JAMF is attempting to install my VPP apps but its asking me to login to the AppStore on the iPad. What am I missing that the account isn't being applied to the iPad so it can just download and install the apps?

Without JAMF implementing the Enrollment Optimization to make DEP enrollments work reliably on WiFi, I'm testing doing the enrollments on ethernet. It works great because it's never losing an internet connection, unlike on WiFi, so the policies set to run at "enrollmentComplete" never fail to run. The problem I'm having, and I'm not savvy with certs at all, is that the 802.1x wifi authentication isn't working after the user gets to the desktop. The WiFi keeps trying to authenticate and doesn't. The easiest way to fix it is remove our SSID from the preferred list of networks, click "Connect" and it prompts for their username and password. A couple things to note. These are not bound to AD. We are pushing out a G2 and L1K cert. Using PEAP. The WiFi and Certs config profile are installed at the computer level. Any direction would be great. Thanks!

The Patch Policy for Firefox lists 65.0.2 as the most recent version. This was only released for Windows. The latest version for Mac is 65.0.1.

Hello all, I'm trying to find a script to enable guest user on 10.13. I've found a couple of scripts that do that but with one problem, they all create the guest user that restarts the Mac and allow access to Safari only aka single-app mode. What I'm after is a guest user to log in to a normal screen where he/she can see the dock and open certain apps. The main part of the scripts I tried is: defaults write /Library/Preferences/com.apple.loginwindow GuestEnabled -bool truedefaults write /Library/Preferences/com.apple.AppleFileServer guestAccess -bool truedefaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server AllowGuestAccess -bool true

I'm trying to modify this script so that I don't have to hard code the values in it, and instead utilize the optional script parameters $4-whatever. I've looked at some of my other scripts that utilize this method and tried to import into this, ut it doesn't seem to work the same. Can someone take a look and help me figure out where I'm going wrong? I get script exit code 2, and unexpected EOF at line #94 #!/bin/sh ############################ AD_Bind_ARD ########################### # Patrick Gallagher | patgmac@gmail.com # http://macadmincorner.com # This is a script that will bind a Mac to AD from ARD. # Modified from Mike Bombich's ad-bind-login-tiger.sh script # which can be found at http://www.bombich.com/mactips/scripts.html # Needs to be modified for your enviornment #################################################################### computerid=`/usr/sbin/scutil --get LocalHostName` # Standard parameters domain="" # fully

I got a script containing encryption to be used in a policy on Jamf (v10.71). When I excecute the script locally on the test device it uses openssl 1.1.1, when I execute the script on the same test machine, but initiated by a Jamf policy it uses openssl 0.9.8 8 (and subsequently fails due to unknown commands). How can I force Jamf to use openssl 1.1.1 when executing the script?

Hello Jamf Nation, Wiping & reinstalling the OS Now to see if that does it (hoping it does) but if not..heres the details. Hardware: MacBook Air - Core i7 (Early 2015)Operating System: Mojave 10.14.3Jamf Pro Version: 10.7.1Server: Self Hosted / On-Prem The computer is in our DEP just fine & in the PreStage Enrollment just fine. It even shows up as assigned "Less than a Minute Ago" - The Problem? The Problem is that even though the "PreStage Enrollment Status" is "Assigned Less than or X Minutes Ago" - the MDM / Configuration Available screen at first boot / initial configuration does not appear & all of the 'Setup Assistant' options are showing whether they are flagged or not. (They are all flagged to not display during enrollment - for the record.) I have never seen/experienced this before & after hours of troubleshooting, here I am! Any Thoughts?

Suddenly I can't pull any VPP apps down via Self Service. On two machines, I get the same result. PKGs I've uploaded appear to work fine, but VPP stuff gives the error in the screenshot. Clicking reconnect gives a DONE and apparently successful checkmark, but it still doesn't work. It will usually throw me out to the App Store, with GET leading to asking for a login. Thoughts?

I have NoMADLoginAD working great, user logs in for the first time using the NoMAD login window, it creates the local account with the same credentials as their AD Account. That works great. I then remove NoMadLoginAD from the security login, to return it to normal login screen - just the user icons - this works great too! I install and configure NoMAD on the workstation via policy, and I set the following via policy; #!/bin/bash AD_domain="mydomain.com" # Write default AD domain defaults write com.trusourcelabs.NoMAD ADDomain "$AD_domain" defaults write com.trusourcelabs.NoMAD UseKeychain -bool "true" defaults write com.trusourcelabs.NoMAD LocalPasswordSync -bool "true" defaults write com.trusourcelabs.NoMAD SignInWindowOnLaunch -bool "true" defaults write com.trusourcelabs.NoMAD UPCAlert -bool "true" #Add to login items osascript -e 'tell application "System Events" to make login item at end with properties {path:"/Applications/NoMAD.app", hidden:false}' exit 0 As you

Hello all, Does anyone know if a configuration profile is reapplied after macOS is upgraded? I have a config profile approving a handful of KEXTs. The profile was applied while the Mac was running High Sierra. They've now upgraded to Mojave and are complaining a few apps weren't working. Turns out, the KEXTs needed to be manually approved locally. Thanks

I had to change the verbiage in our login screen config profile, the laptop shows the updated config profile under Sys Prefs --> Profiles, but when I shutdown / power on the laptop it's not displaying the changes at the FileVault login screen (retains the original information).

I'm looking for a way to check if an app (in this case MS Office apps) has been installed via the legacy installer, or if it has been distributed by the Mac App Store. I don't see any difference in the Info.plist Does anybody know how to achieve that goal ?

Good afternoon, I am trying to figure out the syntax for the wallpaper API. I have tried a number of combinations and no luck. Anyone have an idea? It looks like you would use the POST verb. The URL looks like it would be: https://jss.com:8443/JSSResource/mobiledevicecommands/command/wallpaper The XML appears that it would be something like this: <mobile_device_commands> <size>1</size> <mobile_device_command> <id>XXX</id> <command>Wallpaper</command> <wallpaper_setting>1</wallpaper_setting> <wallpaper_id>DeviceName</wallpaper_id> or <wallpaper_content>BASE 64 Encoded jpg or png</wallpaper_content> <mobile_devices> <size>1</size> <mobile_device> <id>12345</id> </mobile_device> </mobile_devices> </mobile_device_command> </mobile_device_commands> Here is the documentation for /mobil

Hey everyone, So I'm sure a lot of you are aware that when someone signs into an iCloud account on an iPad and enables "Find my iPad", you have to either have the password for the account to remove it, get the user to remove it via Apple's web interface, or use an Activation Bypass Code from MDM after resetting the device via iTunes. Now that my test iPad is on IOS8, I can't reset it via iTunes without having the iCloud password first. Is there a new process for removing iCloud accounts on IOS8 using Casper? If there's a mention of it in the documentation I apologize--haven't had time to read as we have an impending rollout! :) Thanks for any help,Cameron

Does anyone have any experience reporting on what version of Computrace a machine has? Its an elusive "application" but I want to be able to report on it. Is there some code maybe in an Extension Attribute that could be used? Thanks in advance for the help!

Is anyone else having this issue? Its been a few months where i will get a notification for every single discussion or feature request made, even if i never looked at them. Ive gone into my notification settings and there is nothing that jumps out to disabled this behavior. So far im up to 3910 notifications!

I am probably just being really silly, but how do you add a peripheral to an existing user? I can see nothing in the documentation either

Are apps that are (legitimately and not the bug) no longer in the app store uninstalled from ipads or do they remain until the user deletes them or other?Thanks!-John

Is anyone able to update apps using the msupdate -i command after updating to MAU 4.4? It no longer finds updates even though my apps are all 16.17 and when I msupdate -c... it's blank despite my com.microsoft.autoupdate2 plist being populated correctly and with the Office 2019 app array correctly listed. msupdate finds nothing, while MAU via GUI finds all the updates I need. O365 licensing. Happens on 10.13 and 10.14 with 100% repeatability. Have no 10.12 machines to test on.

Having some difficulty figuring this one out. I am looking to add a counter to my While loop within Bash. I have /usr/bin/profiles checking to see if a configuration profile has made it on to the machine before continuing on. This config profile will make its way to the machine after the script removes a cert in key chain which in turn will remove it from a smart group via recon. After this action, it will become relevant to take on the config profile. This while loop on the other hand will wait for the config profile to come down, but I would like it to time out after say... 20 loops. Here is the snippet (sensitive info will be subbed out) #!/bin/sh Profile=B2173820-3729-2819-2839-389283382192 lookUp=$(usr/bin/profiles -C | grep "${Profile}") while [[ "$lookUp" == "" }}; do echo "Profile does not exist, will continue to check" sleep 5 lookUp=$(usr/bin/profiles -C | grep "${Profile}")

Hey! I've been testing the new 10.13.4 update. As we all now, new Kernel extensions need to be either approved by the user or via Configuration Profile. Along with 10.13.4, we are testing Google File Stream which installs a Kernel extension. I can't find the Team ID anywhere online to whitelist it. Called Gsuite support but the Tier 1 Support didn't even know what I was talking about. Hoping that someone else has come across with the same issue.

What header does a jamf webhook (json) have? I’m trying to use Microsoft Flow (to send to teams) but having some difficulty. If I test with Postman using the example data here: https://developer.jamf.com/webhooks#computerpushcapabilitychanged, it only succeeds if I add header Content-Type: application/json but fails if I do not.

Hi, all. I'm wondering about recommended methods for changing the password of the local management account, which is enabled for FV2. After running a policy that changes the management account password, the stored FV2 password is not updated and I have to login with the old password. Even after logging in at the login window (which should sync the FV2 password), I still continue to have to use the old password at the FV2 pre-auth screen. I tried running another policy to enable the management account for FV2 but this hasn't changed anything. Thoughts? Thanks,Eric

I code signed a script, put it in a tar.gz and then created a custom PKG using the Packages App with a post-install script to move the file into its place -- Packages App found here. I followed this guide by Carl Ashley found here I have a MacBook Air that it installs on successfully (macOS 10.14.3) Just got a brand new MacBook Pro that it fails to install on (macOS 10.14.3) It puts my pList into the right place but it appears my post install script, which unzips the tar.gz and moves the file -- fails...causing the PKG to fail to install. Not sure why this is happening. I followed the guide from Carly Ashley and I'm just wondering if its the post install script. Here is the code i'm using: #!/bin/bash resources=$(dirname $0) target_vol=$3 package_bundle_id=$INSTALL_PKG_SESSION_ID /usr/bin/tar -xpf ${resources}/file.tar.gz -C /Library/Scripts/Folder /usr/sbin/chown root:wheel /Library/Scripts/Folder/mount.sh I pulled this directly from the article. Like I said it wo

In our environment we use a custom Guest account to be used in the break room. We have a script that runs on startup that sets the dock the way we need it for that environment (SetDockItems.sh). Mojave's user approval requirement means that any time the machine is rebooted or the user logs in, they need to allow the script that sets the dock to run. Does anyone know of any workaround for this so we don't have to rely on user input? Thanks!