We seem to have a recurring issue with a variety of iMacs and MBPs whereby users are no longer able to login to the machine. At one point in the past when a number of machines were hit with this issue, a simple reboot seemed to resolve the issue across the board. However, since 10.7.5 was released there still seems to be the same issues occurring sporadically. Our fix lately has been to touch the machine, unjoin from the domain and rejoin to the domain (which requires adding back in the piece for Admin users). All the machines are imaged with an Active Directory binding (on 10.7.4), but we noticed that a computer object doesn't exist in Active Directory until after we've unjoined/rejoined. Has anyone else experienced this login issue or have any suggestions? Much appreciated.

in settings>computer management>Directory Bindings I filled in all our AD info created a policy to distribute to all computers recurring checkin + Ongoing fails: log = similar to this: Mon Dec 10 15:12:27 cr-imac102874 jamf[239]: An error occurred binding to Active Directory: dsconfigad: The plugin encountered an error processing request. (10001). (Attempt 1)Mon Dec 10 15:12:38 cr-imac102874 jamf[239]: An error occurred binding to Active Directory: dsconfigad: The plugin encountered an error processing request. (10001). (Attempt 2)Mon Dec 10 15:12:49 cr-imac102874 jamf[239]: An error occurred binding to Active Directory: dsconfigad: The plugin encountered an error processing request. (10001). (Attempt 3)Mon Dec 10 15:12:59 cr-imac102874 jamf[239]: An error occurred binding to Active Directory: dsconfigad: The plugin encountered an error processing request. (10001). (Attempt 4)Mon Dec 10 15:13:10 cr-imac102874 jamf[239]: An error occurred binding to Active Directory: dsconfiga

Hello, I'm working on a user friendly app that will handle corporate client pre-reqs for my environment and the enrollment into the JSS. I'm prompting the user for their NT credentials during this process so I thought I could leverage them to download a QuickAdd package from https://yourjss:8443/osxenroll Is there a way from terminal to download a quick add from this page via bash (REST via curl)? I was looking over https://yourjss:8443/api but didn't see anything. The reason I don't want to pull down a QuickAdd created by Recon (non-expiring invitation ID) is because the user who is enrolled is logged if the enroll page is used, and the quickadd downloaded is only good once. Is the a way to accomplish this? Thank you!

We are reviewing/testing options for our move to Casper 9. In particular, we will need to decide what OS to use for our distribution points. We will be moving away from Mac OS X (and AFP) to Windows (SMB/IIS) or Linux (RHEL/SAMBA/Apache). The JDS will be a possibility for us, but for purposes of this discussion I would like to focus on SMB/share-based distribution. I've done some testing with W2K8 and W2K12 Server at both home and work environments and have run into the following problem ... I can NetBoot and use Casper Imaging to lay down OS/Configuration perfectly using either W2K8/12 server SMB shares. However, as soon as I try to deliver packages via Policy I get consistent "Can't mount a distribution point" failures. As soon as I turn on IIS and use HTTP on these servers for my policies all is well. I've tried with both local and domain accounts with same result. I can mount the share using the read and read/write account perfectly fine. Again, Casper Ima

Is anyone out there using Kerberos authentication in order to setup Outlook 2011?

I'm attempting to create a dual boot with two equal partitions of OS10.9 and a winclone image/package. Should I be creating a Bootcamp (Windows) partition within my JSS configuration and selecting the winclone image, OR selecting the partition option when creating a Winclone pkg, including that in the configuration, and then not specifying any partitioning info? Thanks.

Hey all:In our institution we use Microsoft System Center Configuration Manager (SCCM) to install Windows updates on desktop computers. With our Staff systems, we make updates available at a specific time and the staff can defer the updates for up to 48 hours (or they can update right away) and then SCCM automatically downloads and installs the updates and warns the user about a reboot. Is there a way to mirror this kind of functionality with Software Updates policy? I see that I can make updates available at a specific time but to force a deadline didn't come very apparent to me and I haven't seen this in Jamf Nation anywhere. Any advice would be appreciated

I have an principal at a school that would like to periodically copy a few files to every teacher's laptop. I would like to have a self service item for him to initiate when he wants. The self service item would copy the files to a server and then flush the logs of a policy that would copy the files to every teacher's laptop when it checked in. Setting up the self service item to copy the files to the server is easy enough, script will make that easy, as is creating the policy to copy the files to every teacher's laptop, another script. What I don't know is how have the self service item flush the policy's logs. The principal does not have access to the JSS database to flush the logs, trying to make this as easy as possible for him. If anyone has any idea as to how to complete this I would be appreciative. If you have an idea on another way to complete this that would also be helpful.

I am trying to clean up the results that report back on my EA. I am sure this is something simple but my eyes are getting cross-eyed trying to get the correct syntax. I have an EA that reports back the board-id of the systems. echo "<result>$(ioreg -p "IODeviceTree" -r -n / -d 1 | grep "board-id")</result>" reports back "board-id" = <"Mac-6F01561E16C75D06"> To delete the "board-id" = I added the | awk '{print $3}' echo "<result>$(ioreg -p "IODeviceTree" -r -n / -d 1 | grep "board-id" **| awk '{print $3}'**)</result>" reports back **<"**Mac-6F01561E16C75D06**">** To delete the "" I added the | sed s/"//g echo "<result>$(ioreg -p "IODeviceTree" -r -n / -d 1 | grep "board-id" | awk '{print $3}' **| sed s/"//g)**</result>" reports back **<**Mac-6F01561E16C75D06**>** To delete the < I added the | sed s/<//g echo "<result>$(ioreg -p "IODeviceTree" -r -n / -d 1 | grep "board-id" | awk '{print $3}' **| sed s/<//g**)&

Afternoon everyone,Can anyone clear up my uncertainty....I recently downloaded Mavericks via the App Store using my own own personal Apple ID. I'd like to create a Mavericks configuration and am uncertain whether or not my Apple ID will be permanently linked with Mavericks as it is with other apps. Will users be able to update to the next release of OS X without knowing the Apple ID and password that I used to download Mavericks originally? Thanks,Kevin

So i've been trying to find out why our DMZ HTTPS DP isn't working anymore. Turns out it's entirely due to the version of curl present in 10.9. (curl is used by the jamf binary to get scripts and packages from HTTPS distribution points it seems). I'll quote the relevant part of this link: http://curl.haxx.se/mail/archive-2013-10/0036.html ... In Mavericks, Apple changed from curl 7.24.0 to 7.30.0, and in the process, they switched the TLS/SSL engine used by their curl, from OpenSSL to their own Secure Transport engine. Apple's OpenSSL is still at version 0.9.8 and I doubt they will ever upgrade it, so this change improves curl's security. This is because the new engine supports TLS 1.1 and 1.2, and many new-ish cipher suites not supported by that old version of OpenSSL. Problem i've noticed is this has broken our basic authentication on the server unless I force the "-3" option. I've already flagged this to JAMF in a problem ticket.

I Have 800+ students renaming restricted applications (games) and playing them from the desktop.Each time I block, they rename.Any hints on how I can stop this?

What do the parentheses do when adding criteria to a smart group? What's an example of where you would want them and where you would not?

JAMF Nation I know there is probably a easy terminal command or script to make a program relaunch once close. My company uses Messages for a IM with bonjour configured. End users keep on closing the program so they aren't available. Is there a way to script or managed preference to keep messages open?

Removing SpeedGrade CS6 resolves the recon issue and allows the updated inventory for that machine to be submitted to the JSS. We didnt have this issue in JSS 8.52 since upgrading +- 2 weeks ago to 8.62. Its our clients with CS6 Mastercollection that are not being reconned. After further investigations it seems that its only clients on 10.6.8 and 2 clients on 10.8.2 that are effected. Is anyone else experiencing this problem?

JAMF recommends to setup one Payload per Configuration Profile. Should this practice be followed even when the iPads are Supervised using Apple Configurator.

So I can successfully upgrade machines using the "drag and drop" of the installer into Casper Admin per the steps from the following document: http://resources.jamfsoftware.com/archive/Deploying-OS-X-v10.7-or-Later-with-the-Casper-Suite.pdf My question is how to run a policy or script of my choosing once the upgrade is compete. Since this is installing OS version dependent AD plugins the users will not be able to log in until this step is complete so it is imperative that it is done. The process currently looks like this: Cache Installer -> Make Policy Available in Self Service -> Run Script to unjoin machine, leaving the computer account and removing the OS Dependent plugins -> Reboot/Upgrade Any ideas or suggestions on how to accomplish this would be greatly appreciated!

Is there a way to automatically flush failed policy logs so that the policy is made available again in Self Service without an administrator having to flush the log manually?

We are unable to recognize a mounted DMG in System Image Utility with the goal of creating a Mavericks Netboot Image. Casper Suite 8.73 MBA Laptop A11 inch, Mid 2013OS: 10.9.1Configured as a base netboot image, using the guide "Creating a NetBoot Image and Setting Up a NetBoot Server"https://jamfnation.jamfsoftware.com/article.html?id=307and the guide "Creating a Minimal Base OS Image"https://jamfnation.jamfsoftware.com/article.html?id=313 MBA Laptop B11 inch, Mid 2013OS: 10.9.1Installed Casper Suite 8.73Used Composer to "Build an OS Package" of Laptop A's OS via thunderbolt target disk modeDMG Size: 6.52 GBMounted newly-created DMG, shown as 'Macintosh HD' (technically 'Macintosh HD 1' according to ```df``` command)Installed Server app 3.0.2 from Mac App StoreOpened app: /System/Library/CoreServices/System Image Utility.app Result: Drop down menu is grayed out with "No sources found" message. I've tried this sa

Hi... we configured manually some informations in ARD fields 1 and 2 in our admin console in casper. We want those information to be copied locally in the same fields on the specific computers... but those information does not seems to be copied onto computers... is there a way to do this ? so... : Some informations in ARD fields 1 a 2 in casper ... to be copied into ARD fields 1 and 2 on computers...

Wasn't there a discussion here about Geek Tools? Try as I might I can't find it anywhere any more...

I'm hoping to provide a way to take a Mac, quite literally, directly out of the box and image it (having never run Setup Assistant). I can disable the setup assistant, but the problem is that the management account does not seem to be added to the Mac (let alone the other account I'm trying to add via script). Is this just not possible? MUST the Setup Assistant run before we can image?

Currently I'm working on deploying a Windows 7 VM. However its tied to a MAK and only has x number of activations on it. I know I can scope it to outside of our network, but I'm unsure how to scope it to only run say, 300 times, and then not allow users to run again.

I have two JDS servers, no other distribution points. For some reason, no matter which "Default JDS Instance" is specified for the network segment that the computer is on, Casper Imaging will default to the first JDS, which is the master. I have tried a couple machines now on different subnets. After imaging, the client machines seem to be getting packages from the correct JDS, as expected. Is anyone else seeing this behavior?

I'm trying to test the password recovery option with FileVault, where you type your password incorrectly three times at the boot login. I get the prompt to enter the recovery key, i enter it and then it boots to the login screen where i'm prompted to enter a new password for my encrypted user. I enter a new password and it just shakes it off. I'm forced to enter my actual password. This is a Macbook Pro running 10.9 and i used JSSv9.2 to setup filevault2 with an individual key and institutional key. This is an AD bound user with a mobile account(which now that i think about it, might have something to do with the problem). Summoning @rtrouton][/url][/url][/url EDIT: I enabled a second standard user with FileVault and tried this with that user and i was able to reset the password. So, the issue seems to be with the AD bound user only. Found another thread on the topic: https://jamfnation.jamfsoftware.com/discussion.html?id=7400