I'm attempting to purge all of my deprecated updates from our NetSUS server (just upgraded to 3.0.2). Navigating to /var/lib/reposado and executing the following: repoutil --purge-product all-deprecated I get: repoutil: command not found I can see the command listed in the directory. I've tried running as root as well. Thoughts?

Is there a way to collect System Report information through Casper? Our MBAs are getting to the age where the batteries are starting to fail and are showing Service Battery under the battery health info. Even when asked to inform me when this issue surfaces, many of our students will ignore my emails. AppleCare on these computers will be ending soon and I want to get new batteries in the ones that need them, without having to touch each computer. I would like to be able to set up a smart group where the computer will enter if the Service Battery condition is present. Thanks.

Good day, I have been out of the loop for a while when it comes to Apple management. I'm trying to grok Apple Business Manager... I had a discussion with a former associate who said that you can upload your older machine serial numbers via CSV to ABM in order to add them. From my testing, this does not seem to be the case. Upon import, I recieve the following error "INVALID INPUT" Can someone please set me straight on this... can I or can I not retroactively add devices to ABM that were not originally purchased with DEP/ABM? Thanks,Ken

Looking to stop check in for one machine for a few days/week. Is this possible? Im not sure where to start this

I have a fairly simple package that I created with Composer to install a VPN configuration profile and some additional settings that can't be done with the profile. I'm doing this for machines that aren't managed but I'd like to get this working to sign QuickAdd packages too. We are at a University and I have a Developer account in a Team subscription. When I use the certificate I created and installed into my KeyChain, I get an error message when I try and create a Package: productsign: error: Could not find appropriate signing identity for “Apple Development: David London ... . An installer signing identity (not an application signing identity) is required for signing flat-style products. I can't see an Installer signing Identity when I look at the choices in Apple Developer - Application signing. Is there possibly some other level other than just a Developer that gives me more than these three options? Apple DevelopmentSign development versions of your iOS, macOS, tvOS, and w

I started leveraging JAMF to patch Zoom.us which is working great so far. It installs in /Applications, but I am finding many users have it installed in their ~/Applications folder, leaving the older version in place. I need to remove it from their ~/Applications, but running into challenges. I am new at bash, but I tried running the script rm -rf ~/Applications/zoom.us.app , but it's not pulling it from logged in user's directory. I tried, sudo -u $(ls -l /dev/console | awk '{print $3}') rm -rf ~/Applications/zoom.us.app , but these are standard users and getting permission denied messages. Our mac's are not shared so doing it in currently logged in or all users' ~/Applications directories are fine. Any help is appreciated, thanks.

If i go to: -Computer-Search InventoryNo matter how simple the string i enter, it shows no results.Could anybody help me utilize the search function?

Has anyone been able to block users from using Office 365 while still allowing users to install Office 2016? I've got a handful of users who want all the bells and whistles of 365 so they buy their own account and install. Our company is supposed to only be using VL Office 2016.

I'm seeing an issue where once we apply the Mojave update to a machine, the MDM profile then gets listed as unverified and other pushes (IE apps and other profiles) don't come down until I remove the MDM and re enroll the machine. Then of course I have to navigate to the profiles section of system preferences and approve the new verified mdm profile. Is this normal behavior or is there a work around? I've tried removing the MDM profile then doing a sudo jamf manage command, however I get an error saying "Error installing the computer level mdm profile: profiles install for file: '/Library/Application Support/JAMF/tmp/mdm.mobileconfig' and user 'root' returned -915 (Unable to contact the SCEP server at"https://ourserver.com:8443//CA/SCEP".) Not sure If maybe I'm doing something wrong. Gabe ShackneyPrinceton Public Schools

I'd like to pass a file name via a default script parameter into a bash script which calls an osascript, but am running into problems. I've been fiddling around with something like the below, but am continually getting errors. The script does work perfectly if I hard-code the full path, and the file exists, so it must be something to do with pulling in the parameter. $4 is set to green.png in my policy Any ideas out there? #!/bin/sh if [ "$4" != "" ] then osascript -e 'tell application "System Events" to set picture of every desktop to ("/Library/Desktop\\\\ Pictures/$4" as POSIX file as alias)' fi exit 0

Hi,I have a policy that deploys the macOS Catalina installer to /private/var and that uses the Files and Processes module to run startosinstall. I have the policy scoped to one computer right now and set to run once per computer. The mac will download and run the macOS upgrade, but the policy never says completed in Jamf. As a result, the policy keeps repeating itself on the already upgraded mac. The mac will get to the login screen, but then it will reinstall macOS Catalina once I log into the mac.

So I have a strange issue where my configuration profiles are not being pushed out to my machines. Mainly my profiles that are the fonts. I removed the framework and reinstalled it to test. This reinstalled most of my profiles but only four of my hundreds of fonts. Also a few of my management profiles such as login window doesn't push ether. No consistency to what fails or why. I have also ran jamf recon, mcx, and manage, and policy just hoping but no luck. Anybody have this issue?

Hey folks, I want to add a Freshservice agent that is deployed through a PKG to several computers to be allowed file access through a Jamf PPPC payload. However, the file itself does not contain an application, and creates mostly a .plist and several files in the under-layer of the system (currently checking what exactly). Is there a way to find the Identifier the Code Requirement for a process that is not an .app file, and how?

We wish to migrate to macOS Catalina and the Kerberos SSO Extension. We have previously used AD binding. As part of manually migrating a computer, we put it in a static group called "Unbound". This group is scoped with configuration profiles for Kerberos SSO and is excluded from profiles that bind to AD. My question is about new computers coming into the environment. Is there a way to automatically put new computers in this group prior to enrollment? I don't see anything about group membership in PreStage enrollments. (I also have about 40 Macs coming onboard from an M&A where there's no DEP.) As I type I wonder if it would be better to put the existing computers in a static group and reverse my logic on the profiles. But any ideas are welcome. Thanks. (Running Jamf Pro 10.15.1 on-prem with a 10.19 upgrade scheduled this week.)

So I've run into an issue that is driving me batty... I run the standard terminal command: security add-trusted-cert -d -r trustAsRoot -k /Library/Keychains/System.keychain /path/to/cert.cer and I get: SecTrustSettingsSetTrustSettings: One or more parameters passed to a function were not valid. If I go to keychain access, it added the cert... but not as "Always Trust". Which is essential for this cert. It's set to use system defaults and just says "This root certificate is not trusted." I have re-exported the cert from the windows server and I get the same thing every time. No matter what, it won't import as Always Trust. Any ideas folks? Additional note... when I go to delete the imported cert from keychain manager it throws up an error that says: "An invalid record was encountered." I have to restart Keychain Access 1 or 2 more time for it to allow me to delete it.

I have a test JAMF Pro server (10.20.1) on Red Hat that has the MySQL on another Red Hat server. It almost looks right but some odd things are happening machine searches in the web interface for all machines (nothing in the search field) bring zero results but if I search explicitly for a machine I know is in there by typing its name, I find it Accessing the API gives <computers> <size>0</size></computers> so that agrees in a way to the first point. Unfortunately it looks like this issue has been in there through several upgrades so restoring is probably not going to fix it. I'd like to get it back to a point that I trust it. Given that it's a test server, would it be simplest to just blow away the database and recreate it? If that is the way, will the Tomcat server re-configure the database with all the tables as it does its first connection or do I have to re-do its installation too? Regards, David

Good Morning! Is there an updated script to hide the iCloud Setup Wizard when users first login? Here is the version I have been using for Mojave (which works fine until you install any OS updates or upgrade the OS): #!/bin/sh ## # Writing out launchd item to disable the iCloud login wizard every time the os version is increased/patched. ## echo " <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.markIcloudComplete.plist</string> <key>LaunchOnlyOnce</key> <true/> <key>RunAtLoad</key> <true/> <key>ProgramArguments</key> <array> <string>/usr/local/bin/markIcloudComplete.sh</string> </array> </dict> </plist> " > /Library/LaunchDaemons/com.markIcloud

I'm looking at collapsing all the sites into "None" in our Jamf Pro server. Just wondering if anyone has done something like that? The API looks like it might be able to do this. Basically I think I need to iterate through all the computers and change the site to "-1" and the id to "None" Is anyone able to give me some pointers? Regards, David

Anyone know which Classic API endpoint will show whether disk encryption is enabled on a host ? I've been playing with the API for a few hours and I haven't figured out how to find the same data you would see by "computername -> Disk Encryption"

Hey all,Trying to find a way to have jamf helper post a message that has clickable links. Perhaps one of the buttons could be set to go to that link. If not I could always push a link to their desktop and just have them double click it, but I'd rather it be inline.Gabe ShackneyPrinceton Public Schools #!/bin/bash # Determine OS version osvers=$(sw_vers -productVersion | awk -F. '{print $2}') dialog="Thank you for being a part of the Mobile Access Program! Please click on this link http://mylink.com to compete a brief technology usage survey. Signed, Gabe Shackney Technology Office Princeton Public Schools" description=`echo "$dialog"` button1="OK" jamfHelper="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper" icon="/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/AlertNoteIcon.icns" if [[ ${osvers} -lt 7 ]]; then "$jamfHelper" -windowType utility -descriptio

I have an an issue where I need to update some user fields in the API but I don't really know where to start. In summary, I need to loop through all users and for every user whose 'managed_apple_id' field is blank/null I need to copy the data from the 'roster_managed_apple_id' field to the 'managed_apple_id' field. Does that make sense? Is anyone able to help?

I'm probably missing something. I'm trying to implement some of the scripts hosted here on the JAMF Nation board for keeping Adobe Reader, Chrome, and Google Earth up to date. If I run the script on a computer, I have zero problem. It executes perfectly. Creates a log file like it's supposed to, updates or doesn't update the app. If I set up a policy and have it run at check in I get CA019 rgendler 10 minutes ago Failed Executing Policy Chrome Install/Update No log file created, no feedback, nothing. Am I missing something?

I would like stop users from upgrading to 10.15.4 due to these warning messages coming up for legacy system extensions. Currently users are admins on there laptops and we don't have a separate Software Update Server. What's the best way for to do this and give them access back again once software providers have updated their software.

Hi Folks, Just a simple heads-up. If you have multiple domains, make sure to use port 3268. Reason is this is the Global Catalog that contains ALL information of the forest in read-only. You need to know which Domain Controller is your Global Catalog. Ask your AD administrator. This should solve some issues like:- queries taking very, very long (had 20+ seconds, now less than 1 second)- don't get all group memberships (remember, you need universal groups)- Wilcards not working properly -- Was seen by @Serge My example: See you.

I've tried as root, still blank. No updates found from the update server when I do softwareupdate -al. Package receipts from the following command show it is up to date. Does anyone know where the command softwareupdate --history pulls its data from? I'd like to remove it and see if it re-populates, at least the latest patch, after the next patch cycle. I use the results from this command to populate the 'latest os/security update installed' to a field in jamf via extension attribute. Currently this system shows blank in that field on the JAMF Pro server as a result. for i in `ls /System/Library/Receipts/*.plist`; do defaults read $i | egrep -i "(PackageIdentifier|InstallDate)"; done InstallDate = "2019-07-24 18:25:21 +0000"; PackageIdentifier = "com.apple.pkg.CompatibilityNotificationData_10_14.16U1819"; InstallDate = "2018-11-21 14:17:06 +0000"; PackageIdentifier = "com.apple.pkg.Core"; In