My company is now introducing SSL certificates. We have no issue with Safari nor Chrome just Firefox because the certificate needs to be imported into the browser. We are able to create a new package with the Cert our issue is importing the certificate into FF for our existing users. Not only is the profile name dynamic, but if we do replace the db we will be overwriting the user's other certs. Is there a way to find the correct FF user profile and import the certificate into the existing db?

Our users frequently encounter an issue where at login, they are repeatedly asked for the "Local Items" keychain password. Apple details the problem and solution here, which works well , but I would love to script it and make it a Self Service or pushable item. I wrote the following simple Bash script, which works, however only if ran locally: #!/bin/bash if test -e ~/library/keychains/????????-????-????-????-????????????; then echo "Local Items keychain found" rm -rf ~/library/keychains/????????-????-????-????-???????????? else echo "No local items keychain found" exit 1 fi This is because Casper runs scripts as root, so if pushed through Remote it won't do anything to the logged in user's Keychain folder. I took a look at this discussion on JAMFnation and wrote the following, but it doesn't work whether ran locally or remotely: #!/bin/bash current_user=finger -s -l | grep Login | cut -c 8-25 if test -e /Users/$curren

Every year, we do a GRAD writing test and need spell/grammar check disabled. Unfortunately, developers have built spell checks into everything--the OS, apps, and browsers. I have run into a lot of difficulties trying to disable all layers of spell checks. We use Google Docs and I would like to disable spell check there, but it is not a global setting we can set administratively. Currently, we are using TextEdit on the Macs and disabling spell/grammar check there, but students can still just go and turn it on. Does anyone use a specific program or have any ideas for this? I plan to see if it can be put in as a feature request with Google, but thought I would see if anyone else needs to do anything similar.

Hi all, There are many discussions about how to install an AppStore app on a Mac Client. All of the discussions I have found involve interaction from the user. I really want to know if it is possible to push/ automatic install AppStore apps on Mac clients without interaction from the user. We have a lot of users who don't have an Apple ID. And as we have quite a lot of freelancers and temporary workers we mostly have users without an Apple ID and find it not making sense for these users to create an ID. Any one with insights ? regards Ronald

We are using Cisco's AMP for Endpoints (formerly Sourcefire). After updating to 10.13.4, the service is unable to start and the updated Macs are showing "AMP for Endpoints Service Unavailable" in notifications about 5 times per minute. It appears that this is related to Security & Privacy settings that are not seeing "Cisco Systems, Inc." as a trusted developer and the app is being blocked from loading. I am looking for a way to allow "Cisco Systems, Inc." through a configuration profile, script, etc. Any ideas? Thanks.

I have an Apple TV that is recognized in DEP and in a Pre-Stage but doesn't allow me to manage it (no clickable name that takes me to a management page and is not searchable). I'm trying to give it a specific name and to also force it into conference display mode. My guess is I've missed something really basic – any ideas?

I believe I downloaded the [Adobe Reader 2017 Classic](ftp://ftp.adobe.com/pub/adobe/reader/mac/Acrobat2017/1700830051/) track with the hopes of managing updates through Casper.The only thing I want to do is disable auto updates. I searched and was unable to find out how to do this.Has anyone accomplished this and if so -how?Thanks for any help.

I currently use apache to host a file server as a distribution point. I followed the guide when setting it up initially and have everything symlinked from my samba share. A couple students have found the file server via url and I'm having problems with them downloading packages and now I'm worried about security. Is there a way I can add authentication to the apache directory without breaking http downloads?

I am having issues deploying the 10.13.3 Combo and MacOS Update 10.13.3 also.I'm trying to install MacOS Combo 10.13.3 and 10.13.3 update also with recurring checking through policy. I'm not using DEP. Policy is running to client Machine but after completed process getting error Updates not Installed(Some updates could not be installed automatically). checking logs everything is good.Anyone know about this issue please share solution...Also Atteched screen shot.

So I'm playing a bit of catch up, we have about half of our users on Sierra so far. I've been testing with the following script to have users update via self service: https://github.com/kc9wwh/macOSUpgrade/blob/master/macOSUpgrade.sh . The first run through I did for testing worked great. I ran the script from self service on a macPro and the update worked as expected. For the sake of prepping for the worst, I ran another test with a mac mini (with a fusion drive, not sure that it matters though) and after rebooting the mini started to run through the update. Part of the way through the following error popped up "macOS could not be installed on your computer. Volume contains macOS or OS X installer media." I took a look through a few threads that indicated the /AppleDiagnostics, /BaseSystem , and /Packages needed removed. That did not do the trick. Rebooting to the start up disk did not work either. Fortunately I had a 10.11 recovery boot disk laying around and was able to reinsta

Hello everyone,Please forgive me as I am completely new at this, I want to allow users to install Office 2016 via self-service.I have successfully created and installed packages for Atom, Jetbrains IntelliJ.I am hitting a roadblock with Office 2016, I grabbed the SKU-less package from https://macadmins.software/ put it in JAMF Pro, created a policy.When trying to install via the self service, it seems that it installs, but nothing gets installed; I see that the statuses are executing - install (no downloading) when clicking on install in the Self service app.NB this happens on the single app packages too... Any pointers would be greatly appreciated.Thanks

I'm having this issue with out of the box 10.13.1 computers, and ones that I reformat and will automatically install on 10.13.3. I have the check box unchecked for Location Services in my prestage enrollment, yet setup assistant never asks me about location services. I always have to enable this later. What am I missing?

Hi I wrote a script which makes a GET request. Like this: curl -H "content-type: application/xml" -s -o "/private/tmp/computers.xml" -fku "username":"password" "https://jamf.example.com/JSSResource/computers" -X GET If the inventory contains 0 computers I get a JSON response. If there are more than 0 computers the output is XML, which is correct. This happens only on Jamf Pro 10.3. Is this a product issue or is my curl command wrong? I even tried to force a XML response by defining the header.

Hello All, I am currently having an issue with viewing/editing Autorun data from the "Smart Computers Groups" I click on the group > View > Action > and select the "Edit Autorun Data" option and I get a white page within the Jamf Pro frame (see below) This has been happening since Jamf 10 and I was hoping it was going to clear up for 10.2.1 but it did not. Any ideas?

This may be really simple and I'm just missing something here, but someone enrolled a Mac into our Jamf, and I cannot get the computer to even show up to be added to the scope of any configuration profile. I've eliminated smart groups from the config profiles so the only scoped machines are done so individually, and when I search for the specific machine, it shows no results, but I can find it when I do an inventory search. The other odd thing is that under the management tab of the specific computer, I'm used to seeing "Management Commands", and this computer does not show that at all, which leads me to believe that somehow it enrolled, but not completely. So far, we've rerun our quick add (we haven't completely un-enrolled it) again, and I even sent over a newer one I've tested. It does run some policies, and I've scoped it individually to a policy. Just can't seem to do anything with config profiles. Any thoughts?

Hello again! I'm trying to install our company's app to the Xcode iOS simulator via a script that essentially just runs xcrun simctl install booted [Path and App] however, as I'm finding out Jamf runs every command/script as sudo which is breaking this command. If I run sudo xcrun simctl install booted [Path and App] just in the command line I'm told No devices are booted. but the simulator is booted and I'm staring right at it. I can always create a new package by installing Xcode then our app to the simulator, however that package ends up being over 6GB and at the end of the day not efficient. So we want to install the new version of the app in the existing simulator. Is there a way to tell Jamf not to run the command with sudo? Here's what I've tried so far:- Write a script that just runs xcrun simctl install booted [Path and App] - this works in the command line but fails when pushed out via policy.- Write a non-compiled AppleScript that runs xcrun simctl install booted [Pa

Hey i have a strange issue with Sketch ,as the application is not stored in the application folder does any one have a way where i can find out who has the application downloaded in there download folder

We have an internal distribution point as a master and a cloud distribution point as secondary. I'm able to upload ~5 gb macOS installer to my on-prem and sync it Jamf Cloud. However, I'm unable to download the package from the cloud distribution point and 3-4 hours later when I perform another replication of drives, it attempts to upload the file again. Has anyone experienced this with larger packages?

Hi all, I'm super SUPER new to JAMF/Scripting/etc. I've been on a hands-on crash course because of the fact that summer's coming (new MacBooks...) and it's finally time to get rid of DeployStudio. Essentially, my goal is to have something happen akin to what happens when one logs into Windows 10 for the first time. ("Please wait... we're getting things ready for you.") It takes a while to install Office, Chrome, etc. with a login hook, and the Dock pops up with question marks as all of the apps aren't yet installed. I hope I'm being somewhat clear... My brain is fried from staring at JSS all day!!

I have the following error and no idea where to look to fix: When I click on the link, I get: I havent changed anything as far as I know.Any help is greatly appreciated.

We currently have JSS set up so that a local admin account is made on all machines at enrollment. We also have a log in configuration profile set to Username and Password text fields, and have fast switching disabled (unclear to me if this is causing the issue or not). We have FV2 encryption enabled on all machines as well. Unfortunately, it came to my attention today that if a user does anything OTHER than logging out via the Apple menu, then when you try to unlock the machine, you are not able to try logging in as a different user (aka the management account that I want to be able to access their machine with). Any thoughts on how to get around this? My knee jerk is to try using a policy to force a log out when a user shuts off their machine, but I'm not sure this would work when you just hold the power button to turn off the machine. Another thought would be adding the local admin that management uses as a FV2 enabled user? I've been doing some digging on this, but shy of manually

Hello all! Hoping to gain some knowledge / help from anyone that likes to use terminal commands. I'm having trouble mounting a network share with the end goal of using that network share as a time machine back location for a few of our machines. Here's the script I have so far. It works when executed locally BUT I get an error code when we try to run it attached to a policy. I have VERY limited experience with scripting and terminal commands. I've attached the error I get. Thanks in advance! Client Machines are running macOS 10.10.5JSS Version JSS 9.101.0 Begin Script Mount the network Drive osascript -e ‘Mount Volume “afp://[username]:[password]@[IP Address]/TimeMachine”’sleep 5 Hide the network drive to help prevent the user from unmounting it chflags hidden “/Volumes/TimeMachine”sleep 5 Restart Finder to show new session osascript -e ‘quit application “Finder”’

Hey all,I just wanted to post my findings for those who didn't already know of the differences in the way you can license the Microsoft Apps for Mac and a big shout out to Paul Bowden for all his work and help understanding this. We had recently switched to O365 for our email but had been using a volume license for years. I kept reading about new features in Office 2016 that should have come out with various point upgrades, but I never actually saw some of the changes (the newest one was they added Microsoft Groups to the Mac Outlook Client). So after reaching out to @pbowden he illuminated us to the fact that if you have an O365 subscription, you are entitled to some extra features that don't come with the regular volume license. He also created a great Unlicence tool that has allowed me to make a policy for our staff to remove the Volume license and allow the user to login (to their 365 account) and have it enable the extra features (like groups in outlook). https://github.com/

Maybe not the best place to put this but i've seen some talented people here so let's give it a shot. We are looking into deploying LogMeIn on our PCs and Macs, and of course it works as intended on PC but not on Mac... For those familiar with LogMeIn they have this "host preference" that pre-defines the settings on the host computer.This doesn't work at all on Mac, and because of that I'm looking into setting the settings manually via scripts and so on. Long story short, they use this XML which contains the settings, and what I want/trying to do is to find the following line: <dword name="AllowLoopback">0x0</dword> When this is found, I want to add the following lines under this line: <dword name="AskForPermissionDefault">0x0</dword> <dword name="FullCtrlBypassUsrPerm">0x0</dword> <dword name="PermissionTimeout">0x1e</dword> <string name="PermissionText">Lots and lots of text</string> I have used sed before but I can't

This was asked during JNUC last year, and the response from Charles Edge at the time suggested it was possible. We haven't heard anything. Can we get an idea if Jamf is planning this?