I have come across a weird issue and I am now stumped and hoping someone here can help me out. We have an extension attribute that is checking to see if Google updates is turned off using the following code: #!/bin/sh VALUE=`defaults read com.google.Keystone.Agent checkInterval` echo "<result>$VALUE</result>" If this value is returned as 0 we know that Google updates are turned off. We have a Smart Group that is set up to see if this value is anything other then 0. A policy is scoped to this smart group to run a script to turn off the updates. So I currently have a handful of machines that are reporting no value at all for this EA, which is causing the policy to apply every time it checks in. 200+ machines are reporting this value fine. If I run the script directly on the device it shows the expected value, but the EA value always returns blank in the JSS. All my other extension attributes seem to be populating fine for these machines. Anyone have any ideas?

I'm setting up some new policies, and I'm scoping them to specific computers or small groups of computers. However, almost every time I set up a narrow scope like this, there are an additional 20 or so computers that show up. One time I scoped the policy to a particular subnet, and that seemed to work properly. But every other time, even if the scope is specifically for just one computer, these extra computers show up. Any suggestions on what's going on or where I can look? I'm guessing it's something in the configuration of those extra computers (it's the same ones every time), but I can't seem to figure out what it is. Thanks in advance for your assistance.

Does anyone know where I can find the Apple Remote Desktop 3.9.x admin guide? The latest one I can find on Apple's site is 3.3. I'm trying to enable AD directory services, but the info in the 3.3 guide isn't working, so I assume there's more to it in the newer version.

Not sure if this is already implemented, but I can't find any documentation on it. Is there a way during the setup process (assuming the device is pre enrolled) to give the user a way to say what project or department they belong to? So when they get through the setup process JAMF can install VPP apps based on that group?

Is there a way to export the Management Settings or a configuration file(s) that all settings are located?

Hi Everyone, I have a policy that runs a script which grabs a users full name, splits it into 2 (first and last) and puts a . in between and then appends the domain name. The issue is that when the policy runs off of a trigger, it grabs "System" as the first name and "Administrator" as the last name. However, when I run the policy manually by running "sudo jamf policy" in terminal, it grabs the correct first and last name and the username is then inputted correctly. #!/bin/sh # Get the logged in users First and Last name firstName=$(dscl . -read "/Users/$(who am i | awk '{print $1}')" RealName | sed -n 's/^ //g;2p' | cut -d' ' -f1) lastName=$(dscl . -read "/Users/$(who am i | awk '{print $1}')" RealName | sed -n 's/^ //g;2p' | cut -d' ' -f2) domain="@domainname.com" userEmail=$firstName.$lastName$domain echo "$userEmail" #example userEmail: first.last@domainname.com # Run recon, submitting the users username which as of 8.61+ can then perform an LDAP lookup sudo jamf recon -end

Hi folks.I can prevent the following appearing:Image stolen from forums With: defaults write /Library/Preferences/com.apple.NetworkAuthorization AllowUnknownServers -bool YES However, is there a way to add our.server.ca (or any other we choose), to a "known server" list? I presume that if I were to click the OK button in the above image, it would remember the settings somewhere. -edit- uploaded wrong image initially.

Dear Experts, I would like to know what are the minimum permissions that I have to give an account so that it can do a "POST/computers" via the API. I have tried with CRU for ComputersRU for Users and still got "Error: Not authorized for a user POST" :( I tried to add 'Enrollment' but that does not improve anything. The command works when I give the account full admin permissions, but I would like to reduce the permissions to the strict minimum for this account.

Howdy All, I'm hoping someone here can point in the direction of the best path for something I've been wanting to do. I would like to create a shell script that checks for a file (Lets say a Plist) and if its NOT there, the script does XYZ functions and creates the Plist it looked for in the first place. My idea, is the script runs on a reoccurring basis and checks for the plist, as long as the plist exists, the script won't execute the addition functions. if the Plist isn't there for some reason, the script runs the additional functions and writes the Plist so it doesn't execute the additional functions again. Does that make sense? What would be a best example of this to start with? I've been unable to find anything similar to what i've been searching for. :( Thanks for any help in advance!

Hello, I recently moved my DP to a Windows server. Ever since, my AutoPKG recipes fail with an error message: Error mounting url: "smb://org.local;rwaccount:rwpass@servername.org.local:139/OIT-DiskStation/CasperShare": None The path to the DP is smb://servername/OIT-DiskStation/CasperShare In Jamf DP settings, the share name is entered as "OIT-DiskStation/CasperShare" (without quotes). Policies all work fine. I've verified the RW account works. I can manually mount the DP no problem using that account, and as I said policies have no problem executing. If I change the share name in Jamf DP settings to just "OIT-DiskStation" (without the /CasperShare), AutoPKG works! The recipes run and the package shows up in the correct spot (OIT-DiskStation/CasperShare/Packages). However, if I leave it this way, my policies then fail! I even tried setting up a fresh clean instance of AutoPKG on a new machine but I get the exact same issues there. Any ideas for additional troubleshooting ste

I noticed when I created a new policy that there are nine (9) pending runs and 5 (five) completed runs. I don't want the policy to run on those nine computers since it was not intended for them, I made the appropriate changes for future runs, but the nine pending are still listed in the dashboard.How can I cancel those 9 that are pending? is that possible?

So we are 1-1 Macbook Airs from 5-12. We attempted to use LAN School last year but had huge issues with computers not showing up in the teachers class lists. I have figured out the reason this was happening, but need some help in finding a way to efficiently fixing it. So there is the HostName, LocalHostName and ComputerName. The ComputerName and LocalHostName are correct on the machines but on a good number of them the HostName is incorrect. It seems that LAN School and Terminal use the HostName thus why we had issues getting stuff working when they differed from what we thought they were. Does anyone have any insight on a way to change this en masse?

I have a policy that uses the Dock Items payload to add and remove icons, but when i go into Self Service the policy never shows up. Is this not allowed in Self Service ?

Hi, I was in MacOS 10.13.6 and since I updated to Mojave, everything works exept when I create a new account (AD or Local), I have this message : "OS X needs to repair your Library to run applications. Type an Administrator's name and password to allow this". And when I look the user folder's permissions, I can see "Root" is owner and no user. is it a "User template" issue ? I have to upgrade 1400 computers, how can I resolve this ? Thank you for your help

I'm having some issues with the newly installed JAMF SCCM Plugin. The plugin is correctly installed with all the relevant certificates, and is able to communicate with our JAMF Pro Server and authenticate. The ISV proxy certificate is also correctly set up and referenced correctly by the settings.xml file in the SCCM Plugin. When an inventory scan happens, some machines report back all their inventory, including hardware inventory, correctly, and this is reported in the jamf_proxy_service.log file showing all the DDR discovery, software, hardware etc. However, within the same scan, and sometimes just a few seconds later than a successful inventory, another machine is able to bring in its DDR disvcovery and software inventory, but the hardware inventory shows an error: There was an unexpected error sending the hardware inventory for 'ABC1234' SMSID: F326C9CD-4E33-5BF8-AF18-C856D2253606 Where ABC1234 is the machne name, and the SMSID is a correctly assigned unique machine ID for SC

We are working on getting FileVault enabled. I have the process working on several test Catalina devices. However, we have a single device that even though it prompts the user for their password to enable FileVault, it never actually enables. One thing I have noticed that is unique on this one device is that there are 3 partitions, while all the others that do not have trouble have 2 partitions. Could this be the issue? Or is there something else going on?

This started happening today.We had to sign into three existing managed apple ids on a new or updated iPad. All three sent verification failed messages. The solution was to get a verification code from ASM and then sign into AppleID on a laptop. Once the apple id, password and verification code for the account were entered on the laptop, then the passcode could be successfully entered on the iPad.we have over 1600 Middle School students signed into managed Apple IDs on iPads.shoot me now.

So I stole the script from https://jamfnation.jamfsoftware.com/featureRequest.html?id=751 and tweaked the wording a bit. #!/bin/sh HELPER=`/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper -windowType utility -icon /Library/Application Support/JAMF/bin/jamfHelper.app/Contents/Resources/Message.png -heading "Software Updates are Available" -description "Would you like to install updates? System may need to be rebooted." -button2 "Install" -button1 "Cancel" -cancelButton "1"` echo "jamf helper result was $HELPER"; if [ "$HELPER" == "2" ]; then /usr/sbin/jamf policy -trigger SWUJH exit 0 else echo "user chose No"; exit 1 fi I also tweaked the cancel button due to when I was using it in it's default form everything returned "user chose No" and it wouldn't run the trigger. Now when I sele

I am just wondering how everyone is managing automating Office 2016 updates with Jamf? I know that MAU 4.0 is supposed to have system level settings available but as of right now it is still user level. I have a very large number of dispersed lab computers that do not normally have admins login so I am wondering what would be the best way to go about forcing automatic download and installation of updates. I am sorry if this question has been asked and answered in the past. Thank you in advance for the advice.

I just wanted clarification on this:Devices with a Managed Apple ID logged into it can still get Activation Locked?

Hi, I try to disable any usb, usb-c, or other ways of ethernet and temperately disable it. let wifi run. and then reactive when I finish my script. any way to find out active ethernet adapter and disable it? thanks!

https://www.carbonblack.com/2019/02/12/tau-threat-intelligence-notification-new-macos-malware-variant-of-shlayer-osx-discovered/ Just a heads up. I've been researching for some sort of local markers I can use to make an EA to track it/remove it via policy but haven't turned any up yet.

Hi Jamf Nation, We're excited to announce that Jamf Pro 10.19 is now available! With today's release, you are now able to try the enhancements to Google Secure LDAP, new support for Microsoft Azure SSO, the ability to use your own distribution point for Enrollment Packages, and more. Read the full release notes here. Garrett Cloud Upgrade ScheduleYour Jamf Pro server, including any free sandbox environments, will be updated to Jamf Pro 10.19 based on your hosted data region: Hosted Region Begins Endsap-southeast-2 Feb 21 at 1400 UTC Feb 21 at 2200 UTCap-northeast-1 Feb 21 at 1500 UTC Feb 21 at 2100 UTCeu-central-1 Feb 21 at 2300 UTC Feb 22 at 0900 UTCeu-west-2 Feb 22 at 0000 UTC Feb 22 at 0200 UTCus-east-1 Feb 22 at 0600 UTC Feb 22 at 1900 UTCus-east-1 sandbox Feb 22 at 0100 UTC Feb 22 at 1000 UTCus-west-2 Feb 22 at 0800 UTC Feb 22 at 1000 UTC Next StepsNeed assistance identifying the Hosted Data Region of your Jamf Cloud instance? Check out this guide to find out ho

Wow, im on a posting roll today. Im seeing a few specific folders being created as files as I log into my AD accounts on my new MBAir Image. So far its affecting Calendars, ColorSync, Components, Dictionaries, KeyBindings, Keychains, Mail and QuickLook. They all show as a zero bytes file instead of a folder which is what it should be. None of these folders are listed in the User Template and I'm starting to think maybe this is why. Maybe I'll try creating Folders with these names in the User Template (which I saw as a work around in another post). Anyone else seen this? Gabe ShackneyPrinceton Public Schools

Is there a way to store script output back to Jamf? Is it possible to do it in a way that is searchable? I would like to be able to create a Computer Search for "firewall disabled". To get the data, I could call socketfilterfw --getglobalstate in a script and report the output back to Jamf. Is this possible? Thank you!