Hi all, Forgive me if this has already been covered - I have searched high and low. We are running Casper Imaging 9.21 on a 10.9 NetBoot image. When we image a MacBook Air over Thunderbolt to Ethernet adapter (which has been specified in JSS as a removable MAC Address) and try to name the machine quickly as the MAC Address, it picks the Thunderbolt to Ethernet adapter's MAC Address instead of the Wifi MAC Address. Is this by design? Am I missing something simple? We have a significant number of machines that require imaging soon and don't really want to go into network settings and copy and paste each Wifi MAC Address into the computer name field. Perhaps I need to submit a feature request to give you the choice of MAC Address in Casper Imaging, unless this has already been covered. Cheers,Gavin

We're (FINALLY) moving towards a larger picture plan with our Mac workstations, and allowing local mail applications to run on our Macs as opposed to a Citrix session. Our security team wants to display a pop up message at launch of MS Outlook (the chose application). For the life of me, I can't seem to scope that out as a policy. I could kill it 7 ways to Sunday, but to display a popup security warning message when the application launches has me scratching my head. Has anyone else come across this issue (a popup when an application launches)? If so, how did you solve it? Sometimes I can't see the forest through the trees, so please take that in mind.

I created a user with teh createuserpkg app and found that everything works except I can't ssh into a box using that account. I can using our jss account - so I know ssh is working, but just not with that account.

I would like to build an Extension Attribute to detect the version of Casper Remote, Recon, Composer, etc and create a policy to push out the current version to the various call center macs that have these apps installed. Does anyone have any suggestions on how to look up the versions?

I've been asked to turn off the Remote Management option on all clients, so that technicians cannot access client machines through Apple Remote Desktop and instead must use Casper Remote (since Casper Remote screen sharing sessions can be configured to require approval on the client end, and all sessions are logged on the JSS). I'm writing an extended attribute that will monitor the status of the Remote Management service, so that we can have a Smart Group of clients that have it turned on (and we can get emails when the status changes). It's proving a bit more complicated than I hoped--ideally, you could just run "kickstart status" and get usable output, but as far as I can tell the kickstart command has no option to query status. There's a command here: http://apple.stackexchange.com/questions/90848/check-remote-management-status-via-terminal but the problem with it is that it only works if it is run as the currently logged in user; since Casper runs

This isn't a JSS/JAMF issue, but thought I would throw this out there to see if I can get some help with an issue we have. Our Active Directory Policy I set up in the JSS to bind our systems to Active Directory does have the “Create mobile account at login” checked marked, so that when we hand off the users new system they login with their domain login and would be able to change their domain password in System Preference and also have the ability to have them be notified that their password is about to change. I recently found out that a member of the hardware team who hands off a users new Mac, has been creating their domain account locally and also creating a local password. The users are then instructed to change the local password to match their domain password. The issue I am finding now is that when the user needs to change their domain password, it does not synch to active directory, causing the user to have to use two passwords and not getting the password expire notifi

Hello All, I am wondering if anyone else is having problems with keychain access and the management account? We image most of our machines via a master image. We use the latest hardware available to make the image and then push to other machines. We also create an Admin account that we then change the password on every 6 months. My problem is with the Admin account. When we initially image the machine, it has the default password used when we create all images. When we use Casper to change the administrative password on all machines, we constantly get a prompt when logging in to unlock the keychain. Most of my users don't know the "default password", they know the current password that is set for the next 6 months. I am wondering if there is a way for me to disable these messages for the admin account. If you simply click cancel, you get the error message over and over. Joe

Hi... is it possible to publish through self service certain amount of pdf files like procedure.... for specific computer group or active directory group ?

I deleted a bunch of old files off the root server via C.Admin. Now when I scroll down to JDS Instances and hit replicate it errors out saying it can't find the packages (duh). What am I doing wrong?

First post jamfnation... With 10.8.X we were able to setup a default dock with the Apps we wanted by modifying and then fixing permission on the plist:/System/Library/CoreServices/Dock.app/Contents/Resources/English.lproj/default.plist After making the changes we wanted, any new (English speaking) users that would login would get our customized dock. We are a pretty open environment, and I wanted to let the user change their dock like they prefer, so I don't want to enforce any dock items, just build a standard one. However, with Mavericks this no longer works. I can see that there is now a directory en.lproj instead of the English.lproj, but I would expect that deleting a user's com.apple.dock.plist in /Users/<username>/Library/Preferences and then killing the dock would force it to pull a new copy of the default.plist. Deleting that com.apple.dock.plist is not resetting the dock at all. Does anyone know where Mavericks is saving a user's dock information? Doe

Hi All, We use Remote desktop at the moment and have just recently introduced JSS/Casper into the environment my question is how would you go about importing all your machines from remote desktop to JSS/Casper? Thank SEN73

Hello, We are in the process of switching from Windows 7 tablets to MAcBook Airs. I'm working on writing an Applescript that will migrate a user's backup data from the tablet into the correct folders on the Mac. I've got the script pretty well ironed our, but now see that I need the variable for the logged in user. I have tried set user to do shell script "/usr/bin/logname" and set user to do shell script "/bin/ls -l /dev/console | /usr/bin/awk '{ print $3 }'" but they both result in an error on the JSS of: Script result: /private/tmp/MacPCDataRestore.scpt: execution error: No user interaction allowed. (-1713) Any ideas on how to accomplish this in an Applescript? I could do this all as a shell script, but I wanted to be able to pop up dialog boxes letting the user know what was happening. So the other option would be how to display messages from a shell script. Thanks, Tim

For reasons beyond of my control push connectivity is not permitted in our organization, so I cannot enable configuration profiles from my apple server. I was able to manually configure JAMF to enable configuration profiles but I would like the ability to export the configuration profiles a la iPhoneConfigUtility. Is there a way to export profiles created via JAMF?

With the changes to 10.9's app store lock down and the config profile not working through the JSS/APNS push, is there a way to download the config profile and then bundle it up so it gets installed via the deployment workflow?

This is a hidden feature that was worked in last summer but currently if you do not include CN=$PROFILE_IDENTIFIER in the subject name for the certificate your certificate will expire and never renew. When you add CN=$PROFILE_IDENTIFIER to the subject name then click on General mandatory you will have an option below Level computer/user drop down that appears "Redeploy Profile". This is how frequent it will redeploy the profile which will delete the existing Certificate and deliver a new certificate. One thing to consider is like in our environment you have to be on the network to see our CA. So I have our profile scoped to all computer but they have to be on networks that have access to the CA. This way if they do not have access to the network it doesn't remove the certificate leaving the user unable to connect to our VPN solution.

Hey All, We upgraded our Casper 8 to Casper 9 and found a few problems today. I now can't search by computer name (without a full user's name)example: To Find John Doe's Macbook Pro I used to be able to search for John and get all Johns, then click on the one I want. Now I must search: John Doe. Is this by design? I also use the peripherals page with menus to keep track of assigned equipment. Now I can no longer edit my peripherals pages (adding new entries in the computer account, for example.) I tried adding a new peripheral (to see if the old ones didn't migrate correctly) and that didn't seem to work. Any ideas? Thanks!

Figured id ask, Im sure this have been covered before, I have 11 Systems running 10.8.3 to 10.8.5 that i want to upgrade to OSX 10.9. In the past i Used my Macbook Pro running OSX server and had a netinstall image of OSX and upgrade them using netInstall, Id like do this again or if anyone has a better way to do this with a 3rd party software id love to hear it, Also i have not made a net boot image of OSX in a long time so any refresher on that would be great. I plan to go about this on Thursday at a remote site and wanted a quick and easy way to go about it without just using Flash Drives or copying the file to a Master system and then copying it to each System as i Upgrade them. Once again Im casperless and pretty much use ARD to manage my systems, Id love to find a way i can do this via ARD but nothing really stands out other then creating some kind of automator Script.... again Suggestions welcome thanks you@

I have students that are changing the times on their iPads. I'm finding out that some of them are doing it in order to install something called GBA4iOS, which is a Gameboy emulator. Wondering if there is a way to detect if/when kids rollback the time in order to install "stuff" like this? Thanks,

The jamf binary can be used to add mcx, curious if there's a way to remove mcx? The reason I ask, sometimes there are hidden functions that don't show when pulling up the jamf binary help pages. $ jamf -help mcx Usage: jamf mcx Usage: jamf mcx -username <username> -username The username of the account that Managed Preferences are being applied to. Notes: When run without the -username flag, Managed Preferences are applied for the Computer Level. $ TIADon

What if you actually want to use the iCoud Key-chain in your AD environment? Let me give you the cliff notes on our set up. (Keep in mind I inherited this system I am the new help desk manager) - 500 plus Mac users. (we enable root and admin account, then add users. They are ALL local admins. Yeah I know bad idea.) - Bound to AD.- First.Last and AD password is required to log into their mac. -Password set to NEVER expire. (yeah I know bad)- 120 iPads and growing. -Windows Servers. (we still have a bunch of PC's)- Staff Wi-Fi is accessed by the users AD credentials.-If someone has to have their Mac repaired or serviced they simply write their user name and password down and hand it to my staff! (Yeah I know even MORE of a bad idea.) With that said I have my orders.... NO CHANGES to the Password system unless I can make it easy and SIMPLE! Here is what I would like to have happen. 1. If the user goes to System Preffs and changes their user password I want it to change the ke

SO this is just a general question just to see what others are doing, maybe someone has a great method that's better then ours. Basically, im trying to evaluate our work flow to see what would work best, we have alot of systems like im sure most of you do that are system that had Firewire 800, no thunderbolt, or even some that have no firewire and just USB (2008 macbooks), This causes us to run into some clunky issues of having to have adapters, or cloning the systems to a DMG, most of our external drives also are Firewire 800, so we have Firewire 800 to thunderbolt adapters. Im thinking thiers a better way to handle Migration assistant clones, or 1:1 clones using maybe deploy studio or just attaching a large external drive to our Mac pro server and using it for DMG clones and mounting the image to migrate it or 1:1 clone. At the moment, its kind of a mixed bag, we sometimes have to clone data to an external drive because the original drive has performance issues, so then usin

If I create a general profile for all devices that blocks 17+ apps in the Restrictions payload, and then create a separate profile that I only want to apply to a subset of devices, which has a Restrictions payload to disable Siri. How is the final set of permissions determined. Each payload will conflict with the other.. one allows Siri but disables 17+, the other disables Siri but allows 17+.

Hi All, I've successfully pulled information out of our JSS using the API. Now I have a new challenge: setting an extension attribute via the API. Is this even possible?

I'm looking to start up a User Group in the Kansas City area, to include both sides of the state line. I know there are a number of users in the area. Please shoot me an email mark.hughes@kckps.org if this seems of interest to you.

I am experiencing a problem with the 10.9 Netboot being able to boot the newly released Retinas and older Macbook Pros (non-retinas). I built the Netboot image from the new Retinas. They boot fine, the older MBPs do not. I know the new Retinas forked 10.9, but my usual tricks aren't working. Namely, running recovery on the new Retinas, putting the install files on a USB drive, and running the Retina Mavericks build install on the MBP. Then building the Netboot image from that machine. It still boots the new Retinas, but not the older MBPs.