Running 10.6.2 with the newest apps. Started Remote and got this message:

Hello everybody! We want the newly purchased Macs and iDevices to automatically be added to JAMF.When activating the option on deploy.apple.com, what happens with our older devices that are not yet registered? To they become automatically registered and added to JAMF or it applies only to the newly purchased ones? Thank you!

Hi, So we're having an issue with our AD bound Macs (using Apple's built in AD connector) where after an hour they lose their ability to authenticate to AD. This generally shows itself if the user is logged in and the screen lock comes on they will not be able to log back in. Or if the computer is booted up, but no one logs in, after an hour the red dot will appear at the login screen. Only solution seems to be rebooting the machine. This is what we captured in the opendirectoryd log when set to debug mode right at the hour mark when it fails:(sudo log stream --level debug --process opendirectoryd >> ~/Desktop/odir.log) 2018-08-08 11:39:56.562194-0500 0x4983 Debug 0x0 77 opendirectoryd: (SystemConfiguration) [com.apple.SystemConfiguration.SCNetworkReachability] [0x7faffacb4720] unscheduled 2018-08-08 11:39:56.562310-0500 0x4983 Debug 0x0 77 opendirectoryd: (SystemConfiguration) [com.apple.SystemConfiguration.SCNetworkReachability] [0x7faffacb4720] release 2018-08-

Hello All, I am trying to figure out a way to have a shortcut to specific applications that we use in house. On the Windows side of the house we have a folder specific to our applications that we install. I am wondering if there is a way I could replicate this? It would just be a shortcut to applications : Chrome, Firefox, Word, Powerpoint, Excel and Outlook on the right side of the dock. Thoughts? Thanks in advance!

Howdy, We are having an issue with our Macbooks on High Sierra that are bound to AD with a box that pops up when the user tries to log in:Password Expiration: Your password will expire in 29 days.... Is this because we have "Create Mobile Accounts" selected in our Directory Binding? Our user password policy is set to expire passwords every 180 days. Most of our users who were enrolling their macs reset their passwords within the last few days. Also included in the password policy is that the user cannot change their password within 30 days of changing it. This 29 days doesn't make any sense. Which leads me to believe it is a mac issue and not because the machine is bound to AD. Environment: Jamf Pro v10.6 Enrollment Setup:I have a daisy chain of enrollment policies that go out during enrollment. Here is the summary:1) Sync Apple Time Server: ntpdate -u time.apple.com2) Script changing the name of the mac to the serial number3) Bind to AD with the Directory Binding a) Cre

Hi, we have around 70 Mac devices and their performance are not the best after resetting and putting external SSD as the main boot. To improve it, I have been thinking of several Mac cleaner software for our environments and I think Clean My Mac 3 and Dr. Cleaner, these two are the best. So... do you recommend using this cleaner software in a production environment? If you do, which software do you prefer?

Hi all.Is it common that Maps.app, Photos.app and Books.app is not listed in the drop down selection when you choose configuration profile - Dock - Add Dock Apps?I know how to add additional apps to the drop down selection by editing an tomcat xml file which is not very handy. I thought that Maps.app, Photos.app and Books.app is so much default that they should are allready listed in the xml. Thank you

Hi All, I've managed to get an FSDP configured on RHEL6 running netatalk, and that seems to work great for AFP. The problem is, I can't get https connectivity working. Clients just get 403's according to the web logs. The documentation for configuring the HTTP(S) portion of the FSDP is pretty minimal from what I've found, and focuses almost entirely on doing it on a Mac. What's required to get this working? I'm not currently using webdav on the system... is that required? I figured it just had to have the direct link, and while it is indeed passing that, it's getting a 403 (forbidden). Thanks!

A new Mac Pro arrived, fated to be a server, which we do not manage with Jamf Pro. However, it feel into the default DEP group and was enrolled on startup inadvertently, getting the FileVault settings for faculty computers. Unenrolling it from Jamf and undoing the initial policy effects was fairly straightforward, and it now reports having no configuration profiles installed, as expected. However, the machine still prompts for a mandatory FileVault enrollment every time someone logs in with a directory based account. FileVault never succeeds, nor should it in this case. Anyone have suggestions on what prefs files to purge to get it to stop trying?

Hi all, Would love some help in making a Restricted Profile or other method for stopping my students from opening the Epic Games Launcher. I'm hoping to put an end to Fortnite on our school owned machines. Many thanks! Brenton

With the introduction of the new iMacs on Monday, Apple has removed all traces of its wired keyboard from the consumer and institutional/enterprise stores. Is there anyone else out there managing labs and clusters using bluetooth keyboards and mice already? I'm looking for strategies besides hoarding old wired keyboards and mice, though that may be the solution in the short term. Oddly they are still selling the wired mouse.

We've been adding the following to the web.xml to restrict access to the JSS WebApp <!-- Restrict Access to JSS via IP Address --> <filter> <filter-name>Custom-RemoteAddrFilter</filter-name> <filter-class>org.apache.catalina.filters.RemoteAddrFilter</filter-class> <init-param> <param-name>allow</param-name> <param-value>"REGEX_IP_VALUES"</param-value> </init-param> <init-param> <param-name>denyStatus</param-name> <param-value>404</param-value> </init-param> </filter> <filter-mapping> <filter-name>Custom-RemoteAddrFilter</filter-name> <servlet-name>PresentationLayerServlet</servlet-name> <servlet-name>FrontEndController</servlet-name> <servlet-name>FrontEndUploadController</servlet-name> <servlet-name>RestletServlet</servlet-name> </filter-mapping> B

Hi Jamf Nation, Is anyone using Jamf and Centrify, particularly leveraging Centrify GPOs to enforce Smart Card login on Macs 10.11 to 10.13? I've read that others have had their fair of issues with Centrify (UUID permissions and network login issues). Everybody seems happy to move away from Centrify to Jamf. Our ORG is currently on 10.12 & 10.11. Until the CIS 10.13 benchmark comes out, we can't upgrade to 10.13 to enforce Smart Card login. Plus, Centrify says that Multi-Factor Authentication for Macs is still in beta. Is anyone usin multi-factor login on Macs? Ideally, I'd like to wait for the CIS 10.13 benchmark, then upgrade our ORG and force Smart Card login that way. But I've been given a quick deadline now to make it happen. Can anybody share their experience with Jamf and Centrify? I'm a bit worried about an admin applying their GPOs and other weirdness. To get Centrify to work, I'd have to unbind and re-bind using Centrify's tool. I saw some scripts and I know Jamf

It is very strange how suddenly the xpath GET stopped printing the data correct, for this line: id=`/usr/bin/curl -k -u $user:$pass "$jssurl/JSSResource/computers/udid/$uuid" -X GET | xpath //computer/general/id | cut -f2 -d ">" | cut -f1 -d "<"` Getting this output with ALL the data from JSS on that specific computer: % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 37386 100 37386 0 0 43174 0 --:--:-- --:--:-- --:--:-- 43170 not well-formed (invalid token) at line 1, column 0, byte 0: {"computer":{"general":{"id":1992,"name": ..... .... [ALL THE DATA] .... ^ at /System/Library/Perl/Extras/5.18/darwin-thread-multi-2level/XML/Parser.pm line 187. It displayed computer id before and now all data raw... I wonder why it stopped working like that, any ideas?

We have 300+ Macs in our environment and have found that they are reporting in other tools like McAfee and Ivanti that they are Windows machines because they are pulling an IP address that a Windows machine previously had. Looking through the Landesk forums, the only thing besides editing the host file I haven't tried is setting the "DHCP client ID". If your DHCP Server supports it you can go into System Preferences -> Network -> Select your adaptor on the left -> click the Advanced button -> Set the "DHCP client ID" to your hostname. I have verified that the Macs have the computer name set correctly by using Jamf and another script to set the computer name. I also have "Use a dynamic global hostname" unchecked in the network preferences. Does anyone know of a way to script the DHCP client ID to the current hostname of the Mac?

Is anyone else seeing this issue? We're deploying High Sierra 10.13.6 and every time a new user logs in, this dialog appears: "iCloud Drive may not work properly. Please check the iCloud preference pane. Couldn't communicate with helper application." We're disabling the iCloud setup assistant which is working fine, but all of a sudden on our most recent builds, this message shows up every time. The dialog eventually disappears without user interaction, but I'd like to prevent it from displaying at all. Thanks!

One of the companies we support has an internal app that is not installed through App Store. Searched for a bit, but not found documentation on deploying. Anyone have that handy?Thanks!

I'm working on a way to build Smart Groups based on a machine's OU in ADS. I've put together a Bash script to create an Extension Attribute reporting the DN, but it doesn't update the field in the Inventory for computers. I'm not sure why, because I verified the script is working. Anyone had any success with this? It's sort of imperative I get this functionality for RBAC for my sites and such. #!/bin/bash compName=$(/usr/sbin/scutil --get ComputerName) ou=$(dscl '/Active Directory/<DOMAIN>/All Domains' -read /Computers/$compName$ distinguishedName | grep 'CN' | awk '{$1=$1;print}') echo "<result>$ou</result>"

trying to get my scripting correct to be able to update an extension attribute for an ipad using rest api. even through the Try It Out feature on the uapi/docs i receive an error 500 so something isnt correct. All examples are in XML but uapi is in JSON which i prefer (as im using powershell) as the example in the uapi docs isnt working, i know the request isnt correct.....but what am i missing? is the documentation correct? I noticed in the model schema it mentions "extensionAttributes": [ { "id": 0, "name": "string", "type": "STRING", "value": "string" } but in the bodies Model Schema it has "updatedExtensionAttributes": [ { "id": 0, "name": "string", "type": "STRING", "value": "string" } ] here is the generated example which fails with error 500. the attribute exists, correctly as far as i know. curl -X POST --header 'Content-Type: application/json' --header 'Accept: application/json' --header 'Authorization

We just upgraded last night and I noticed the "Computers", "Devices" and "Users" tabs missing in the top left-hand corner in Chrome on my Mac (2 different ones actually). I logged on to a Windows VM and launched Chrome and logged in, and they were there. Never had this issue on 10.3.0. Mac/Chrome: Windows/Chrome:

As we got JSS updated to 9.73, Casper Imaging stopped working. After choosing the Configuration and providing my JSS account credentials I get the error message:"Unable to create the invitation. Check to make sure you have permission to create an invitation"I have administrator-privilege account with everything checked on JSS User Accounts & Groups side. Please help. Thanks!

JAMF Nation, Like many others I am tasked with CIS Benchmark deployment. I need to enable Secure Keyboard in Terminal.app. It can be done via script but the user can de-select the option after the script runs, allowing their current session to be disabled and thus not enforcing the benchmark how we need it enforced. A .plist file pushed via Configuration Profile would be the best way to enforce the setting. In a test I have pushed a .plist file with the Secure Keyboard "key" set to "True" and it works but it also sets every default option in the Terminal so none of it can be changed. My question: How can I push a .plist file via config profile that ONLY forces the Secure Keyboard key to "true"?

I have a computer enrolled into my JSS using DEP. The pre-enrollment ran correctly and all I had to do was select my country and the computer did the rest. My question is, how do you scope computers to policies that used pre-stage enrollment and not computers that are already enrolled in the JSS? For example, now I have this computer which I can log into with no packages or settings installed. I want install all my new programs and scripts on it, but I want to ensure I'm not messing with existing computers in my JSS.

Hi, One of our users has found a way to bypass the restrictions payload we use to prevent access to certain preference panes in System Preferences. The way they're doing this is by going to View > Customise, hiding panes and then using the Search box to find them. This allows them to get into the pane without the configuration profile blocking it. It's not the end of the world since these users aren't admins and they're limited in what they can do, but there's still a few things they can do that we don't want them modifying. Previously it seems you could have stopped this by changing the permissions of the individual panes you don't want users accessing, but now SIP stops you from doing this even as root. MyMac:~ root# chmod 750 /System/Library/PreferencePanes/Sound.prefPane/ chmod: Unable to change file mode on /System/Library/PreferencePanes/Sound.prefPane/: Operation not permitted I've seen from another thread on here that "Apple

Hi All, Is it possible to give 2 policies the same custom trigger name ? that are scoped differently I need to remove some software from our Macs. The script to do this is the same no matter what version of the OS it is running.I then want to immediately install the new software. This is slightly different for OSX10.11 and lower machines than it is for OSX10.12 and up machines.So I have a policy made for each of the installs. If I scope one with a smart group for "10.11 and down" machines and one to "10.12 and up" machines , if I give them the same custom trigger name, when the first policy finishes will it call both policies, but due to the scope will it only run the policy for that machine ? Andrew