Hello all, We have multiple users with multiple mobile devices. However, we have one user with 2 (iphone/iPad) mobile devices which will only allow us to assign a single mobile device to a department. If we assign their iPhone to a department, it will remove the department from their iPad and vice versa. Like I said before, we have many users with multiple devices and they don't seem to get this issue. I've tried re-enrolling both the devices to jamf but it doesn't help. I'm a bit suck on what may be causing this. Any help will be greatly appreciated.

I'm running 8.73 and didn't notice any export button but is there a way to export a config profile from one created on the JSS? I'd rather not recreate it in apple configurator if at all possible :)

Already asked Rich T about this on twitter, but I thought I'd post here as well . . .I'm working on enabling filevault using the fdesetup command and a plist with a certificate embedded to create an institutional recovery key.Normally when using an institutional recovery key, you start by creating a keychain in keychain access. During that process, you set the password on the FV2 master keychain, which then is supplied at the command line when the recovery key is used to decrypt the disk.When using a plist with fdesetup, fdesetup creates the keychain from the embedded certificate in the plist. Since I didn't create the keychain, I don't know what password to use to unlock it. Anyone know what password is assigned to the FV2 master keychain when it's created by fdesetup?

I'm working on an extension attribute that gets a computer's OU. I found existing code, modified it, and it works great! However, when a user goes off campus, the EA script can't make the ldap query because our domain isn't accessible over the internet. This causes the EA to become blank. It updates to the proper value when the user comes back on campus. How can I tell an EA to leave the value it has alone? I tried to put something like this at the top of my script (changed my IP's for obvious reasons, but the rest of it is verbatim): ETH0IP=`ipconfig getifaddr en0` ETH1IP=`ipconfig getifaddr en1` if [[ $ETH0IP != "192.168"* ]] && [[ $ETH1IP != "192.168"* ]]; then exit 0 fi I thought that if I didn't have a <result> tag it might just kill the script. Unfortunately, I see the same behavior. Anyone else know how to solve this?

Within Casper Imaging 9.3, I have an uncompiled configuration that contains a few installs that are direct from their maker (example: Java 8 JDK or Xquartz 2.7.5). These are in .pkg format and I merely dropped them strait into Casper Admin and then added them into my configuration to deploy to 10.9.x boxes. My problem is, the two examples listed above do not seem to install during Casper Imaging but they will install just fine if done from Capser Remote. My questions are, why on earth does one pkg deploy correct using one product and not the other? Is there a secret to these pkgs to get them to install correctly from Casper Imaging? Must I really do everything in imaging as a DMG?

We have 70 new Late 2013 standard iMacs, and I have started imaging them to rollout shortly. In my testing in the last few days I have noticed that they have different energy saver settings than previous Macs (we have always set our lab Macs to sleep the display after 15 minutes and then the computer after three hours (or in some cases never)). The old system of sleeping the display and computer at separate times is now gone. Upon looking things up I found that the new Haswell iMacs have different power management (https://discussions.apple.com/thread/5460434). Does anyone know of a simple way that JSS could be used to maybe run a "pmset" to force the computer and display to sleep at different times? The pmset KB from Apple (https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/pmset.1.html) talks about having different timers for each, but I am not sure how to set them, or what the best practice others have found is.

We're having issues with a Canon printer driver and it seems a newer version seems to be fixing these issues.I'd like to create an Extension Attribute to show the same Driver Version shown under Options & Supplies > General tab for the printer in Printer & Scanners in System Preferences.Then I can setup a Policy to track the printer driver versions.Thanks for any assistance.

Is anyone using hash tags for package/file verification before they install the packages on client machines? We are looking for a way to ensure that none of our packages get corrupted either accidentally (through network issues) or intentionally (malicious intent). Short of writing a custom script for each installer to do a checksum, is anyone doing anything of the sorts for their JSS? Thanks. Chris

Does anyone know of a good way to do this in an extension attribute or similar? I need to track down laptops that haven't yet been switched over to using AD accounts.

Hello, We have a JSS in our DMZ providing remote access for checkins/ Policies / ect. When users attempt to use Self Service they are getting the error "Could Not Connect to HTTP server to download x.pkg" From the DMZ JSS i am able to ping the JDS. Traffic for 80 & 443 are open between. Are there more ports i need to open between the DMZ and the JDS to ensure it works? Would putting a JDS on the DMZ JSS box be more efficient? All servers are running Ubuntu 12

I'm curious if there is a way that I can use an extension attribute to list the name of the computer object being used for the bind to Active Directory. All I can see in my JSS currently is a bind status of "Not Bound" or the name of the domain it is bound to. Since the name of the computer (hostname for example) does not always match the computer object name, I'd like to have that listed under the Operating System tab. I would imagine this is achievable via an extension attribute script, but I'm not positive which command would be easiest and most reliable to use.

Is anybody having any success managing Launchpad? It looks like it's an sqlite database, so I'm a little outside my comfort zone trying to manipulate it directly. (The ask from management is that we try and prevent certain utilities from showing up here, such as those automatically installed by Centrify).

Came across this by accident this morning and I'm a bit confused. Did I miss a thread somewhere ? (I've looked around and I don't see anything talking about this.) Using a test non admin local account on a 10.9.2 machine I was able to install an app from the Mac app store on that machine. I can pick any legit Apple ID to do so. I thought the user needed to be in the _appstore group for this to happen ? Or at least an admin account. Is this something new in 10.9 that I've missed ? I thought the user would need to have write access to the Applications folder. Went back to a 10.8.5 machine and sure enough it doesn't work. It asks for an admin password. So this behavior seems to be a 10.9 thing. For a one to one deployment I can see this as an ok thing. In some ways it could be a bonus. I was looking for ways to do this using the _appstore group. But for labs this could be a bit of a disaster. That would mean that any student with an Apple ID could install ap

I was curious if it's possible to add multiple lines of commands here? The box only shows a single text field rather than a multi-text field so I wasn't sure if I was to copy a script with multiple lines would run? Thanks.

We are still testing Mountain Lion before allowing installation across our environment and wireless config continues to give us trouble. We have WPA2 Enterprise security, and we use 802.1x network authentication via TLS (certificate based authentication), the certificate payload includes a wireless certificate and then root and corp certs in the trust. The profile is scoped at the system level for clients running 10.8+ The Config profile pushes out to Mountain Lion clients and they are able to connect to the network but they inevitably end up jumping on and off of the network, often when the screen is locked, which renders network users (Active Directory) unable to log back into their profile until they plug in to the network. Anyone else experiencing this? If you are any ideas for a fix? I can barely maintain a wi-fi connection for more than a few minutes. Our Lion clients continue to work just fine with the same network and certificate payloads.

Is there an easy way to create either a smart group or computer search that identifies computers outside of a network IP Range? Adding "IP address not like 10...*" doesn't seem to block out 10.1.1.1 for example. Maybe I'm not identifying the IP range correctly, but if anyone can offer me any better ways to do this that would be much appreciated! Thanks in advance Laura

Running JSS 9.24I wanted to customize the enrollment icon so I downloaded the DefaultEnrollmentLogin.png edited it with our logo on the screen and then saved it as a .png.... The file size grew from 19KBs to 133KBs. There isn't a restriction on file size, it just says "It is recommended that you use a file with the GIF or PNG format" I also made a .gif that is 98KBs. When I press Upload Login Page Icon, it gets to 99% and then hangs and continues to try, but never fully uploads. I also notice that the file size when uploading is different from actual size on the Mac, but didn't know if that was due to how they calculate file size. When I click save it says the icon has been uploaded and I can upload another icon or reset the icon, but the new icon does not appear on the enrollment page. I've tried other .png and .gif images, but it still just seems to hang at 99% It's not mission critical, but would add a nice touch to the enrollment page. From Chro

*That word is supposed to be REVOKE. I'm hoping someone can help me out of a jam. I am the MDM for a school that collects iPads over vacations. Some students, perhaps desperate to keep their iPads, left them home or didn't come to school on the morning of the collection. I wrote to these students, informing them that they were not to turn of their iPads over break and not until they bring the devices to me April 20th. My plan (now maybe backfiring!) was to issue the Remote Wipe, expecting that it would sit in the command queue waiting for the device to connect to wifi for execution--the same way inventory commands sit. The key thing here was being able to CANCEL the command for those students who indeed kept their iPads off during their vacations. HELP? The command is not queued or PENDING. It's just in the history as executed, even on those iPads with other commands in their queue. Now I have a situation.

I'm trying to use M.P. to setup an app. In the plist of the app it's got the <key>info here</key> and then <true/> <key>enableKeychainLockCheck</key> <true/> <key>enableNotifications</key> <true/> How do I enter that into the M.P.?

Hi All; I haven't seen a discussion about this in the forums that wasn't several years old and was wondering what suggestions there were for running casper off of. The current use case is imaging up to 10 machines at once of various makes and models with an ideal imaging time of <1 hour. Currently we have an older DELL Optiplex 745 running Norton Ghost with Windows XP that's able to image unto 3 machines in over an hour and a half each and with. While virtualization is a possibility, I think it may actually be faster and more prudent to just get a physical imaging server. Thanks for any help, :Theo

I am in a trial of Casper right now, and looking for a little guidance, if anyone has some to offer. I want to create a management or service account on each workstation, hide it from the local user, enable it for SSH, and turn SSH on (to allow Capser Remote). Is there a best practice approach for this from within JSS? I have seen a few different articles on this here at JAMFNATION and am not sure yet which way to go. Thanks in advance. Matthew Ellis

Hi, Is anyone doing 10.8 imaging with Casper Imaging and Multicasting? A quick chat with JAMF today revealed that they depreciated their multicast image tool.

Is there anyway to assign a site during imaging? When editing a Configuration there is no option to choose a site under the Management tab. Can you create QuickAdd packages and then just add them to the package part of the configuration to get around this? We have about 5 or 6 sites we will be putting into production. We could of course have users enroll after the fact but the worry is they will not end up not actually doing this. We would rather they are enrolled form the get go.

Hi all, I just made a brand new NetBoot image of 10.7.4 and after the build it's almost 13GBsTrashed most of the apps and utilities, ran monolingual also ... but wow 13GB !!! Used the latest method as described in Casper NetBoot Automator Action 1.1Anyone made a slimmed down low-fat netboot ? My previous 10.6.x netboot images were about 3.9 GBs thanks in advance.

Ok, I've hacked away for hours, but I just can't seem to finish an Applescript that I'm working on for our image. I've managed to create the following:- an Applescript that prompts for UserID, Password, Email and sets up an Outlook account I'd like to do the following within the same script:- take the UserID variable that was created above and edit the printers.conf file by changing the DeviceURI... from (current file text in printers.conf in cups.DMG that is deployed):lpd://EMPLOYEE@10.100.153.197 to:lpd://{UserID}@10.100.153.197 Sorry if that's complicated. Hard to be concise. I've search the posts on JAMF, but not breaking through.