Hi, I have been using the same set of scripts for the past 3-4 versions of Mac OS which will redirect the users profile folders (Desktop, Documents, Downloads, Movies, Music & Pictures folders) to the users Active directory home folder. I mount the home folder in the users profile and then create symbolic links to the various profile folders to folders within the AD home folder. If i select each of these folders, i can see the contents that is stored on the network home folder (e.g. if i click on the documents folder, it shows me the contents of the documents folder which is located on the AD home folder) The problem is the desktop (although it redirects ok) it does not show the files on the actual desktop. If i try to copy a file to the actual desktop, I get an error of "The operation cant be completed. An unexpected error occurred (error code -8055)" So in a nutshell, everything appears to redirect ok when i browse the actual folders within the local user profile, but not

Hello, In order to have the time to check that every of our apps is compatible with the new upgrade, I've used the "restricted software" to prevent users from upgrading to Big Sur. At the same time, software update are set to automatic so they can still get security updates. But obviously, Apple is trying to force user to use they brand new OS, so they notify user about downloading it. Is there any way to prevent that ? Users won't stop reaching to us because they can't install an update.

I want to scope a VPN install at a AD security group. Can this be done and how?

It's been awhile so I completely forgot how to convert an iPad that was original not purchased under the Business Manager to a DEP iPad. I know you have to use the Apple Configurator.

As the subject states.... in macOS Big Sur they have officially killed the --ignore flag, now what do we do? I imagine we can still restrict major version updates, but what happens if there is a incremental update that needs to be restricted for whatever reason?

How does the "Defer software updates for X days" thing work? Does it count days from the release of an update OR does it count the days from when the computer is made aware of the update? Here's the scenario:- I have the setting set to defer 1 day.- a Mac checks for updates and there are none available on this day- The Mac is shut down - Apple releases an update the next day.- 5 days later the mac is turned on Should that Mac be able to install the update right then since it has been more than 1 day since the update was made available? I would think so. However, in practice I am seeing that the Mac still says that the computer "is running the latest software update allowed by your administrator" until at least the next day (day 6). I haven't been able to find any clarification on how this process works. The way it's working now is not how I need it to work.

I'm using dockutil and loving it. But I'm hoping to accomplish one thing that may not be possible: Is it possible (with dockutil or otherwise), to add a network share point with a custom icon?

Add the process name of big sur and a message is optional here is a screenshot hope this helps anyone that needs it! Restricted software

Hello all. Since upgrade to Big Sur, the following EA script seems not to work properly anymore, as it always gives result "Not available". Any idea how to fix this? #!/bin/sh apiURL="https://xxx.jamfcloud.com/JSSResource/computers/udid/" apiUser="xxx" apiPass="xxx" MacAdd=$( /usr/sbin/networksetup -getmacaddress en0 | /usr/bin/awk '{ print $3 }' | /usr/bin/sed 's/:/./g' ) udid=$(/usr/sbin/system_profiler SPHardwareDataType | /usr/bin/awk '/Hardware UUID:/ { print $3 }') siteName=$(/usr/bin/curl -s -u ${apiUser}:${apiPass} "${apiURL}${udid}" | /usr/bin/xpath '/computer/general/site/name[1]/text()' 2>/dev/null) if [[ $siteName ]]; then echo "<result>${siteName}</result>" else echo "<result>Not available</result>" fi Thank you and best regardsChristian

Hi All, My company does not currently have an LDAP solution in place, but in the meantime I would like to implement a way for the user's full name from the local account to be automatically populated into the JSS Full Name or Real Name section of the computer profile. I've been scouring other threads, but I haven't found a definitive answer to what I'm looking for. The closest I've gotten so far is adding the local account username into the JSS. Thanks for all the help!

I'm working on upgrading from 10.12.4 to 10.15.7, and running into some trouble. I've set up a policy utilitzing the Catalina Upgrade script on Github - https://github.com/kc9wwh/macOSUpgrade My issue is that - the policy will try to download the installer three times, then fail due to a checksum error. macOS Installer Downloaded 3 Times - Checksum is Not Valid Prompting user for error and exiting... 0 Now, I don't really care about having this script kick off the other policy to download the installer. I've already got a policy for that, just drops the installer right into /Applications, and it works fine. I've already got it staged on all my computers, ready to kick off once I'm through with testing. I'm just looking for a GO button at this point. I just want to cut out all this automation for calling another policy to download the installer and verify the checksum, but I don't really know how. I've seen another poster with the same

Hey all, I got curl to download the QuickAdd.pkg directly from the JSS's enrollment URL but when it does download, it's a 1kb file and installer bombs out. Any thoughts in my syntax? cd ~/Desktop; curl -O -k -u jssUserName:jssPassWord https://my.jss.com:8443//flatpackagedownload/QuickAdd.pkg Basically, trying to script the download and install of the QuickAdd. I've tried as well using the -L option, but still downloads a 1kb file. As always, thanks in advance. -pat

I just updated my computer running Mojave to the latest Security and Safari updates. Ever since then when I am in the New Computer Package and click on Choose File I get no dialog box so I can't upload a package. I have noticed this same behavior for other websites also. I have no issues if I use Chrome so It appears to be something with Safari after the update. Any ideas on what might be the issue?

Hello! I'm trying to loop through a CSV of device serial numbers, extract those serial numbers as variables, use the variables and the API to get the JSS ID of the mobile devices as another variable, then use this new variable to execute some remote commands on the devices : #!/bin/sh while IFS="," read serial; do echo $serial jID=$(curl -sku $apiUN:$apiPW -H "Accept: text/xml" $apiURL/JSSResource/mobiledevices/serialnumber/$serial | xmllint --xpath '/mobile_device/general/id/text()' -) curl -sku $apiUN:$apiPW -H "Accept: text/xml" $apiURL/JSSResource/mobiledevicecommands/command/RestartDevice/id/$jID -X POST done < ~/Desktop/TestFile.csv However, whenever I run the script get the following errors : -:1: parser error : Document is empty My CSV is a .csv created in excel with a single column of serial numbers and no header. Is it possible that there is an error there? Or can I not loop and use these variables in the csv? The actual command I will be doing fo

First ever post! I would like to have a policy that places the installer in the Applications folder of macs in preparation for upgrading. One method I will use for Macs not yet on Catalina, is to create a package with the Install macOS Big Sur.app. When I place the installer app (a 12GB file) in Composer, the package it builds is only 15MB. I am using Composer 10.25.1 on a Catalina mac. Thoughts?

Departing employees have the option to buy their computer equipment at a fraction of the cost. Our offboarding process includes removing JAMF and leaving a user account as an admin. We recently got a message stating that the user cannot upgrade their OS (the message shown is an old version of ours). It appears as if the restriction is kept in a local cache and not removed upon removal of JAMF. Any ideas on what are we missing during offboarding?

Basically the title. We are moving on from Centrify but the existing mobile accounts still got the old Centrify search path. How do we change this? See image:

I have created 2 policies to install the 10.15.7 upgrade on systems that are on <10.15. The first policy Caches the installer.pkg and the second installs the cached package using the startosinstall command. I have configured the install policy to display a Start message, and deferral option. Restart options are set to "if package or update requires", and Maintenance is set to update inventory. I have also set a server side limitation to make the policy active after a specific date and time. I am testing on 2 machines and on each the start message pops up correctly, I select start now and in about 5 minutes the computer automatically restarts and the update installs. After the install and sign in with user, the Start message immediately pops back up and the only way to dismiss is by deferring the upgrade or starting. And therefore I am stuck in an endless loop of software upgrades. The interesting thing is on one of the machines the policy log shows as completed, but it con

Question for those running macOS Catalina I recently noticed that devices deployed with FV2 FDE require either a known user’s password or the FV2 Recovery Key when booting into the Recovery Partition. Has anyone here dealt with this scenario: Don’t know the user’s password Don’t have a known/working FV2 Recovery Key Here's the flow...1. Command+R+Power = Boot into Recovery Mode2. Answer Challenge Question: User Password or FV2 Recovery Key3. Wipe Disk/Reinstall macOS, etc. How does one get past this roadblock? Thanks!

I got an email last night, from Apple, regarding a replacement for the Volume Purchasing Program, Apple School Manager Apps & Books. It is fully described at this HT. We have 2 VPP tokens, and a couple of apps that got licenses on each token - one of those apps is paid. That makes distributing the paid licenses a little complicated. Well, one of the features of ASMA&B sounds like something that could help us unify into a single account. The Apple article states that our MDM vendor must support the new functionality, so my question is: Does Jamf Pro support ASMA&B?

Hey All, I'm running into an issue with PPPC where I can't install a profile because it must originate from a user approved MDM server? We don't use DEP here, but I've re-enrolled my machine to test with via UIE, clicked approve in system prefs, segmented profiles (I was planning on combining it with a kext profile for the same app), and I'm not sure what I'm doing wrong. Attached is a screenshot of what the PPPC payload looks like. Any help would be greatly appreciated so my team doesn't have to head here and click for every machine:

Is it possible to make an installer display the interactive installer dialog when deploying via self service?

Hey All,We just had a successful roll out of a one-to-one with MacBook Airs and I wanted to share some of what really worked for us. We started with imaging, which we use DEPNotify to prompt to name the computer and then run the installs for base software. (We asked Apple to setup our order but they had so many issues and delays that we canceled their setup and ended up setting up close to 2000 on our own using labs and our office, along with 100 Belkin ethernet adapters, and we ended up being able to image from 200-300 a day ). Our base system has Chrome, Firefox, Cisco Umbrella, Zoom, Adobe Creative Cloud (just the desktop app) and Microsoft Office Pro installer. I also install DockUtil and Desktopr to set each desktop and dock as they logged in. The last prep work I did was create a ton of TCC profiles to allow my various scripts and applescripts to work: We then had handouts where we kept all the machines on wired connections for the first login (still binding, dont ask) an

does anyone have this enabled in a policy ?does it actually work? Perform authenticated restart on computers with FileVault 2 enabledRestart FileVault 2-encrypted computers without requiring an unlock during the next startup so basically you have an encrypted mac, it's running a policy that requires a restart (software install policy, OS X update etc..), so when the policy 'restarts' the computer, the computer will bypass the 'encryption login lock' and go directly to user login screen ?

Hello there, I was wondering if there is a way to convert Mobile accounts from Open LDAP (Mac Server OS) to local accounts as I noticed that some of my users are not getting all policies/configuration profiles to work right and I assume its because of this. Thank you all. EDIT 1: Solution in comments below.EDIT 2: Once we removed the "mobile" from the accounts everything worked out fine.