I have LAPS currently setup in my environment and I would like to make another script that uses the password stored in the LAPS EA for running some commands. I am having a difficult time making a variable that is set to the stored EA in JSS. Any help would be great!

We've been setting up a lab and 4 of our 10 Mac Minis have old policy profiles on them even after being deleted from the JSS. I've booted into the recovery partition in hopes of using terminal to locate and delete these left over profiles. Normally I'd just re-image them but the teacher has software & files they don't want to lose. Does anyone have any suggestions on how to go from here?

hello, I just tried to configure my first patch management policy with Google Chrome and I got this notification on the scope. Should I stay the target like this because it will be automatically or should I change the scope to all computers? because I don't want to push the latest version to everyone, just to people with an old version of the application. I'm confused about this notification.

I've been trying to create a Composer pkg that places pre-configured Google Chrome settings into the User Template from ~/Library/Application Support/Google but when I deploy this package to my test machines the settings won't apply and going to the Chrome settings provides the following message of "Some settings were reset" So I know that other threads recommend using the Google Chrome Master Preferences via JSON coding but here's my dilemma: I must include an extension, Color Enhancer in this case, but this extension must also be disabled by default. Basically they only want the user the have the option to go to Extensions and enable Color Enhancer if they want. While I think there are ways to use the Google Chrome Master Preferences and also add an extension I'm not aware of how to programmatically disable an extension BEFORE the profile in ~/Library/Application Support/Google has even been created. To add to my problems the PC packager has this working on our Windows clie

does the 'display login window as name and password' get automatically set when the mac gets bound to AD ? if i wanted to have this for macs that are not bound to AD, is there a script to have it done, or a payload property somewhere?

Basically the title. We would like to prevent certain users from using Bootcamp on their Macs. I can't seem to figure out a way to prevent this. I know it sounds dumb but this is coming from above me, plus the thought of supporting 2 operating systems on one device doesn't sound fun.

Hi jamf nation :) Is it possible to put a Policy or script or something to the Self Service?That would be important so the Helpdesk can tell the User that they triggered a software for reinstallation or activated some software for them and they can press a button to speed up the installation. (not get the software magically installed in the background) Thank youBRDaniel

Does anyone know if there is a way to restrict iCloud usage on devices with Jamf (or Windows) to only allow a corporate domain to log into a device's iCloud? For example, I work for www.cool.com...and I have a macbookpro, but I can only log into iCloud with a userABC@cool.com email address. I cannot log into iCloud with my personal coolguy@gmail.com address. I tried to search this topic, but I only saw references to VPP and I didn't see anything there that described this.

Maybe I'm going crazy, but I don't remember the JSS default MDM profile created when the Mac is enrolled in Casper as being removable. Now it is in Macs enrolled in our JSS (v9.72).. I can't seem to find any setting that specifies removable or not.

I tried to find something on this and came up empty. I am surprised that we have not been asked this yet, but is there anything that anyone has done to show the clients when an active Remote session is in place? When it terminates?I know some of our clients at some point will bring this up, and I thought I'd ask before I get asked. Scott

Hi Folks, I'm trying to create an extension attribute to get the MAU status. By the script is working fine: But using the same code to create an Extension Attribute is not working. Does anyone has a tip to solve this? Thanks in advance,

There are a few threads on here regarding this (some started by me) but I'm having a heck of a time consistently disabling Spaces on client machines for Smarter Balanced testing in a few weeks. To disable manually, you go to System Preferences-Keyboard-Shortcuts and uncheck these boxes. This screenshot is from my machine running 10.10.2 but the same boxes exist in other OS versions. Unchecking these boxes modifies the ~/Library/Preferences/com.apple.symbolichotkeys.plist. Last year with version 6.3 of the browser I created a custom configuration profile with this plist as the payload set to the computer level. Worked great. Now with version 7 of the browser, not so much. Even after deploying a config profile, checking that the boxes are unchecked, the SBAC browser still thinks Spaces is enabled. If I manually check and uncheck the boxes, the browser launches fine. So there is something that is finalizing the update to that plist that is only getting done by manually mak

Our school district is piloting the Smarter Balance assessment this spring. One requirement of the testing is that Mission Control/Spaces is disabled. Through the GUI, you do this by going to System Preferences-Keyboard-Shortcuts and unchecking the box for Mission Control. It appears unchecking this box modifies the com.apple.symbolichotkeys (amongst others) preference file. The problem I'm having is that this is a user-level preference and most tips I find online are for local users, not AD users. Anybody have a fairly painless way to do this rather than touching each machine?

Hi All, We're currently in the phase of moving away from Centrify to Casper and use a script that basically, removes the AD object from the machine, with a service account. Then utilises the Centrify Uninstall script and force uninstalls centrify with no interaction, after the uninstallation is finished we install Casper via the QuickAdd.pkg created in recon and a couple of custom written prompts to re-name the machine to a new naming convention then update the Inventory database. The Mac is rebound to the domain via an enrollment policy based on the naming convention smart group. So the machine side for us is fine. My question comes now when migrating the users profile what is the best way to migrate the users profile and keep the data and preferences in tact, what i've been doing is playing with the following command: sudo chown -R firstname.lastname:'DomainDomain Users' /Users/firstname.lastname The user then logs into the Mac for the first time after being bound with Casper, on

I'm having an issue with a client installing McAfee 10.6.2 on macOS 10.14.5.I have a custom install, following McAfee's method that only installs threat prevention.When the install is finished McAfee is running but TP is not enabled. Using the McAfees preferences it can be switched on with no errors or warnings.using the same install on 10.14.3 works as expected with TP enabled. Doing testing using a full install, i.e. not customised at all, has the same end result. TP not enabled but the other two services are.According to McAfee the kexts for this version are notarised and the kext profile is deployed and correct for the version.using kextutil, above, shows that the FileCore kext loads with no errors but trying to load AVKext it can't find Filecore kext. anyone else getting this issue?

I'm running the following script by hand in Terminal which works successfully to mount our user's homedrive: filteredLDAP=$(ldapsearch -LLL -x -h our.domain -b "OU=People,DC=mds,DC=ad,DC=dur,DC=ac,DC=uk" "(sAMAccountName=$USER)" homeDirectory | sed 's/[^:]*: //;2q;d' | sed 's////g')connTYPE=$"smb:"connCONCAT=$"$connTYPE$filteredLDAP"open $connCONCAT When I add the script to self-service, nothing happens - I think it's because the script is being run as root and not the current user. Is that the case, and if so, how can I amend to run successfully? Thanks.

I was building an dmg in Composer and selected APFS, I must have check remember the selection because now I am not being prompted to choose between HFS+ or APFS. Is there a way to clear that?

Kinda weird issue that I just started noticing but it seems the "eject" option is not showing up with external media on 10.10.2. If you right click, eject is not an option. If you drag to the trash, the eject icon shows up but does not eject the media. If you use the dockutil command in terminal, it does eject the media but that is obviously not ideal. Apple's recommendation/instructions are to log out. restart and/or shut down and remove the media before restarting. Also not ideal. Has anyone else seen or encountered this yet? And if so, what solution have you implemented? Any feedback would be appreciated.

Hi everyone, I've recently inherited a JSS, and they have configuration profiles and policies go to certain smart groups. The criteria for these smart groups is based on if the machine has a specific plug-in. I need to create a new plug-in, but I'm not sure if I'm doing it the right way (I'm doing a touch command to write the plug-in to /Library/Internet Plug-Ins/nameofiplugin.plugin. I can successfully create a zero kb plugin file, however I can't get it to appear as a criteria option in the JSS. The previously created ones are under that however...

I've been able to identify the agent installed and process running. My problem is that I cannot figure out how to detect the version number of those. Awesome community has lots of Extension Attributes for other security agents, but I didn't have any luck with these two.

Hi All, I am working on the workflow for deploying 10.14.5 to our machines and while testing the desktop workflow, keep getting this I searched earlier and found the solution of adding a custom config profile with com.apple.MCX as the domain and "<key>cachedaccounts.askForSecureTokenAuthBypass</key> <true/>" as the main entry in the plist. However, after trying this twice, it still prompts me for a secure token for each user that logs in. Am I missing something? Thanks

Hello JAMF Nation, I could really use some assistance in FORCING the 10.14.5 update to my mac users, the problem is that I gave them the option in the first place to download it and install it. I opened the door for these users to never update despite my efforts. Now, I want to force it to install but being extremely new to JAMF and not knowing how to really write scripts was wondering if anyone had any workflows I could use that would do this very thing. And being so new a quick visual would go a long way as am a hands on visual learner. I have tried to push it out via a smartgroups and command actions but it does not work. I also tried creating a policy and adding the .dmg as a package for installation. I added my test machine to the scope and it says it installed restarts the computer as part of the payload but never really installs. My Guess is since it's a .dmg and needs to be mounted I have to have a script to get this done. Thanks In Advance.

Howdy, I am testing the process for updating the computers to Mojave for my end users, but I'm running into an issue. No one seems to be talking about it, so hopefully it is an easy fix. I've been following this process: https://github.com/kc9wwh/macOSUpgrade Which I remember working fine for High Sierra, but when I run the process now, it only works for users that have admin rights. For non-admin users, it gets to the fullscreen splash and gives a prompt asking for admin rights. I've tried a few things, but I can't get around this issue. The issue was also raised on the Github page, but I was hoping one of yall would be able to help me out, or at least show me an alternative update method that I can push down to non-admin users.

With the new Outlook app being the security nightmare it is... I find myself wanting to block it. Seems like this isn't possible in Casper... is that a correct assumption? I've never needed to block an iOS app before. Would a config profile "poisoning" the app's settings somehow work?

Hi Guys, Just wondering if you are packaging and deploying un-notarized apps still in your environment. I'm not sure whether we should still be allowing and packaging these apps since this will make upgrading to catalina much more difficult...since they won't run in catalina. lemme know!