I've been using Neagle's great tool "InstallOSXpkg" to deploy Lion and have now begun testing with Mountain Lion. That tool is introduced here: http://managingosx.wordpress.com/2012/07/25/son-of-installlion-pkg/ The problem: I can't get the right policy settings to both properly reboot the mac into its install environment AND log the policy as completed. Instead, what happens is one of three things: 1) If I set the policy to "reboot only if a package or SWU requires", the copy of the install is made but the installation of the OS never happens. The computer remains booted, just now with an "Install OS X Data" folder in the root directory. 2) If I set the policy to "reboot only if a package or SWU requires" AND also add "/sbin/reboot" into the RUN COMMAND field in the advanced tab, the copy will occur, the mac will reboot into the right environment and the new OS will install! However... the policy won't log that i

Realizations: 1) This is OT but I am asking anyone and everyone. 2) My server OS is way out of date. [10.5.8] (I took over this environment not long ago and am in process of getting new hard/software) Last night I was at home working on my server. Moving files, backing up logs...normal stuff. I was prompted to run updates on my MacBook Pro so I disconnected from the SSH sessions I was using, ran my updates and rebooted. After getting back on VPN I was able to SSH back into all machines except for this one and this is my JSS. I'm completely stuck and my fingers are sore of googling. Please if anyone has seen this before and can shed some light I would be eternally grateful. Never have I seen an OS that removed all users admin privileges. EDIT - 0Forgot to say that when you check "Allow user to admin...." it DOES give you the warning to reboot before changes can take place but as you could imaging once you reboot it's back unchecked. external image

Our inventory peeps aren't happy with the fact that Casper displays each model name exactly how Apple names it.. Meaning, they don't like "MacBook Pro (Mid 2012)" They just want it to say "MacBook Pro" or "MacBook Air" I've got the follwing ext. attribute that sort of does the trick: #!/bin/shKind=system_profiler SPHardwareDataType | grep "Model Name"echo "<result>$Kind</result>" However that returns the result as: Model Name: MacBook Pro And they still don't like that cuz they have to edit out "Model Name" Does anyone have any idea how to get it to say just "MacBook Pro" ??? Thanks!!! A

I have a script that has been working for 10.6 that unlocks Network for non admins, but it doesn't seem to work with 10.7. Anyone have any ideas what it takes to make it work in 10.7? Below is my current script I am using for this. Thanks!Alan #!/usr/bin/perl $plbud = "/usr/libexec/PlistBuddy"; $auth = "/private/etc/authorization"; $sysprefso = `$plbud -c "print :rights:system.preferences:session-owner" $auth`; if ($sysprefso !~ /true/) { print"Needs authorization file modified "; # Set system.preferences settings here system"$plbud -c "add :rights:system.preferences:session-owner bool true" $auth"; system"$plbud -c "set :rights:system.preferences:session-owner true" $auth"; system"$plbud -c "set :rights:system.preferences:allow-root true" $auth"; system"$plbud -c "set :rights:system.preferences:comment Authenticate either as the owner or as an administrator." $

Hi All. We've recently rebuilt our Master Casper server to 10.8.2.. the Replica's are on 10.7.5. I've tried the below to recreate the SSH public keys on the clients so we can re-do the RSYNC connections unprompted when running a shell script via a launch daemon. However I keep getting the error "Permission denied (publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive)." when running as root. If I run as any other user, I am prompted for a password.. so i'm guessing it's not working.. Maybe something has been left on the replica's referencing the old master? Any ideas? 1. Login to ReplicaServer as Administrator. 2. Click “Go” in the menu bar & select “Utilities.” 3. Once in the Utilities, open Terminal. 4. Enter the following commands in order on (each is on a single line). Press Enter after each command: a. sudo su b. Type Administrator password when prompted, press

I just saw the posted schedule and noticed that the sessions "Mass iOS Deployments" and "Don't Get Schooled by Your One-to-One iPad Deployment" are scheduled at the same time (Thurs 1-2pm). These sessions are both on iPad deployment and I was wondering if they could be scheduled for different time slots so that people could attend both. I'm sure there are other folks like me who want to attend both of these sessions given that they are both regarding iPad/iOS deployments. Thanks for considering!~Joe

After running Optimize Database Tables, and I was the only one using the web interface, I received all kinds of errors and then the database was completely deleted after restarting Tomcat. I restored from a backup and all is well, but heads up in case you're ever tempted to click on that link. There should probably be some sort of warning before it lets you use that feature.

Hey all, I have an 802.1x profile going out to our 384 Lion managed clients. Unfortunately when making a change (the only way, it seems, to see how many computers a profile has gone out to) it says that there are only 225 clients that have this profile. As we transition to our new wireless security, this is a big problem that 160 clients are not getting the 802.1x profile. Why would a configuration profile not be going out to all managed clients? Do I have to delete this one and try a new one?

HI all, I am experimenting with a number of MCX's in 10.8 (yeah yeah, use config profiles. I'm using MCX for some things, deal). I've made several changes to a few MCXs, the screen saver lock MCX we have, for example. Originally I had it set as this: com.apple.screensaver askForPassword acaldwell (User) always 1 askForPasswordDelay acaldwell (User) often 0 idleTime acaldwell (User) often 1200 I later changed it to read: com.apple.screensaver askForPassword acaldwell (User) always 1 askForPasswordDelay acaldwell (User) often 0 idleTime acaldwell (User) always 600 But for whatever reason I cannot get the Mac to refresh it's MCX settings. I've used jamf mcx -user acaldwell about a hundred times, rebooted, reset P

Is anyone experiencing consistent 5+ minute delay on logins for machines bound to Win AD 2008 R2 on Lion only? ML does not seem to have this issue. We've regressed the issue to the point that it might be caused by some configuration issue when using the Casper bind as part of the imaging process. I know the question is a bit vague, but I don't want to overdetermine this. Thank you!

We will have a policy set up to run between 0000-0600 (using the every30 trigger), and we want it to run only if loginwindow is the active process. So my thought is the policy will run a script, check running processes, if loginwindow is the process, run the rest of the script, else exit... Any advice from the scripting gurus? Jared? Thomas? Sean? :) Thanks,Don

Is anyone else having this issue using chrome, with version 8.61? The last item in that "headder" row wraps below and often overlays over other items. Everything displays alright with Safari - so I guess I'll have to use that if it bothers me too much.

We have made the investment in Casper to begin the process of enabling the support of Mac OSX in our Enterprise, but need to create a formal project that umbrellas implementing full support that includes all the processes and documentation needed by 1st level help desk, 2nd level desktop support etc and so I was wondering if anyone had done something similar and had a project charter/plan they could share.

with the 1.2 update now comes this popup box when trying to use it Could not find supervision certificate. Does anyone know what this means...

Grr, there's a post on here I can't find about using jamfHelper utility window to read a button click from a user as to whether or not they want to run updates. Does anyone know where I can find the code for this, or at least point me in the right direction?

So I'm futzing around with Casper Imaging and the firstRun script that it creates and have run into some frustration with Configuration Profiles and enrolling on OS X client. My test lab is at JSS 8.6 and OS X 10.8.1. There are two scenarios: I specify all of my "must be installed to the boot volume" packages to install at boot time during imaging so they get copied to the firstRun script. I also have a script that runs at reboot that names the Mac, binds it to AD, and runs a jamf enroll command. When the Mac is finished and does it's final reboot, it does not receive any device profiles. I have to log in as a local admin and run a sudo jamf enroll. jamf enroll sees that the Mac is already enrolled, deletes the entry, repushes it's certificate, enrolls it, and device profiles come down immediately. One more reboot and logging in as an end user gets user profilesto come down. Prior to running the enroll command, there isn't even a "profiles"

Hey all, I'm working on a script to rename permissions on accounts moved from Open Directory to Active Directory. As part of the checks (while loop logic) to see if the account exists I am querying AD for the GUID of the account: /usr/bin/dscl /Active Directory/$domain/All Domains/ -read /Users/$user GeneratedUID | /usr/bin/awk '{print $NF;}')" This works great for accounts that do exist in that domain, but if they don't the command fails. (I might have mistyped this from my script, but the logic works ;) ) How can I capture this information into a variable, and have sterr ignore the cases where the command populating the variable fails?

How do you log into self service? Trying to get the limit by groups mechanism to work properly and when a policy is enabled on all machines and scoped to specific groups it still isnt visible under Self Service unless i remove the AD Group. Any ideas would be appreciated

Hi All, I had this before 8.6 & hoped 8.6 resolved, but what we've found is that some MCX settings that are set to Once (READ: User Level At Next Login Only) are being applied Often (READ: User Level At Every Login). Anyone else seen this? is there a Defect-ID?

I've created an Adobe Creative Suite installation, but it only seems to work if you are logged onto the computer as an admin user. As a standard user it doesn't do a full install. Anyone have an idea on what I'm doing wrong?

I've created an Adobe Creative Suite installation, but it only seems to work if you are logged onto the computer as an admin user. As a standard user it doesn't do a full install. Anyone have an idea on what I'm doing wrong?

I'm looking at how to help track down ipads and thought if we had 843 open from the outside and casper logs the IP from a users home or another business (which will be obviously different from our own), is this standard practice, advisable and/or a security concern?

Can't login to my JSS is saying Alerting Table Plugins :( What the heck does this mean!!!! Its been this way for almost an hour.  --Matt Lee, CCA/ACMT/ACPT/ACDTSenior IT Analyst / Desktop Architecture Team / Apple S.M.E / JAMF Casper AdministratorFox Networks Group

I am getting a standard configuration setup and I was curious how people arranged their docks. With OD MCX, you just drag and drop them into the order you want in WGM and it applies the icons in that order. What is the best way to manage a dock via Casper and make sure the Icon are in the correct order? It seems like it sorts them alphabetically when I add Dock Items into a Policy. I've also tried importing a com.apple.dock.plist into Managed Preferences and it didn't like the nested Dicts.

Maybe it's not supported or maybe I'm doing something wrong but when I try to create a Self Service policy and scope it to an AD user group it doesn't show up for the user. The same policy scoped just a computer or computer group works fine. Also, when I change the trigger to login it works. Is this normal behavior or am I missing something here?