After kicking off the imaging process and when everything is done I sign into one of the computers and get "The imaging process is finishing installing software" and then restart. I know this is normal but our computers are continuing to do that after every restart and sign in. We have imaged using this method and image before and have not had this issue. The computers we are imaging are located in another building but we have distribution points here that have also recently been replicated. Any ideas on what could be causing the issue?

Trying to get my Webclips into the dock in a configuration profile on iOS 10 using JSS 9.96. I can push the web clips with the Web Clip tab in the configuration profile...but when I try to arrange it into the dock it doesn't seem to work. Any thoughts? Gabe ShackneyPrinceton Public Schools

Hello everyone, I am reaching out to the community to ask if anyone has tried to add a single user account from AD to ssh access on the Mac? I have tried the following Created a policy to run a single terminal command: dseditgroup -o edit -a “(networkid)” -t group com.apple.access_ssh Also I have tried scripting this out in case the com.apple.access_ssh group is not there. !/bin/bash/ dseditgroup -o create -q com.apple.access_ssh dseditgroup -o edit -a "DOMAIN(networkid)" -t com.apple.access_ssh Does anyone have any thoughts or have gotten this to work for them.

I am having an issue with our laptops that need to login to AD profiles.Before our network update, I had a Configuration Profile with the Network settings and the Certificate for the 802.1x network.Since the renewal, our issuer has changed and AD logins no longer work. I thought it would be as simple as putting the new cert in the configuration profile and be done with it. Sadly that wasn't the case, and I believe it is because the certificate roots are from a different CA. That CA is also not included in the System Keychain by default (not sure if this is relevant?) I have tried deleting the old certificates relating to our expired 802.1x cert and the CA certs as well as pushing all the new certs in a configuration profile. No dice.It seems that when I get AD logins working, 802.1x WiFi doesn't, and when I get 802.1x WiFi working, AD logins don't. If anyone has experienced a similar issue or can point me the right way, that would be appreciated.

Ever since I've started upgrading Macs running High Sierra, I have noticed that each and every one of them is extremely reluctant to shut down or restart. I get as far as the black screen with the spinning gear and that's it. I end up forcing the computer to power off after several minutes. In some cases I've let it sit there for an hour and a half and the computers never shut off. This is causing serious issues with laptops because users throw them in their bag and go home in this state. Meanwhile the computer is still "Running" and the fans spin up and the battery drains. Has anyone else seen this problem since upgrading to High Sierra? These are all in-place upgrades from 10.12.6 to 10.13.1, 10.13.4, or 10.13.6 (I've been seeing this problem for a long time)

We received some new machines that are setup for DEP, and whenever I am going into the PreStage Enrollment page to click the box to make them active, it will not allow me to save changes. Basically, the "Save" button is "greyed" out and won't allow me to add those machines in to be DEP Enrolled. This is a new behavior that I haven't experienced before. I was able to save these changes as recently as a month ago, but now it's non-functional. Also, and it might be related, in the DEP breakdown, it's naming a bunch of Mac Models as iMac 21.5" when the Description is clearly not the same type (see attachment, Macbooks and Mac Minis are showing as "iMacs"). Could this be causing the save issues since there's a mismatch? Does anyone know why this might be occurring? Thanks! ~ JYH

A few iPads that I have to rename are not taking. I'm running Jamf Pro 10.8. I can rename them "2018-iPad-XXXXX" , hit save, update inventory and when I go back it reverts back to the old "iPad" name.. Any info would be helpful . Thanks. Pics below

Do I really need to connect to any on-prem directory service in jamf | PRO if I want jamf connect to do all the work?

For years we used a logouthook to remove Student homefolders on logout. after some issues in high sierra we created a combination of launchagents/deamons to accomplish this. But in Mojave we encounter the operation is not permitted when de script tries to delete the homefolder. this is caused by the new PPPC security.How can i whitelist a script so it is able to completely remove the homefolder(s) on logout? i know you can do some tweaking with a pppc policy but really dont know how this works in our situation.

Hey, I am setting up Self Service for our company at the moment. Now, after writing scripts to install /update Apps / programs, I was wondering if it is allowed to use the apps / programs Icons in Self Service. One example is Microsoft Office. My users can update all Office Programs via Self Service. Is it allowed to use e.g. the PowerPoint Icon from Microsoft in this Self Service Policy? Would be great if any of you have some experience regarding this. I don't know if that matters but we're from Germany. Edit: I mainly wonder about Office, Google Apps (GMail, GDrive..), Adobe Apps

I want to create a policy that will set a specific user that can access Remote Management on our managed computers. Used 6 different scripts I found here and they all seem to set Remote Login with Only these users (and there is no one in the user list).Here is the latest from Apple's latest ARD (3.9)sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -on -users specificuser -privs -all -restart -agent -menu If I run this on the laptop in Terminal it does select Remote Management, but if I run this as a script, it will select Remote Login. The first time I ran it in Terminal low and behold the specificuser showed up. The next time I tested it in command line the Only Allow These Users had no name in it.That is what I am experiencing with ALL the scripts running as a policy script. None populate the specificuser and all activate only remote login. I am new to using scripts in JSS so if I miss something obvious just s

Has anyone seen this when using "Option Command R" on macOS? I have been searching for this without much luck...

I noticed one of my recently enrolled computers listed under Enrollment lists: "Today at 3:44 PM" However its currently 1:48 PM (I am on the east coast). Looking for other KB articles I see information about changing apache settings, but I am using the Jamf hosted version of Jamfcloud and all responses on this topic are quite old. I looked all over the settings and couldn't' find if local timezone or logs are configurable. Is this admin configurable or do I need to reach out to Jamf to make some apache change?

I am attempting to set a custom desktop background for all users through Configuration Profiles, and it is working. However, it is locking the desktop backgrounds, and I am unable to change it once it is set. There is an option in the Configuration Profile to lock the desktop background, and I do not have it selected, but it seems to be locking it anyway. Users need to be able to change the background after it is set. I am deploying the background image into a folder in the root directory, and simply setting the background to it using a configuration profile. Is there a better way to do this? Any ideas on why it is locked, when that option isn't selected? The only way I've been able to change the desktop background is to remove the configuration profile from the computer, then reimage it completely.

hi, I miss on the inventory-page from jamf now the following information for macintosh hardware:- size of memory- processor (i5, i7) and processor speed and an export-function as csv-file would be great. nothing ist possible at the moment, at least I can't find it? it would be very helpful for us to see instantly, if a mac is capable for specific needs (e.g. adobe creative cloud apps, music-apps, office-apps,..) many thanks, ferdinand

We are getting this error on only one computer when inventory update occurs. Message does not mean much, nothing in the associated logs on the server matches the error message. JSS 9.65Computer running OS 10.10.2 '"Gathering application usage information...Error running recon: Invalid Message - The message could not be parsed."

Yesterday I was experimenting with setting the homepage in Safari via Config Profile. It worked quite well, but it was only a test so I removed my computer from the scope and went home for the day. This morning I discovered that my computer was still locked in to the homepage I set in the test profile. I was done with my test so I deleted the profile from the JSS thinking that would definitely remove it from the computer. Nope. My computer still has the profile installed and it definitely managing my Safari homepage. I can't remove it from System Preferences > Profiles because the minus sign is grayed out. I tried using the profiles remove command but it tells me that the profile cannot be removed. How on earth can I remove this unremovable profile? I can't scope and unscope my computer to the profile since I deleted it from the JSS. Is there some magic way of removing this?

In my environment i am trying to setup our Mojave corp build with 365 and trying to take advantage of jamf passthorugh on mobile config. problem i have although all our emails are the same domain, 'conesto' for example, a small set of users have a different activation address so i cant use $EMAIL for the activation address. i have tested and although i can setup Skype with $USERNAME@fqdn old style, i cant do that with our 365 portal so its either full email or domain login................... how can i pass conesto$USERNAME as a activation value without json turning it to when it translates it from custom setting plist to MCX. i have tried to escape with but i only get it worse with \\ what am i doing wrong

We use Okta for our auth with Jamf.After a password change/reset, we sign into the Jamf Connect Sync window with the new password and it asks us for our local password (old okta password) and it is overwritten. This is all well until I look at the Okta logs and every 15min there is an invalid login attempt. After 10 attempts the user is locked out of their Okta account. After opening back up the Jamf Connect Sync window, I notice the old password is still saved. Replacing it with the new password is fine, but it doesn't update and save it for the future, therefore the invalid login attempts continue. Could this be to do with an auto auth or key chain configuration?Any assistance would be greatly appreciated.

Hello, we are more or less new to Jamf Pro and rollout our first managed Macs in a friedly user phase. Main Problem:AD usernames with - or _ in it like "muller-riha.marc" will not work. It is shaking like the password is wrong. Does anybody know anything about it? BestTristan

I'm SMH about an issue with policies that are staying in the "pending" state even though they have successfully completed. This is troublesome because the policy in question is one that the execution frequency is set to "Once per Computer". I've flushed the policies for the machine. I've even run recon on the computer and still the same issue. I have a cloud instance of JSS with version 10.12.0. Anyone else having this issue? Here is some context - The policy being run on 10.14 is using the "Execute a Command" field in the "Files and Processes" payload. The command being run is for running updates, then doing a restart: softwareupdate -i -a; jamf policy -trigger restartComputer The trigger "restartComputer" is also just a command payload running the following command: shutdown -r now Doing a recon, shows the computer was successfully updated by comparing the before and after inventory of the computer.

As a school district we have some schools that allow the students to get Apps from the Mac App Store. Because we are a school district, we obviously cannot allow admin access to those machine. Therein lies the rub. I would love to see if any of you have a graceful solution for non-admins to remove apps from the Applications folder without being an admin. This is what I have worked out so far:I KNOW I can use a script to move all apps from the applications folder to the user's applications folder.From there they should be able to delete them. (To my knowledge, please correct me if I'm wrong.)I KNOW that I should be able to exclude items from that action, Utilities folder, built-in Mac Apps, etc. I need some help getting a script together so that we can do this. If anyone has a more graceful method, I am all ears. I will include what I have so far but am limited by the string length and can only include a few apps. #!/bin/sh # current user is $3 shopt -s extglob cd /Users/$3/des

Hi,Is there a way to select 100 devices and change the asset tag for them all?There must be around this instead of doing them one by one. Thanks!

I know the title sounds illogical, but bear with me. I've been testing NoMAD and NoMAD Login AD as a replacement for our AD bind. We use LDAP group limitations regularly for policies, and also for a couple of user-level Configuration Profiles. I try to steer clear of these in general, but for things like Chrome managed preferences we're basically stuck with them. Policies seem to work fine. For example we have login Policies to mount SMB shares, scoped at the relevant machines and using an LDAP group limitation. A NoMAD Login account will pick up these policies and mount them at login. Despite being a local account, it apparently satisfies the limitation since the account name matches the LDAP account in AD (which is part of the relevant LDAP group). NoMAD itself ensures the user has a Kerberos ticket, so the share mounts without prompting for credentials, just as if we were still using an AD bind and mobile accounts. However, when doing the same thing with user-level Configuration

I have a simple configuration policy applied to my student computers which will require a password immediately upon sleep. However, 90% of the computing done in this school is done on two different websites so I have Guest User configured to access those two sites (and only those two) for the convenience of the students. However, I have noticed that this configuration policy does not seem to be triggering when the Guest User is the current logged on account. Any ideas here?