Im trying to install a policy through SelfService and keep on getting the following error. Where am I supposed to add the option "-allowUntrusted"? (yes I am downloading it from the App store to rebuild the package new but I am just wondering if anyone knows where it is located, we may have to do this a couple more time)

So, here's an issue...I'm whitelisting KEXT's via config profiles. Run the following to find team ID and identifier via terminal.Which is good.Until I tried to find the bundle ID and Identifier for this little beauty " Legacy Developer : Hzsystems..As you can see, I can see th ebundle Id, but no team Identifier.... Thoughts????

Hey there! Probing this community to see if anyone else experienced this issue and how it was solved. We've got a few computers, that for an unknown reason, appear to have their Touch ID undoing itself from allowing computer unlock. The Configuration Profile is currently set to allow Touch ID unlock. This is intermittent across our organization, with a large portion of people who are unaffected. But those that are affected, the only step I've seen help is rebuilding the entire OS. Apple was unable to provide details on where this plist regarding TouchID is located, and I suspect an interference with SIP is why it's unable to reauthorize the new settings. I've blasted away /Library/Managed Preferences/, and I would like to know a solution other than reinstalling the OS, if anyone here was able to solve it in a cleaner manner!

I'm trying to push apps out to an iPad and they are all coming back with the error "Cannot connect to iTunes Store". I know I have licenses for all the apps. My DEP connection is current. All of my VPP Accounts connections are current. When I go into Global Management Settings there are exclamation points by GSX Connections (we never set this up), VPP Accounts, and Device Enrollment Program. I checked Apple's status site and everything related to those is green. My DEP says it synced a minute ago. We're running Jamf version 10.13.0-t1559772983 on a Windows 2008 Server VM. (We need to migrate to a new VM before we can upgrade jamf any further). Any thoughts?

i am testing Dock Master (http://errorfreeit.com.au/blog/2015/4/28/dock-master) and it created a mobile config from the site. When I create a new configuration profile in JSS how do I apply the mobile config? do I use the custom settings payload and upload the mobileconfig ? or should i just use the Dock payload in the configuration profile ? whether its the mobileconfig or the Dock payload being used I want all existing and NEW users to get this Dock or how can i use a current test users ~/Library/Preferences/com.apple.dock.plist and using Composer create a dmg out of this and apple it to FUT and FEU ?

Hello, we're currently using vpp.itunes.apple.com and I'm aware that this would end December 1, 2019. I'm just preparing all the pieces to migrate to Apps and Books in ASM. Deployment of apps, will it be different? What we're doing now is, buyer will buy apps in vpp.itunes.apple.com and Jamf admin will add this app in Jamf and would be able to push out to devices specific devices. Will this be pretty much the same process in Apple school manager via Apps & Books? Thanks

Just a simple question on creating config profiles to approve kernel extensions. I only use the teamidentifier. what is your opinion on creating a config profile for each kernel extension you want to approve? or creating one single config profile with all the kernel extensions you want to approve? 5 seperate confg profiles to approve each kernel extensions?or1 single config profile that approves all 5? and why?

Hi everyone, I'm looking to find information on how to setup an on-premise AD CS service as PKI CA for Jamf Pro, including enrollment certificates. It seems that this particular part of integrating with Microsoft AD CS is undocumented, and now I have my infrastructure guys responsible for AD CS to ask what type of certificate is being issued on enrollment and which certificate template is used when issuing said certificate? Anyone who knows this? And does anyone wish to share his or her experiences with this type of setup? Thanks in advance! -Søren G.

LanSchool, once installed, needs to be given permission under Privacy/Accessibility. I was looking at trying to automate this using PPPC but the issue is there isn't actually an app in the Applications folder to point to. Ideas?

I have created an app in automator that asks the user to contact IT. I built it as a pkg and uploaded it to jamf. I built a policy to install. All is great, but I need it to run it after it installs. Any thoughts on getting this done? Basically we are trying to let the user know to contact IT immediately and have this spoken repeatedly.

After the new update many teachers are complaining that when they disconnect from Apple TV via Airplay they are getting the ads for shows/movies . These are in the banner of Apple TV menu, they find them distracting and trying to find a quick way to filter or block them. I've had them scroll down so that the banner isnt on the screen, it is a temporary work around as it will eventually default back up. Looks like there isn't any filters on restrictions on Ad content in JAMF. Any info would be helpful

An ongoing issue at many locations for AD bound macs is that if the users change their password incorrectly their keychain does not sync. 10.14.4 and up compounded this due to the 'update keychain' prompt not working and just creating a new keychain. For us we use User based network certs so a user getting a new keychain also means they can't get on the network or VPN. I've written this script which is linked to a jamf Self Service policy that replaces the Login keychain with the old login-renamed-1 keychain. as well as updating the password and setting that to the default. It prompts the user for the current and previous password and if the user gets both those right everything works great! However i'm trying to build in a test to verify that the users previous password is correct and that part is not working. Anyone know of a command line way to determine if a keychain is locked/unlocked? Here is the entire script: #!/bin/bash ##UPDATE KEYCHAIN PASSWORD username=$( scutil <&

When I drag a package into Casper Admin, it no longer computes (or at least no longer stores) checksums for packages that are uploaded into it: This is with JAMF Pro v9.101.0. There's nothing in the release notes for that version about a known problem with computing checksums. Computer Management --> Security --> Package Validation is set to "Never". Any other setting results in a verification failure. I can't find any relevant error messages in /var/log/jamf.log or /var/log/system.log. Any ideas?

i run the following command to get the TeamIdentifier to create the config profile for kernel extension, but then the teamIdentifier for this particular application comes up as 'not set' codesign -dv --verbose=4 /Applications/YourApp.app the application is Cisco AnyConnect Secure Mobility Client.app does this mean i can't create the config profile to approve kernel extension? so when this application get's installed the user will get the popup and will have to 'allow' it ?

Looking at a specific patch management policy log, an attempt to install shows: Error: Could not connect to the HTTP server to download (null) It seems like the package name isn't being interpreted correctly. Any idea on best way to try and fix this?

Using Casper Remote I have not been able to find a detailed error log. Can anyone tell me where it might be? Would it be on the Casper Server or the Remote Mac initiating the .dmg? In Remote the install stops at Verifying Computer's Identity..., so it gets past authenticating then the next line says Verifying Computer's Identity... and eventually times out and the software is not installed. I am hoping there is a log somewhere giving me more information. On Macs that do get the software installed I see a line that concerns me and wonder if anyone can offer insight as to what problems come of it. It gets to Verifying /usr/sbin/jamfvnc... the next line says /usr/sbin/jamfvnc does not exist. Then continues and successfully installs the software. Anyone see where this might be a problem or should I just ignore it?

I want to be able to push out a specific setting in Powerpoint to all my users so that we don't have to manually enable it each time we provision a new machine. A few questions, Is this possible to do with a config profile that runs a script which edits a specific plist file? If so, where is the plist file located and how do determine what to change within the plist? My users are using Office 365. I've attached a screenshot of the setting I'd like to enable.

Good Morning, With the latest versions of Google Chrome (Version 45.0.2454.85 (64-bit)), when printing, by default Chrome uses its own built-in Print Preview functionality. i.e. it doesn't use the System Print dialog display. I want to disable Chromes built-in Print Preview functionality completely so whenever an end-user prints, it uses the OS X native system print dialogue but I can not seem to turn off Chromes built-in Print Preview functionality. I have tired using the defaults write option: defaults write com.google.Chrome DisablePrintPreview -boolean true and also remapping the Command-P functionality using keyboard mapping (http://ryan.mcgeary.org/2012/09/13/disable-chrome-print-dialog-use-osx-instead/) but neither approach works. Oddly enough, when the defaults write option is actioned, the Chrome .plist (~/Library/Preferences/com.google.Chrome.plist) reflects the change (DisablePrintPreview, Boolean, Yes) but still operates using Chromes' own Print Preview funct

We know in OS X a local administrator also don't have the right to access other users' home folder, such as Desktop and Documents. If you try to click on them, you will see a red minus and it says you don't have permission to access it. There is another thread talking about going to "Get info" on the folder and change permission that way. But it doesn't change the sub folder. So I end up trying to use chmod -R command to change the permission on /users. However, I have two problems:1. I don't know the correct syntax to use to just give Local Admin RW right using chmod command. It looks like I am giving everyone or domain admin the full access. I can't get this right.2. Even you have given the full access to Local Admin to the /Users folder, when a new AD user logs in to the computer first time, his home folder will become unaccessible to Admin again. And I have to chmod again. Any other way to get this done besides setting this command as login p

Today I replaced the SSL cert for one of our storage servers. I used the JSS built-in CA to create the cert and installed it in the usual manner. While everything appears to be fine on pre-Catalina clients, the Catalina clients fail (refuse?) to connect to the server. When enabling debug mode I see the following: Tue Oct 15 18:44:50 catalina jamf[26008]: [DEBUG] Failed to download bom file https://mdm-stor-1.x.y/Packages/ONLYOFFICE-5.1.pkg/index.bom to /Library/Application Support/JAMF/tmp/index.bom: Connection failure: "The certificate for this server is invalid. You might be connecting to a server that is pretending to be “mdm-stor-1.x.y” which could put your confidential information at risk." Tue Oct 15 18:44:50 catalina jamf[26008]: [DEBUG] Downloading flat package https://mdm-stor-1.x.y/Packages/ONLYOFFICE-5.1.pkg... Tue Oct 15 18:44:50 catalina jamf[26008]: [DEBUG] Exception caught (code -1202). HTTP result code: 403 When using curl from a Catalina client and I feed it the pr

When I install Kaspersky Endpoint Security on High Sierra, I get the "System extension blocked" message. I know I can go in and allow the kernel extension under System Preferences -> Security & Privacy.That just keeps me from automating this for the enduser... Have any of you gone about this new security feature in High Sierra in any clever way, so I don't need to either do it myself on every device, or disable checking kernel extension entirely (which I don't want to do) Any feedback is highly appreciated. Thanks.

I am installing GlobalProtect during our initial imaging process and it installs just fine. However when I try to test it the application never prompts for the login credentials. After I uninstall it and install it manually the login credential window pops up like it should. Anyone have any thoughts on what might be going on? To create the package I just dragged the .pkg housed within the .dmg downloaded from PA website into Jamf Admin. I am wondering if perhaps I need to set some kind of file ownership back to the logged-in user or change the way I create the package but I am really not sure.

Hello Jamf Nation! I have a script we've been using to install various apps in Self Service that no longer works in 10.15. Wondering if anyone can tell me why. It worked fine in 10.14. In 10.15, I can run it in Terminal from the logged in user, but I can't get it to work when I run it as a policy. An example of the script is here (in this case, to install Chromium): #!/bin/bash clear && rm -rf ~/updtemp && mkdir ~/updtemp > /dev/null && cd ~/updtemp ############################### # Define functions # ############################### versionChecker() { local v1=$1; local v2=$2; while [ `echo $v1 | egrep -c [^0123456789.]` -gt 0 ]; do char=`echo $v1 | sed 's/.*([^0123456789.]).*/1/'`; char_dec=`echo -n "$char" | od -b | head -1 | awk {'print $2'}`; v1=`echo $v1 | sed "s/$char/.$char_dec/g"`; done while [ `echo $v2 | egrep -c [^0123456789.]` -gt 0 ]; do char=`echo $v2 | sed 's/.*([^0123456789.]).*/1/'`; char_dec=`echo -n "$c

We have had some complaints about the non standard HTTPS port Tomcat uses. I know that to modify the port used I need to modify the server.xml file in the Tomcat directory. I am thinking I could change the port or try a redirect. Has anyone attempted this? I am afraid client communications may be messed up if I change it.

Does anyone have a simple PowerShell script to delete a device out of Jamf via device serial number? I have a Mac sh script with curl, but need this in PowerShell.