Hi everyone, We're new to Casper and are trying to figure out the best way to address a few issues. We have a select number of machines that are "presentation laptops" that we want to loosen up energy saver settings on, but keep the majority of our machines on a normal energy saver policy. Ideally, I'm thinking of having a static group for the presentation laptops, then a smart group containing all machines less the presentation laptops static group. Unfortunately, I'm not seeing any options within smart group creation to handle this. I was thinking we could achieve this by setting the machines to a particular building or department and going off of that, but we have some other items that may conflict with this (i.e. policies to install printers / set time zone based on the building, running other scripts based on department). Any ideas/suggestions?

During installation process we specify how often we want computers and mobile devices to submit inventory reports to the JSS as well as how often we want computers to check in for policies. Is there a way to check the values once they were set?Is there a way of changing these settings later on, please?

Hi all, I'm always behind with my updates but it seems I need to run this one cause we now got Adobe CS 6. Just read the Requirements list of the JSS Installer that my JSS box needs to have MySQL Enterprise or Community 5.5 My jss has Ver 14.12 Distrib 5.0.92, for apple-darwin10.0 (i386) Do I need to update it to 5.5? Thanks in advance.-pat

Anybody using Managed Preferences to either prevent access or use read-only access for external drives? I've tried testing this, but my experience appears to be: LionWorks as long as it isn't fat formatted Snow Leopard Deny Access: Works as long as it isn't fat formatted. Read Only:read-only for HFS. After using a fat formatted external drive, which ignores the mcx itself, any subsequent use of HFS external drives are now read/write as well. Anyone confirm/deny this experience? If it can't handle DOS formatted, then it's pointless configuring any of this for external drives. Thanks Sean

Hello all, We are having an issue getting a prestage to execute. I have limited the scope to network segments, but when a machine is netBoted within that segment it doesn't pull the prestage settings. The run count is 0 in the JSS. It fails to run regardless if the machines are managed or not. We are about to image a few thousand machines that are currently not in the JSS and would like to have the the auto-login/configurations set per network segment. Any thoughts?Do I need to create a policy to assist with the prestage? Thanks! AG

I've been using a bash script run daily by a JSS policy to mount a Windows server share, synchronize its contents locally on every machine and then unmount the share. This has worked until Lion came along. It seems that 'mount_smbfs' won't authenticate properly when run as root. Here is the stripped down script with comments and error checking removed: CLIENTPATH=/Users/Shared/Test SERVERURL='//DOMAIN;botuser:password@server.designory.com/Test' SERVERMOUNT=/Volumes/Test SERVERPATH="/" mkdir "$SERVERMOUNT" /sbin/mount_smbfs -o nobrowse $SERVERURL "$SERVERMOUNT" /usr/bin/rsync -aEu --exclude ".DS_Store" --exclude "Thumbs.db" --exclude ".T*" "$SERVERMOUNT$SERVERPATH" "$CLIENTPATH" --delete-after chmod -R u=rwX,go=rX "$CLIENTPATH" diskutil unmount "$SERVERMOUNT" This works just fine when run as any user other than root. Anyone else mounting SMB shares via a s

Following the instructions in "administering file vault 2 with casper suite", I created a package to assign a recovery key to our imaged workstations. After imaging my test box I activated the encryption manually and was presented with the message stating that the key had been assigned and merrily encrypted the drive. Before making this production I decided to unlock/decrypt the drive by booting from a USB drive with our imaging image and using the FileVaultMaster.keychain (the one with the private key intact). Unfortunately this is what I receive: CasperIMG:users root# security unlock-keychain /Key/FileVaultMaster.keychainpassword to unlock /Key/FileVaultMaster.keychain: CasperIMG:users root# diskutil cs listCoreStorage logical volume groups (1 found)|+-- Logical Volume Group 0896F511-CDA6-4838-B9D1-83C4F71400A5 ========================================================= Name: Macintosh HD Sequence: 1 Free Space: 0 B (0 B) | +-< Phys

Since the 8.5 upgrade I can't seem to build reliable DMGs with composer I have tried different build folders and external drives but after the build when I mount the DMG I have this... external image link Not sure what my issue is. Anyone else having the same problem? Cheers

So, I have two links that point to our local scholastic server for Educator Access and Student Access. I would like to have the dock icons/links available as a self service item. From my workstation, I had the two weblinks in my dock, and added them to casper admin as new dock items. In casper admin they show the path as file://localhost/Users/myname/desktop/scholastic.webloc/ and on top of that its NOT showing up in self service, I have it scoped to all computers and triggered by none or self service. Should casper reflect the path as my local machine, vs not having a path and just collecting the address of the actual web link? Maybe I just need to apply it as a policy, and not self service....Anyone added simple web links to the dock via self service?

Hey everyone. I just downloaded Lion from the App Store and extracted InstallESD as I always do. When I loaded it into Casper Admin it tells me it is not a valid installer. Has anyone ran into this with the current version of Lion or a previous version? Thanks!

I have a xserver that is running the JSS right now. At some point it became enrolled in our inventory but I no longer want it there and I don't want it managed. I know i could enter in the terminal command to remove the JAMF framework, but I just wanted to check to see if that would break something with this Server actually running the JSS. Any thoughts?

Hi All, I need to disable Safari's pop-up blocker. The older way of doing this does not seem to work on Safari 5.1.5 http://macmule.com/2010/09/25/disabling-safaris-pop-up-blocker-from-terminal/ the below works: defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaScriptCanOpenWindowsAutomatically -bool YES But when attempted via MCX nothing seems to be set.. any ideas? (mcx below). Display Name: Safari Disable Pop-Up Blocker Application Domain: com.apple.safari Key Name: com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaScriptCanOpenWindowsAutomatically Key Type: boolean Key Value: true

I've successfully packaged previous versions of Adobe Camera Raw without issue but every method I've tried with ACR 6.7 has failed. This install works between composer snapshots but once it is packaged and pushed out it fails to install. Casper logs are showing a successful install but the version of ACR on the client machines remains at 6.6. Does anyone have any tips or workflow ideas for this?

Folks, I was thinking that it might be interesting to try to assign admin rights to directory users via Self Service if the SSI item availability was controlled via an LDAP group. It would let us apply an external process to control a local provisioning of admin access. Assuming that the LDAP group was visible and I scoped the policy, that just leaves me with the small matter of adding the user to the group. Would I just be best off using the scripts for dsgroupedit? http://managingosx.wordpress.com/2010/01/14/add-a-user-to-the-admin-group-via-command-line-3-0/ and then simply set the script as a login script using the $3 variable for the user name? I guess where I'm confused is that I just want to be sure that I only enable as an admin the user that installed the self service admin item. I'd appreciate any and all feedback on this!

Getting this error on first login to fresh machine that has 10.7.4 and latest Java (2012-003) from Apple. We'd like to turn it back on for the users through a policy or (better) during the imaging process. Any ideas? external image link

I just fresh install Casper Suite 8.52 and testing enroll iOS device to inventory.On my iPad first enroll step "Install Root Certificate" is ok but it will show error whengo to next step install "MDM Profile"Our iPad wil show "https://mac.server.com:8443//enroll/SCEPProfile?invitation=26434324345454543" is invalid. Is any people have same issue too?

I'm testing creating images with instadmg. I placed the image in Casper Admin - without having created an admin account in instadmg. I set my configuration with Ensure computers are managed, username and password set for the admin account. After imaging the machine, I can't log in as the admin. I can log in with my ad credentials, and my managed, mobile account is created. Looking at Users and Groups, I see the admin account and my managed, mobile account. The issue is that the password doesn't work. Anyone else seeing this problem? Do I need to create the admin account in instadmg? (I also saw this issue with taking installing the esd.dmg and not setting it up. Setting up a system and then using composer works... I just wanted to move the the 'clean' image. (for systems that are reimaged - will be using the thin image concept for new hardware) Oh- running JSS 8.43

Is it possible to use a profile to add a wireless network to a system at time of imaging? Double clicking it works fine, but I require no user interaction. thanks.

Has anyone sucessfully migrated using Open Directory on 10.5 to active directory? Any help would be very much appreciated.

Is it possible to delete a compiled configuration? I have one left over form last year (I've not re-compiled yet) and when I replicate its slowing the process down. I feel it must be in the manual someplace dammed if I can find it....

Is there a command or tool we can use to create a password hash so it can be used in a script for JSS? In the "old days" (pre 8.4) when Recon used to spit out QuickAdd installers with postflight scripts that included hashed passwords, we were a couple'a clicks away from hashing passwords. But now that QuickAdd "enrolls" computers, we lost that nugget. So what's the best way to turn a password into a hash? Is there a command line trick? Or is there a GUI doohicky that can do the trick? I guess I'm not a hash guru (never touched the stuff myself although my buddies did when I was stationed in Turkey...but I digress...), figured I'd check in with the group. Thanks,Don

It seems that i can use Casper Imaging to deploy an image if i create one. Has anyone done this yet? Any problems etc. Also does the recon.exe go on the Bootcamp image somewhere and will I still be able to get an audit on the Mac when its booted into bootcamp all the time?

Hi all, I am looking for some assistance in setting up a local password policy for my Macs that are not bound to AD. Right now, they all have a generic password set, but due to increased security standards, we need them all to require a password to unlock the screensaver (which is now set to kick on after 15 minutes). Is there a way to force a user to change that generic local password? And if there is, can we force it to match our AD password policy (8 char, 1 upper, 1 #, etc)? I see the OS - Local Password Policy in the extension attributes, but can't decipher how to make that work on my machines. Any help would be greatly appreciated. Thanks.Lindsay

How can I get Lion to set the Airport SSID and password in the imaging workflow? I have used the command.../usr/sbin/networksetup -addpreferredwirelessnetworkatindex en0 "SSID" 0 wpa2 "password" This works great on the Macbook Air I am imaging, but I can't seem to get it in the imaging workflow. I always have to manually run this script after it reboots from being imaged.

I'm in what appears to be a reboot loop. Imaged with the 10.7.4 ESD, and the Apple Software update add-ons, then a 3rd party disk encryption app and an 3rd party AD plugin (which should and does bind on first boot). The machine has a post boot install and it seems like the postboot.sh scripts in /Library/Application Support/JAMF/PostBoot/ aren't getting removed. As a result I see the same things over and over and over. On the next login, I see the JAMF banner 'The imaging process is finishing installing software' I can see the line to remove the postboot.sh, launchdeamon and script itself in the script yet the files remain after the restart, triggering a loop. Am I mis-using the 'this app must be installed to the boot volume at imaging time'? I'd assumed that this was to be used for Apps that weren't 'imaging friendly'.