Hey Guys, I'm trying to silently mount a network share on login without the user having to authenticate. Our computers are bound to AD and use mobile accounts (with all syncing disabled). I'm using a LaunchAgent which runs a script. Here's what's happening: Everything works reasonably well on the first login. It creates the account and when I reach the desktop I get a pop-up that says "you are attempting to connect to the server "server.name.com", and I click the blue "connect" button and the share mounts. Sweet! Here's a screenshot of this: However, every login afterwards prompts for a password... Here's another screenshot: So, I don't know why it's authenticating the first time and then not authenticating for all subseqent logins. Here is the script that I'm using: #!/bin/bash # this script was written to determine the currently logged in user and then determine # the path to their network home folder # it will then mount the home folder ## Get Current User current

Update 2018-03-14: This issue has been resolved with the newest version of the DLP and SEP clients, as I've stated in this comment. Resolution: With thanks to @lrabotteau, we've been able to see that this issue is directly attributable to the Symantec 14.6 DLP client not being compatible with MacOS High Sierra. My IT Security group has a ticket open with Symantec and they've provided us with steps to remove the agent, as described in this comment. I'm now marking this issue as solved since it's not related to the JSS itself. Now we just need to find a resolution to the DLP issue without requiring a complete upgrade of our DLP infrastructure... Issue: I have a fresh-out-of-the-box MacBook Pro 13" non-touch strip mac that I've just enrolled. One of my policies requires a reboot – SEP installer. When issuing the reboot or shutdown command, the computer ends up with a Kernel Panic just after the display LED turns off, and the machine will reboot on its

Hello there, I was wondering how your organization is handling Adobe CC products in your organization. Is everyone moving to Adobe IDs for every user, the "Named user license" approach? If you used Adobe CCP, and your users see the pop up "You license is expiring," do they just sign in to activate their seat? Thanks for all your thoughts.

Hi All, As I'm sure many of you will notice soon, MS changed their version numbering for Office 2016. Rather than 15.x, the latest patches are now 16.9. This breaks all my Smart group logic... since now I have to look for two completely different versions. Licensed software also is a bit weird now. How are people handling this? Just duplicating their licensed software profile, and smart groups, then setting policies to look at both, or...?

I think I broke my old AST server a few months back and looking to rebuild it. I have the installer files from GSX but can't find what the system requirements are, not sure if it will run on 10.11 and 10.12?

So, anyways, as a high school student, I am looking to remove an MDM profile that is stored on my computer that has a bunch of restrictions. With 'sudo -s' then typing in 'profiles -R -p com.uni.mdm' I get returned 101: profile is not removable. I then went to a thread regarding how to remove an unremovable mdm profile and came across to do this via nuking the directory that the MDM is stored in. I typed in as bash 3.2#: 'rm -r /var/db/ConfigurationProfiles' and after typing in 'y' a bunch of times in an attempt to remove it, I get that it is not permitted. I have no idea how or why, but I am looking for some help. Thanks for reading this and I hope I can get some help.

Just like everyone else we are dealing with keychain issues for our AD accounts. I have a lab where students login with their AD credentials and they are constantly complaining about the keychain prompts. The building consultant wanted me to script something that would remove the users keychain folder contents after each logout. I understand this may not be best practice but I can't for the life of me get it to work through Casper's login/logout hooks. I'm using this script: http://www.amsys.co.uk/2015/02/delete-keychains-logout/ #!/bin/sh rm -Rf /Users/$USER/Library/Keychains/* exit 0 When I run it from terminal manually it works like a charm. When I run it via event/logout hook it completes "successfully" but the folders remain. Anyone have any ideas why its not delete the contents? Any suggestions on how to deal with keychains on lab machines other than ADPassmon? Thanks

I'd like to get into Shared Ipads for a couple of my classes but I'm not sure where to start. I've got a DEP device in a prestage that is supposed to set it as a shared Ipad, but after enrolling it never shows as shared. Ideas?

Hi, we need to implement a software restriction policy for the new MacOS prior to it being released Does anyone know the name of the installer .app to block or has that not been released yet ? Thanks as always in advance

Hi JAMF Nation, Hoping someone can help me out with this. We are using a Configuration Profile to blacklist and whitelist various applications for students, and for the most part it seems to be working without a problem. However I am running into this issue with Google Chrome and it's Automatic Updater. Whenever I launch Google Chrome, one of the two following messages appears. "You don't have permission to use the application 'GoogleSoftwareUpdateAgent'.""You don't have permission to use the application 'ksadmin'." I have been searching JAMF Nation for the past couple of days to try and resolve this and have tried various fixes. I have now added these two directories to the 'Allow Folders' white list, as from what I can gather they are the directories that these to files are attempting to run from. ~/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/Google Software Update.app/Content

5 years ago, we were updating all of our school's equipment to the latest OS by our Team hitting all machines in person and the last few years we've leveraged Self Service for our users to install OS updates themselves. After spending a lot of time the last few weeks trying to update all the associated polices and scripts, try new methods posted here on Jamf nation, I finally just decided to try updating a test machine to High Sierra via the App store. I'm thinking about just having our users update via the user initiated App Store method. Only obstacle would be getting getting the setup assistant to not run. What reason would I have to not use this method? If I go with this how can I skip the setup assistant on next reboot etc if the user updates via the app store? (previous just packaged up to run in the Self Service policy) Thx in advance for your thoughts.

Has anyone actually been able to disable auto updates in a chrome package? - I was Able to create a new mdm configuration profile and upload an edited com.google.Chrome.plist file with a few policy settings. this worked great. I followed the instructions here: https://support.google.com/installer/answer/147176?hl=en&ctx=go but I am still able to update chrome. as a matter of fact, - I even went as far as changing and even deleting the GoogleSoftwareUpdate folder under user/library/google - and it just builds a new one I know in windows, it's one reg key and you get "Updates are disabled by the administrator" can it really be this difficult?

We're imaging using a monolithic image and I'm having issues activating SMART Notebook on OS X. I'm trying to activate SMART Notebook automatically using their silent image command, but it isn't working. When I run the command in Terminal, it works fine. When I try to push the script or run it through Self Service I can see it run in the dock, but it has no effect. No errors, no activation, nothing. I've tried searching JMF Nation, but I haven't found a real solution. Any help here is appreciated!

Hi all, Any idea how to set a non-Apple app as a login item via a configuration profile or Casper MCX? I know i could do this via a LaunchAgent, but am trying to avoid that for now if possible.

Hi All, I'm wondering if anyone know if it's possible to mount SMB shares based on users being in a AD group if the Mac is not bound to AD, but has Jamf Connect (NoMAD) and a valid kerberos ticket? I current have all Macs bound to AD and use a Apple script created by macmule. He's an example of said script; -- Checks Group Membership for ADGroups contains user & if they -- are in the correct groups, mount shares. ---------if ADGroups contains "ADGROUP" then mount volume "smb://fileshare.full.path/SHARENAME"end if Maybe this can't be done... hopefully it can so that I can stop binding machines to AD. If anyone has advice on this I would appreciate it.

I am trying to write a script to report back an extension attribute on SecureToken status. Background - we push out a default admin account (aka "admin") during DEP enrollment. DEP prompts for creation of a user through the GUI and our frontline techs will often create a "localadmin" account, which they're supposed to delete later on. Well, things happen, and the account doesnt get deleted every time. I'm trying to make sure that if there's a local admin, it's got SecureToken, which ever account it has. I've got a script that works on one user, but won't work for more than one user returned. I've not really played with for;do statements, so this is my first go round. Can someone give me a pointer on where I may be going wrong? #!/bin/sh # # SecureToken for Admin.sh # # Get the Username of the local Admin account ADMINid=$( dscl . list /Users | grep -v ^_.* | grep dmin | grep -v JAMF ) # Get SecureTokenStaus status=$( d

I am in the process of deploying around 80 iPads for our school district. Is there any way I can push out Apple ID's to each iPad (and then lock them from being removed) instead of entering them manually? Thanks for any help.

Hi everyone, Today i have this error "This Apple ID cannot be used to make purchases" when installing vpp apps on few iPads. All apps are concerned.It's device based and iPads are on iOS 12 (fresh DFU recovered) with managed apple ids.Nothing relevant in logs. Any idea?

Hello EveryBody, First message, even if I read you all the time. I'm trying to modify a script created by Aaron Baumgarner. that script is to install VLC. Actually we have here a cloud based proxy. I would like to modify the script to cross that proxy when we are in the intranet and not if we are outside.here what I did: check= ping -c 1 InternalIpOfEquipment if [$check = 0 ]; then /usr/bin/curl -x ProxyIP:443 --output /tmp/vlc.dmg "$fileURL" else /usr/bin/curl --output /tmp/vlc.dmg "$fileURL" fi it seems not working. and don't find my error. Could you Help me?

Hello, We have changed out print management system and therefore I had to add a new printer to Casper Suite. The system is set up in AD using a .gpo and a printerpool. I did this simply by adding the new printerpool to a Mac and then added it in Casper Admin. While this works (the drivers are still the same), when the new printer has been added to a Mac through Casper, it will now say "Paused for authentication" whenever I try to use it.If I add the printer the conventional way to the Mac, it will send the print without issue and I use my card at the printer to retrieve it. Is there any way to get around this issue or atleast prompt for authentication details? Right now it just looks like the print job gets stuck in the queue and you have to "refresh" it manually to prompt for credentials. Thanks, J.

We just reimaged our student macbook pros with High Sierra in the summer. Now, when they leave the computer on and put it back in the cart at night, the next day, the students cannot log in because the time is off on the laptop. We didn't have this problem with Sierra or older versions. My understanding is that it will try to resync within 15 minutes but even after a reboot, it isn't trying to get an updated time right away. So, for the laptops that aren't powered down at night, they have to set them aside for a while to get a proper time sync. Anybody have a fix for this

Hi All, We are looking to change our company wallpaper on our Mac's, and in past we have done this by saving the image to a test Mac, and using composer to create a DMG of the folder location. We then push this folder out to users, and once pushed out, we changed the filename on a restrictions config profile. The problem we have now, is that we have a mixture of APFS and Mac OS Journaled devices, so the composer route seems to add a bit more complication. Can anybody advise on a better way of doing this? Thank you!

This request is to help us out with a symptom where users' "login" keychain and AD become out-of-sync. In a good handful of these cases I'm seeing that a user attempts to actually change their password from the local machine as they should, but they are unable to because their Mac times out before reaching our DC. The fix? If we un-bind and re-bind the computer to our domain, accessing network resources and password resets seem to work just fine. So, what I'd like to do is create something in Self Service where a user can kick off a policy/configuration and it will automatically unbind and rebind their machine to our domain. I know there are Policy attributes in the GUI that will bind a machine to a domain, and we utilize this in our OS configurations -- it works find for binding a computer to the domain. However, there isn't a GUI-option to remove it from the current bound-domain, so I was thinking of scripting. I am borrowing a script that Scott Bl

Goal: Only allow members of specific Active Directory (AD) groups to logon to certain computers. Why: We want to keep students from being able to logon to Faculty/Staff computers. We also need to keep Prep school students from using University computers. The Details of the problem: THIS WORKS: Manually going into System Preferences, Login Options, Allow network users to log in at login window (Options...), Only these network users. Entering in domain groups. THIS DOESN'T WORK: Creating a Configuration Profile within JSS where the Login Window contains a payload with the groups specified under the Access tab. This doesn't work if the group contains > 1500 users. Can anyone verify this? Any workarounds? This is a bugger.....

I've seen some discussions already dotted around but not much has helped so far. We have successfully used a script that will remove the SSID from a Mac but after a reboot, you are still left with the SSID details in Keychain. Is there a way (script?) to remove this? I want to test it using terminal first.