Is it possible to create a policy that executes a script when a target machine is removed from a Static Computer Group? For example: I have scoped a policy to install Firefox on any machine placed in a Static Computer Group called "Firefox". However I would like to execute a Script to remove Firefox from that machine in the event that it's ever removed from that group.

I know there probably has been a defect already open for that... but is there anybody who got to thin image fusion or SSD drives properly ? As soon as i try to thin image those drives casper imaging just goes straight through my packages like if it was installing very fast but no packages really installs... If i compile the whole thing it all works fine... works fine also with thin imaging on regular drives

Thought I'd share this for anyone who might find it useful. We have users whose FileVault2-encrypted Macs are backed up with Time Machine to un-encrypted external hard drives. This kind of destroys the point of securing the data on the internal drive, so we're changing our policies to require the external drives to be encrypted. As such I've been working on a way to encrypt the drive and add the password to the user's keychain so that they are not prompted to unlock the drive when it is connected. Eventually I'll work this into Self Service and prompt the user to provide a password. Here's what I have for now: #!/bin/bash #Encrypt Time Machine drive mountPath=`tmutil destinationinfo | grep "Mount Point" | awk -F ": " '{print $2}'` if [ "$mountPath" = "" ] then #Drive not mounted exit 1 fi diskutil cs convert "$mountPath" -passphrase "$PASSWORD" #Add password to u

Not seeing much on it, so I'm assuming it is but I want to make sure there isn't a better method first.

Hi, Running a diskless net boot image 10.9.2 . For some reason when it gets to the block copy of our image (10.9.2) it happens too quickly, just goes through instantly. Anyone seen a similar issue to this?

Hi, I have recently employed the following script to collect user info via AD, a script posted on these forums.#!/bin/sh loggedInUser=/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }' accountType=dscl . -read /Users/$loggedInUser | ?grep UniqueID | cut -c 11- if (( "$accountType" > 1000 )); thenuserRealname=dscl . -read /Users/$loggedInUser | awk '/^dsAttrTypeNative:original_realname:/,/^dsAttrTypeNative:original_shell:/' | head -2 | tail -1 |cut -c 2-userEmail=dscl . -read /Users/$loggedInUser | grep EMailAddress: | cut -c 15-userPosition=dscl . -read /Users/$loggedInUser | grep JobTitle: | cut -c 11-if [[ -z $userPosition ]]; thenuserPosition=dscl . -read /Users/$loggedInUser | awk '/^JobTitle:/,/^JPEGPhoto:/' | head -2 | tail -1 | cut -c 2-fiuserPhone=dscl . -read /Users/$loggedInUser | grep -A 1 PhoneNumber: | tail -1 | cut -c 2-userDepartment=dscl . -read /Users/$loggedInUser | grep "Company:" | cut -c 10-if [[ -z $userDe

A bit off topic - but putting this out there anyway... With 10.6.x the Kerberos Agent would pop up a polite GUI requesting password which could be called from a script as follows: echo '' | sudo -u $user kinit This could be used to automate prompting a user to re-authenticate and preventing ticket expiry. With Kerberos changes in Lion what are others using to prevent ticket expiry/renewal? Thanks, Lisa.

My Mac OS X clients have different errors that I see through the email notifications that are sent to me. Rather than manually resolve each computer, I wanted to have the JSS place the computers with particular errors in specific smart groups so I can use those smart groups to scope specific solutions, e.g., run QuickAdd or jamf enroll at computers with "device signature errors". I would appreciate JAMF Nation's feedback in either tightening the EA's script (I am sure it can be written more efficiently) and/or improving the script's logic. For example, the current iteration of the EA only checks the last 100 lines of the jamf.log for a particular error. My intent with the tail is to try to examine the few days or week's worth of entries so that the error is relatively fresh; I did not want to try to resolve an error that occurred once a few months ago. Thanks in advance. #!/bin/bash $ERROR="" #examples: "connection failure", "device signature error", etc. MATCH=`tail -n 100 /var/

Seems with the 10.9.3 update Apple is hiding the Users folder. I believe Apple had done this by design, but it also could be a bug. I don't see any harm in it as users couldn't see other users files anyway. The only harm is maybe to people who use the "Shared User" folder. Regardless, I wanted to let you all know. If you want to change it back here is a fix below. To ensure the visibility of the /Users folder after restarts, you can create an AppleScript applet, and set it to run when you log in to your Mac. Use the following code: tell application "Terminal"do shell script "chflags nohidden /Users" password "yourpassword" with administrator privilegesend tell Replace “your password” with your user password. Save this as an application, and add it to your login items in System Preferences > Accounts.

We've recently upgraded from 8.73 to 9.3 and have setup a new JDS. Manually instructing Casper Remote and JSS Policies to install via the JDS have proved successful, so we're ready to set the JDS as the master distribution point. However, since setting the JDS as the master in JSS I've found that all of our policies and remote sessions continue to use the classic file share distribution points. Logs show that it doesn't even try to use the JDS. None of these policies have manual distribution point settings. Any ideas on what's wrong?

Hi all, I've been having a hard time trying to find out if this is even possible or not. What I'd like to do is to have Casper use a policy to silently check for and/or update Java in the background, but I can't seem to find any sort of terminal command to accomplish this throughout the interwebs. Is something like this even possible?

Hi.If seen a problem across a lot of our machines that the user we created for management of our machines is visible.We are on 9.24 and used the command "jamf createAccount" with the -hidden option. We also moved the home folder to /private/var/. Any idea how we can ensure the user is hidden? BTW: This also happens when we enroll a new machine with a Quick Add package where the option is set to hide the account... Thanks.

I'm trying to make the switch from a monolithic workflow with DeployStudio to a packaged workflow with Casper, both thin and not. ;) With DS, I used admin autologin and a login script to execute tasks that need to happen on the first boot after DS has finalized the image. I let DS do the binding and my script is there to basically license Adobe Creative Cloud. I have already been using launchd for tasks such as rebooting daily and running a weekly data clean-up script. This is my first time trying to get something to launch once only on the first time the machine is booted. At the moment it is not working. The logic is a little convoluted and I am open to suggestions on how to simplify this. All of my scripts are in /Library/AdminToolBox, a directory I created for such things. My launchd plist looks like this: <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/Property

Hi All, Since migrating to v9 in January, we've had issues where the Network Segments are not always using the correct DP.. BUT this seems to be with the JAMF Binary & not the apps as Casper Imaging, Remote & (we think) Self Service all seem to be respecting their defined DP's. We have quite a complicated setup, but here are the Network Segments: External 1.1.1.1 - 255.255.255.255 BCP DMZ 10.1.11.1 - 10.1.11.255 Sunderland 10.1.13.1 - 10.1.13.255 Lakeside Server VLAN 10.1.2.1 - 10.1.2.255 Nottingham 10.1.32.1 - 10.1.33.255 Canterbury 10.1.44.1 - 10.1.44.255 Stockport 10.1.44.1 - 10.1.44.255 Manhattan 10.1.52.1 - 10.1.52.255 Tokyo 10.102.4.1 - 10.102.4.255 New York 10.103.1.1 - 10.103.1.255 Lakeside Wireless 10.110.1.1 - 10.110.2.255 Sunderland Wireless 10.110.13.1 - 10.110.13.255 Nottingham Wireless 10.110.32.1 - 10.110.32.255 Stockport Wireless 10.110.44.1 - 10.110.44.255 Manhattan Wireless 10.110.52.1 - 10.110.52.255 Lak

I can see where to search for it in an Advanced Search, but how do I just display that info? Didn't see a choice in Inventory Display. I'm running 9.3. Thanks!Brian

Annoying not having the ability to cancel uploading or indexing process.I had to force quit Casper Admin last week while uploading a small package that hang casper admin to respond to anything. After I relaunched the casper admin and tried to upload again it says it has the package and need to replace it I click replace, it doesn't even take a second to replace but is it replacing it???? I don't think so the package still on the share even if i try to remove it from the share it says it is being used by other application and can't delete. Deleted from the Casper Admin won't remove it from the share for some reasons.I had to rename the package to be able to upload the package again but the old faulty record still on the share.any suggestion would be appreciated.

I'm not super familiar with how config profiles work. Do they layer on top of each other, or does each config profile need to include the settings from the other? For Instance - if I want a config profile to restrict the app store, I create one. Then on a another config profile I restrict certain preference panes. do they stack, or do I need to replicate the preference panes?

Can we image 11" Macbook Airs with 15" Macbook Pro OS X. We have purchased a latest Macbook Pro and we are rolling out some students macbook Airs so the latest OSX with latest machine configuration we have is Macbook Pro. Would there be any hardware conflicts.

Hello, I need to uninstall some old McAfee agents that are in my environment still after adding newer version to build process. Below is what I was hoping would work but I get a syntax error when I test. Any help would be much appreciated. Thanks. #!/bin/bash if [ -d "/Library/McAfee/shared/4.8.0" ]then else "/Library/McAfee/cma/uninstall.sh"fi

Is it possible to use an App Lock setting in a Configuration Profile for an iOS device to lock it to Safari? What application Bundle ID should we use? We tried "com.apple.Safari" but that did not seem to work.

I'm new to scripting the MAC OS and looking for some help to gather version info from a plist file. My goal is to create an extension attribute that will use a bash script to tell me if clients have MozyEnterprise installed. Mozy doesn't seem to install in the typical app directory but installs itself as a system preference. The location to the plist file is /Library/Preferencepanes/MozyEnterprise.prefPane/Contents/info.plist. Within this plist file there is a key named "Get Info string" which is a string type that has a value of "MozyEnterprise 2.13.0 ©2006-2012 Mozy" the version number I'm trying to extract and setup. Thanks for any help anyone can provide.

Hi everyone, we used to create a logout *.sh script to execute at user logout. This script deletes all user accounts with a number in their profile since our students all have that. Now I'd like to implement the same in Casper and already enabled login/logout hooks. Also I created the script but I can not find where/how to attach the script to execute on a machine. *Deleted unnecessary info*

Hi guys In Mavericks with a cinema display attached there is an options tab in the display preferences there is an option tab. In order to make a change you have to unlock the padlock, but users don't have admin rights. Doesn't anyone know if it is possible to script the option to "Pressing the displays power turn the display on and off"? Thanks Tim

So...here's one I've been wracking my brain with. We are planning to pilot a number of Macs to our organization in the coming months. Windows Machines bound to AD using Network accounts, all have data on them, being migrated to piloting Macbook Airs also AD bound using same network accounts. Need to get the data migrated in a simple way that even the users can follow directions and not screw up...Nothing I can think of is easy enough. Any suggestions?

Hello, For some reason I can't seem to get my head around this and apologies in advance for sounding dumb but what is the difference exactly? At present we have a master File Share Distribution point which we pump all our items (pkgs/scripts/configs) into via Casper Admin. This is currently configured as File Sharing over SMB. I noticed we have a JDS Instance which allows us to replicate (this doesn't replicate for some reason) but not exactly sure why it is there! Why not setup another File Share Distribution point with File Sharing/HTTP enabled? Thanks in advance.