I'd like to get my users up to date with security updates / software updates so we reduce variables in our infrastructure. I know plenty of ways to push updates or have the computer run softwareupdate -i -a, get users to go through Self Service, etc. etc. etc. Sounds like a great plan up until .... The dreaded question of reboots and how to handle them. How do you handle them if you cannot force one on them? The 5 minute auto restart option is not an option at all. How do you nag them to say, "You're computer just ran software update and it needs to restart, please do it as soon as possible". jamfHelper script in a policy through a smart group that says softwareupdate that requires reboot just ran? I worry that they'll ignore the pop up and just keep clicking OK for days and never reboot and then put the machine in a weird state.

https://github.com/darklordbrock/scripts/blob/master/UW-Milwaukee/mySWUcheck.sh I want to share this workflow I have setup. I have a smart group that will add machines that need a software update. The smart group gets a policy that runs this script at log out. I will ask the user during logout if they would like to install updates. The user can click NO three times. On the four log out the system will just install the updates. The script will tell if the updates need to reboot the system or just install. If the updates need to reboot, the script will have the system shutdown when they are done installing. With this being a log out script I thought it would be best to have the machine shutdown on a reboot needed. This way if the person is going to shut their machine down at the end of the day they can let this run and just go home, knowing the machine will shutdown with it is done. I have started to notice since I have been using this that most people do not log out or shutdown ve

Before I submit a feature request, is there a way to ensure that if a tech launches a Casper tool, they would be prompted if the version does not match JSS? In other words, JDoe opens Casper Admin 8.62, but we upgraded JSS to 8.63, so they would/should get a dialog along the lines of: Hi JDoe, I hope you're having a fantastic day. Oh, by the way, did you know your Casper Admin application is not at the latest version? Plese follow this link to be presented with a Self Service install of the latest version. :-)

Hi guys I've been trying to get the IDENTIFIER of a usb stick plugged in so i can use disk1s1 as a variable Im having problems cutting out the spaces and i was wondering if anyone knows how to just get disk1s1? This is what i have so far diskutil list | grep RALLY | grep disk 1: Windows_FAT_32 RALLY2 64GB 64.2 GB disk1s1

Brand new NetSUS installation of Ubuntu 10.04.4 using the 1.02 seed file. Fresh after the install, I've reconfigured the server for a static IP address, I've modified the adminHelper.sh script to work with DeployStudio .nbi bundles, and I've enabled ufw but have allowed access from the subnet that my workstation is on. I upload my newly generated "DSR-1083.nbi" bundle to the SMB share, I configure NetBoot to listen on my subnet, and click the Enable NetBoot button but nothing happens. The /etc/dhcpd.conf file looks correct--it has the path to the .sparseimage inside the .nbi bundle and everything. If I manually launch dhcpd from the command line, however: shelluser@NetSUS:~$ sudo /usr/local/sbin/dhcpd /usr/local/sbin/dhcpd: 2: Syntax error: ")" unexpected shelluser@NetSUS:~$ sudo /usr/local/sbin/dhcpd --version /usr/local/sbin/dhcpd: 2: Syntax error: ")" unexpected shelluser@NetSUS:~$ ls -l /usr/local/sbin/dhcpd -rwxr-xr-x 1 root root 66

For those of you using Casper FileVault configs who also encounter Fusion Drives, are you running into problems? With 10.8.2, encryption would fail (the Institutional key would be set, but the drive would not start encrypting). With 10.8.3, the key is set and the drive begins encrypting after the first reboot (as opposed to before it, like I see with non-Fusion Drives) BUT on the subsequent reboot, the machine fails to boot after unlocking (indefinite pinwheel). I recall somebody saying the -defer flag was causing trouble with Fusion Drives; I was hoping 10.8.3 would smooth out some kinks... silly me.

Anyone tried setting a startup/shutdown schedule in an energy saver payload pushed to a 10.8.2 machine? Every time the profile is installed in a fresh 10.8.2 install on a couple Late 2012 Mac Minis (machine specific build, of course) I can no longer log into these machines. I only get a white screen. I have tested this in a setting where the only thing thats different from a "fresh out of the box and fully updated" install is jamf 8.62 management and this one payload, so no packages or bindings or anything else.

What's the best way to trigger a policy ONLY if the compurter is logged off? Extension Attributes are not an option, since inventory data is gathered every 7 days (14 day window). We need to run "softwareupdate -i -a" only if the Macs are logged off. The policy is all set up and tested, just hung on how to trigger only for logged off Macs. :) Thoughts? TIADon

Has anyone out there used something simple like cURL to monitor if JSS goes down, and to restart Tomcat automatically if it gets no response?

I have a weird issue with the latest Flash Player installation. I've found that it installs just fine when a user is logged on, but if no one is logged on it will just sit at "Installing Adobe Flash Player 11.6.602.180.pkg" forever. Has anyone else come across this? Here's how the install is setup: PKG copies the install app (extracted from the dmg directly from Adobe) to /tmp, and a postflight script runs the command: "/private/tmp/Adobe Flash Player 11.6.602.180.app/Contents/MacOS/Adobe Flash Player Install Manager -install" An easy fix would be to change the trigger from every15 to logon. Thanks,Luke

I am working on creating a user setting and adding them to User Templets. I am working with 10.8.2 when I add the finder.plist that has disable fast user switching and then test login in I find fast user switching to not disabled. How can I make sure my User Templet has user fast user switching disabled

I've created a quick 10.8.3 BaseOS image using Composer to capture it, uploaded it to our distribution point, tried to use Casper Imaging to lay it back down and it gets stuck on "set Name to" and the screen just says Creating jamfHelper... The image itself works, I can lay it down via Disk Utility and everything seems fine. Any ideas?

Hello, Is there a way to not force the local iOS backup to be encrypted? We only have two policies deployed: one for WiFi, and the other with a web clip. However, every time people try to do the local backup, iTunes states that the iPad requires the backup to be encrypted. However, when I unenroll the device, it can backup fine without encryption. At this point, we are not planning on forcing backup encryption. Thanks, Tim

Hey, guys: I have a policy that I want to install Office 2011 14.2.3 and then apply the 14.3.2 update, but it always installs the 14.3.2 first (and fails, obviously) before installing the suite (which succeeds): Installing EN Microsoft Office 2011 14.3.2 Update.pkg... Installation failed. The installer reported: installer: Cannot install on volume / because it is disabled.installer: A version of the software required to install this update was not found on this volume. Installing EN Microsoft Office 2011.dmg... Closing package... [STEP 4 of 4] Running Recon... The two are set with sensible Priorities (10 for the install, 11 for the update). Perhaps policies don't look at the Priority setting, and Priority is only for Imaging? I'm not too fussed about it and have since acquired an installer that installs 14.3.2 to begin with, but am curious if this behaviour is normal and am wondering what a one-policy solution might be were I need to something sim

I'm new to Casper and new to scripting. I'm looking to apply a few dock items using dockutil at login once per user per machine. I am able to get the following script to run successfully via policy with a manual trigger... #!/bin/sh#### Script to add and remove items from dock using dockutil.###sleep 10# Remove Mail/usr/bin/sudo /usr/local/bin/dockutil --remove 'Mail' --no-restart --allhomes# Add OIT IP Helper/usr/bin/sudo /usr/local/bin/dockutil --add /Applications/OIT IP Helper.app --position beginning --no-restart --allhomes# Add Self Service/usr/bin/sudo /usr/local/bin/dockutil --add /Applications/Self Service.app --after 'OIT IP Helper' --no-restart --allhomes# Relaunch Dock/usr/bin/sudo killall Dock exit 0 When I run the same script with a login trigger it does not work, but it runs. I understand this could be due to login policy wanting to run as the service account for JSS but when I attempt to run it as a user I run the following and it fails b

This is a new installation for me, I am relatively new to the product. I built a bunch of self-service packages, and tested a few deployments with no issues, this has been working fine for about a week. Today it seems out of nowhere the apps installed by self-service will not open, they show "no access". It looks like the owner (original creator of the initial package) is the only one who has access. These packages were made with a local admin account (captainla), but I am not sure why apps being deployed with Self Service are taking the captainla account as the owner, when System should own the apps, right? Thoughts?

I have a specific need to disable the Check for Updates Automatically in the Java Control Panel across multiple computers. I can successfully build the plist/dmg and distribute it via Casper. However, when the Java control panel is opened, the control panel resets the setting and enables Check for Updates Automatically. Any thoughts?

I'm working on cleaning up our licensing for Parallels as we have a few different license keys that have been used over the years. I'm trying to build an Extension Attribute that either provides me the key or tell me it's "wrong". If the license key is the correct one it will have a line "key_number=" and the key will begin with "PDEI". If it doesn't have the correct key, this line either won't exist or the key will be something other than "PDEI". I'm a total rookie at scripting so what I've put together is purely by piecing together other scripts with a whole lot of trial and error. Here is what I've come up with so far. PDKey=$(prlsrvctl info --license | grep 'key_number' | awk '{print $1}') if [ $PDKey -eq 0 ]; then echo "<result>Wrong</result>" else echo "<result>$PDKey</result>" fi This is the error I get on a machine with the correct

Is anyone experiencing an issue where uploaded Winclone sets that are received into Casper Admin require multiple sync sessions to distribution points? All uses of Casper Admin have their preferences set to "Modification Date" - and yet we are constantly re-syncing Winclone items that we can confirm are on the main distribution point. I am considering doing a single checksum sync, but in our environment that will take probably about a week to accomplish. Oh and why is Winclone an "Additional Tag" and not a "Third Party Product"? Any thoughts?

Recently I checked the computer records and found thatthere's no applications in the application details (which was there before) of the inventory for some machines. And there are no errors found in inventory update policy. If I do a manual "sudo jamf recon" it will get the inventory record updated correctly with all application details. I did a manual recon with -verbose and no issues found. To get this confirmed, I ran "sudo jamf recon" on a specific machine yesterday and confirmed all applications were on machine inventory but when I checked it today there are no apps in the inventory record of the machine. It seems like the auto inventory update (daily) caused it.

I'm trying to make some smart groups to catch the Office 2011 patches and I'm going cross eyed. Forinstance... Need one for any office 2011 that isn't 14.1.xthen one for 14.2then one for up to 14.2.3then one for 14.2.3-14.2.5 to go to 14.3 or 14.3.1Now 14.3.2 is out but requires 14.3.1 Is there a simple way to do this?

I have tested/tested and tested some more. Here's all I'm trying to do; --Use JAMFHelper to put a message on the screen telling the users some magical/awesome stuff is happening (I've tried both with and without the -startlaunchd option) --Have my shell script do the magical/awesome stuff, aka trigger a policy to run. --Then kill JAMFhelper and move on. (with the -kill command) The issue I'm having is, my script waits for jamfelper to close before ever moving on to the command to trigger the policy. I'm WAYYY okay with looking silly, and someone telling me that I'm missing something very obvious, and I really hope that's all it is. Thanks Everyone!

Has anyone successfully accomplished this? Works perfectly on 10.7+ using my config profile and $COMPUTERNAME for directory username.

I've noticed on a few systems that they are checking in, they have the current binary, proper accounts enabled, etc etc. But when I push software such as Flash or Java or ... just about anything, Casper remote will report successful, but when I go and check in teh JSS it shows as still not there. This one I've logged in locally and done a sudo jamf recon verbose and it goes through and does everything... then... quits. No error, no nothign. Successfully installed Adobe Flash Player.pkg. Unmounting file server... Running Recon... Retrieving inventory preferences from https://... Finding extension attributes... Locating hard drive information... Locating hardware information (Mac OS X 10.8.2)... Executing Unix applications... Locating accounts... Locating application details... ushofml312683:~ $ Finished. I've tried re-enrolling with -prompt and -verbose and it gets to teh recon and stops again... :~ $ sudo jamf enroll -verbose -prompt JSS Username: JSS Password

I have my mountNetworkShare.sh script set as a login policy and it's restricted to run only on internal network segments. The parameters of the policy are being honored, but the share still attempts to mount when I log in from offsite. It looks like the .plist file created in ~/Library/LaunchAgents is the culprit. Has anyone else seen this? I'm mounting end-user network home folders via smb and I'm using Kerberos. The only modification I made to the script was specifying smb and the name of the share.