific solutions, e.g., run QuickAdd or jamf enroll at computers with "device signature errors". I would appreciate JAMF Nation's feedback in either tightening the EA's script (I am sure it can be written more efficiently) and/or improving the script's logic. For example, the current iteration of the EA only checks the last 100 lines of the jamf.log for a particular error. My intent with the tail is to try to examine the few days or week's worth of entries so that the error is relatively fresh; I did not want to try to resolve an error that occurred once a few months ago. Thanks in advance. #!/bin/bash $ERROR="" #examples: "connection failure", "device signature error", etc. MATCH=`tail -n 100 /var/

Seems with the 10.9.3 update Apple is hiding the Users folder. I believe Apple had done this by design, but it also could be a bug. I don't see any harm in it as users couldn't see other users files anyway. The only harm is maybe to people who use the "Shared User" folder. Regardless, I wanted to let you all know. If you want to change it back here is a fix below. To ensure the visibility of the /Users folder after restarts, you can create an AppleScript applet, and set it to run when you log in to your Mac. Use the following code: tell application "Terminal"do shell script "chflags nohidden /Users" password "yourpassword" with administrator privilegesend tell Replace “your password” with your user password. Save this as an application, and add it to your login items in System Preferences > Accounts.

We've recently upgraded from 8.73 to 9.3 and have setup a new JDS. Manually instructing Casper Remote and JSS Policies to install via the JDS have proved successful, so we're ready to set the JDS as the master distribution point. However, since setting the JDS as the master in JSS I've found that all of our policies and remote sessions continue to use the classic file share distribution points. Logs show that it doesn't even try to use the JDS. None of these policies have manual distribution point settings. Any ideas on what's wrong?

Hi all, I've been having a hard time trying to find out if this is even possible or not. What I'd like to do is to have Casper use a policy to silently check for and/or update Java in the background, but I can't seem to find any sort of terminal command to accomplish this throughout the interwebs. Is something like this even possible?

Hi.If seen a problem across a lot of our machines that the user we created for management of our machines is visible.We are on 9.24 and used the command "jamf createAccount" with the -hidden option. We also moved the home folder to /private/var/. Any idea how we can ensure the user is hidden? BTW: This also happens when we enroll a new machine with a Quick Add package where the option is set to hide the account... Thanks.

I'm trying to make the switch from a monolithic workflow with DeployStudio to a packaged workflow with Casper, both thin and not. ;) With DS, I used admin autologin and a login script to execute tasks that need to happen on the first boot after DS has finalized the image. I let DS do the binding and my script is there to basically license Adobe Creative Cloud. I have already been using launchd for tasks such as rebooting daily and running a weekly data clean-up script. This is my first time trying to get something to launch once only on the first time the machine is booted. At the moment it is not working. The logic is a little convoluted and I am open to suggestions on how to simplify this. All of my scripts are in /Library/AdminToolBox, a directory I created for such things. My launchd plist looks like this: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/Property

Hi All, Since migrating to v9 in January, we've had issues where the Network Segments are not always using the correct DP.. BUT this seems to be with the JAMF Binary & not the apps as Casper Imaging, Remote & (we think) Self Service all seem to be respecting their defined DP's. We have quite a complicated setup, but here are the Network Segments: External 1.1.1.1 - 255.255.255.255 BCP DMZ 10.1.11.1 - 10.1.11.255 Sunderland 10.1.13.1 - 10.1.13.255 Lakeside Server VLAN 10.1.2.1 - 10.1.2.255 Nottingham 10.1.32.1 - 10.1.33.255 Canterbury 10.1.44.1 - 10.1.44.255 Stockport 10.1.44.1 - 10.1.44.255 Manhattan 10.1.52.1 - 10.1.52.255 Tokyo 10.102.4.1 - 10.102.4.255 New York 10.103.1.1 - 10.103.1.255 Lakeside Wireless 10.110.1.1 - 10.110.2.255 Sunderland Wireless 10.110.13.1 - 10.110.13.255 Nottingham Wireless 10.110.32.1 - 10.110.32.255 Stockport Wireless 10.110.44.1 - 10.110.44.255 Manhattan Wireless 10.110.52.1 - 10.110.52.255 Lak

I can see where to search for it in an Advanced Search, but how do I just display that info? Didn't see a choice in Inventory Display. I'm running 9.3. Thanks!Brian

Annoying not having the ability to cancel uploading or indexing process.I had to force quit Casper Admin last week while uploading a small package that hang casper admin to respond to anything. After I relaunched the casper admin and tried to upload again it says it has the package and need to replace it I click replace, it doesn't even take a second to replace but is it replacing it???? I don't think so the package still on the share even if i try to remove it from the share it says it is being used by other application and can't delete. Deleted from the Casper Admin won't remove it from the share for some reasons.I had to rename the package to be able to upload the package again but the old faulty record still on the share.any suggestion would be appreciated.

I'm not super familiar with how config profiles work. Do they layer on top of each other, or does each config profile need to include the settings from the other? For Instance - if I want a config profile to restrict the app store, I create one. Then on a another config profile I restrict certain preference panes. do they stack, or do I need to replicate the preference panes?

Can we image 11" Macbook Airs with 15" Macbook Pro OS X. We have purchased a latest Macbook Pro and we are rolling out some students macbook Airs so the latest OSX with latest machine configuration we have is Macbook Pro. Would there be any hardware conflicts.

Hello, I need to uninstall some old McAfee agents that are in my environment still after adding newer version to build process. Below is what I was hoping would work but I get a syntax error when I test. Any help would be much appreciated. Thanks. #!/bin/bash if [ -d "/Library/McAfee/shared/4.8.0" ]then else "/Library/McAfee/cma/uninstall.sh"fi