In Mac OS, when you have your login screen configured to show a list of users (as opposed to a username/password text box combo), each user is accompanied by a large circular image. This is alternately known as a 'User Picture' or a 'Login Picture'. All users have such an image even if they are the generic gray silhouette image. Furthermore, when you enable network users to log into your mac, and have the login screen configured to show a list of users, the User Pic that accompanies the 'Other...' user is a special login picture, which is a gray silhouette of three individuals. Like this: I would like to change this image so that I can have a more fun picture for the students in my school to click on when they want to login with their network account. I do not know how to do this. One idea I have, and it is really more of a brute force idea, is to find that image on the hard drive and replace it with a picture of my choice. I am open to other ideas, however. Does anyone know how

Good day and thank you for taking the time to read this! I am trying my hand at modifying configuration profiles manually. I create a base template in JSS, download it, convert to xml and strip out all the stuff I don't want. I then rename it with the mobileconfig extension and upload it as a custom configuration profile in JSS. I then scope it, push it down, and it appears. However, the problem comes in when the configuration profile for some reason changes from the time I edit it to the time it gets uploaded and pushed down. Settings that I had cut out were added and ones I wanted in, were not. Does JSS modify a custom profile to any extent when uploaded? Or am I missing the proper way to do this entirely? A quick example is I am setting up a configuration profile that enables iCloud Keychains + allows for Safari Autofill. These are the only two settings aside from the xml's normal metadata. When I take a look at the settings once it is installed, its cleared out some of what I h

Hey, I am trying to setup a virtual mac environment for testing. I have a MacPro 6,1 and I'm looking to run A MacOS Mojave 10.14 off it. What is the process to get this up and running? I have ESXi 6.5 installed on the MacPro, the environment is all setup but when I try to build a VM with Mojave 10.14 and try binding it to JAMF the MDM profile fails to create and I think it has to do with the Mojave VM not being registered to Apple. The binding process only works for physical macs with serial numbers registered to Apple. Is there a specific way to bind 10.14 OS? I have tested it with previous MacOS versions and I was able to bind, it seems the 10.14 OS has a new bind process. Also whats the EULA around this? Is the way I am doing this legit or do I require other licencing? Any help will be greatly appreciatedThanks

I'm using mysides to add mounted network shares to our user's sidebars. It works great for share names containing no spaces, but we have some shares that do contain spaces and i'm having no luck with them. Here's my script: #!/bin/bash # Add Sidebar Shortcuts if [ ! -e /Users/$3/.sidebarshortcuts ] then echo "Adding Sidebar Shortcuts" su - $3 -c "/usr/local/bin/mysides add public file:///Volumes/public" su - $3 -c "/usr/local/bin/mysides add personal file:///Volumes/anthonymc" su - $3 -c "/usr/local/bin/mysides add design file:///Volumes/design folders" su - $3 -c "/usr/local/bin/mysides add accounts file:///Volumes/national accounts" su - $3 -c "/usr/local/bin/mysides add photostudio file:///Volumes/photostudio" touch /Users/$3/.sidebarshortcuts fi So out of the above shares everything gets added to the sidebar fine except for:/Volumes/design folders/Volumes/national accounts I've tried using quotes as well as the backslash to tell it there is a s

Hi, In the second week of october i am going to attend Jamf 400 in Amsterdam, just curious if there are any tips n tricks i can already practice on :) Cheers,Thijs Xhaflaire!

So I implemented a handful of Team IDs in a Configuration Profile for auto approval. These were working fine and my policies were installing no problem. Then Mojave happened. Even with the Profile loaded I still have to approve each KEXT in the firewall when enrolling a Mojave Mac. Anyone else see this?

Hey there, I'm currently rolling a new software out (to a few hundred endpoints) with JAMF pro. I do it with a policy that installs the .pkg and the scope is every user that has not installed it yet.It does work for all the endpoints except about 10. These 10 endpoints get the following error: Executing Policy program name Verifying package integrity... Installing program.pkg... Installation failed. The installer reported: installer: Package name is Program installer: Upgrading at base path / installer: The upgrade failed (The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance.) I looked at some existing threads but no solution helped me. I also tried to cache the pkg first and install it with a second policy. Does anyone know what to do?

Hello all, I've been tasked with deploying a password to our deployment of CrowdStrike. The engineers as Crowdstrike advised me to create a python script falcon_password.py #!/usr/bin/env python from __future__ import print_function password = "password" try: while True: print(password) except IOError: pass and then execute this command against it./falcon_password.py | sudo /Library/CS/falconctl installguard I am not sure how to deploy this without the "falcon_password.py" file being available in plaintext on the target computer. The file has the password in plaintext.

Hey guys,I have a policy I want to run only Saturday morning before 2AM (From 00:00 to 01:59 it should be able to run). See the below for how I set up my client-side limitations.Well looking at the logs (see below), it ran not only yesterday (a Sunday) but also on Saturday at 8:50PM, 6:23PM, etc... This policy is cached for offline running. I can disable that part if necessary. Thanks guys

I built a simple smart group that is supposed to include computers that have two packages cached in the "Waiting Room" folder. I have the criteria set up like this: And I have a computer with both packages cached, as can be seen on its inventory page: But the computer doesn't show up in the group. If I remove one of them so it's only looking for one package it works, but for some reason it's not working for both at the same time. Any ideas?

When testing a policy with a Directory Binding payload, I am receiving this error and the policy is failing: The username (xxxxx) and password provided for the domain (xx.xxxxxxxxxxxx.edu) was not valid. (Attempt 5) Some background: Our institution is currently migrating from an Internal Active Directory Forest/Domain to an outfacing Forest/Domain. As a part of the migration we are now following the Red Forest security recommendations. With our current AD Domain Structure I have a Service Account for the LDAP Server Configuration with the JSS that is an actual AD admin account. With the new AD Domain Structure I have a new Service Account that has the least allowed privileges to bind computers to the domain. This account does not have login privileges to the AD Domain Controllers or any elevated privileges other than bind privileges. I have configured the new domain in the LDAP Server Configuration Settings manually (with help from our AD Administrator). Within the LDAP Server Con

Is there anyway of preventing iOS 11 install on iPads beginning tomorrow? I don't want individual students installing iOS 11 without the classroom updating to iOS 11 with teacher's permission. What are my options?

Hi to all, I'm unable to access a specific computer on MDM, if I try to do that it just loops in a blank screen.Anyone experiencing similar?

Is there a guide somewhere with a full set of instructions from start to finish for what I would need to do in order to set up a package to allow me to do an unattended in-place macOS upgrade using Casper Remote? Specifically from OS X 10.10 to OS X 10.11 (a sizable chunk of our equipment cannot go to 10.12 so we don't want to move to that yet). I'm looking to do this during the summer break but I want to set things up and test it beforehand so I can check a) that it works and b) how much time it takes. Thanks,Dan Jackson (Lead ITServices Technician)Long Road Sixth Form CollegeCambridge, UK.

Hi, Reaching out, maybe anyone knows the name off the application.Got a brainfart and can't remember a name of a particular mac application. The app can analyze running apps and the files are being modified / used by that application. Like composer but than real time view! Cheers,Thijs

Currently in my printer policies I have the payload 'files and processes' filled in with lpadmin -p name -o setting=value -o setting2=value if i instead go the the CUPS interface and change the default options this way Administration --> Manage Printers --> choose printer --> Set Default Options and then upload the printer to Casper Admin, will also these default options that I changed also follow the uploaded printer into Casper Admin? so that when a person adds the printer via Self Service that also the default options that I change via CUPS will get set for that person ??? or do i still have to do the lpadmin -p name -o setting=value ? an example change I do is have color printers default to printing B/W instead of Color This is how my printer policies go; first installs the driver and then adds the printer then does the 'files and processes'. So I dont' see this CUPS option working my way, is this true ?

We just bought Notion for our iPad pros with Apple Pencil using VPP, however I cannot get the handwriting $7.99 in app purchase to download. Does VPP disable in app purchases? If so what are the work arounds if any? Gabe ShackneyPrinceton Public Schools

Hi, Users with the latest version of Flash Player still receive an update notification from Self Service because the package definition in Patch Management is not up-to-date.At the moment the latest Version is 29.0.0.140 and Patch Management knows that but i´m late with the package. So the latest Software Title Definition in Patch Management with a Package is one Version behind the latest.The Problem is now that the users with the latest version are receiving update notifications and when their are doing it via self service nothing is happening for them. For the users the update process seems to not working.So i´m asking if this is the expected behavior and its my fault that i´m late with package definition or is this a fail in how Patch Management is handling this.We are on jamf 10.2.0.

Per Bohemian Coding's Sketch Blog, Sketch will no longer be distributed via the Mac App Store. We were previously using VPP to distribute Sketch via the Mac App Store, and now that I've tried creating a policy to deploy it as a .pkg via Self Service, I'm running into the issue described by njwinter in a discussion I've previously replied to. The Sketch App is installed in the user's Applications folder, but it simply won't open.

Our teachers have automatically installed printers when they change network location, login or check in, this happens once a day. Just in case something gets screwy with the printers and they have to reinstall, I wanted to have a script that they can run in Self Service to refresh the printers. I run the following script (which will delete all printers, even ones that they manually configured); #!/bin/bash #Deletes all printers installed, even non-district printers. # lpstat -p | awk '{print $2}' | while read printer do echo "Deleting Printer:" $printer lpadmin -x $printer done But since the triggers I have on the printer install policies only trigger once a day, how can I do another check in ignoring that they have already checked in today. I tried to issue a jamf recon, but that didn't work. Any ideas?

Managing the Guest User Account is such a royal pain in the neck that I have decided to create my own Pseudo-Guest account and manage it with logout scripts etc. However, the Local Account policy in Jamf Pro requires a password. What is the best way to accomplish this?

I created a config profile to enable time machine. Since most of the Macs in our environment are not MDM capable, pushing that profile is not going to serve the purpose. So I though of creating a policy that can be made available through self service. I have the profile downloaded as a .mobileconfig file. Can someone please guide me as to how should I package it so that I can add it to a profile ? Also the mobile users are not local admins on their Macs.

I wanted to start a thread to get a discussion going about how my fellow Higher Ed jamfers plan to deal with Adobe's change to licensing in CC 2019. We currently operate with an enterprise license and install all the CC apps in a bundle to our computer labs. In the past this was done with the CC packager and a serializer. Adobe has since made that obsolete in favor of User based licensing. So... we are now faced with the issue of ensuring that a user, after signing off of a machine, also gets signed out of any CC apps they had running. Thus making sure their that the next potential user is good to go. I'm curious if anyone is attempting a sort of "log off" script for Adobe CC apps or how the community in planning on handling these new Adobe bombshells.

Hey there. I've used the following command to allow non-admins to add and remove printers, but would like to know how to undo it:dseditgroup -o edit -n /Local/Default -a everyone -t group lpadmin I tried the following, but it did not reverse the effect:dseditgroup -o edit -n /Local/Default -a admin -t group lpadmin I've searched around and found lots of threads on how to enable non-admins to add printers, but no topics that discussed how to undo the change so any help would be appreciated.