We have an odd behavior effecting DEP enrollment on Jamf Pro 10.1.1. These Macs complete the Setup Assistant as expected based on our PreStage Enrollment settings, however the Jamf agent fails to install. We get the following in jamf.log Enrolling computer... Wed Feb 07 13:54:01 MacBook Pro jamf[619]: Error Domain=com.jamf.jamfsecurity.error Code=-25300 "searchForItems:conversionBlock:error: : The specified item could not be found in the keychain." UserInfo={NSLocalizedDescription=searchForItems:conversionBlock:error: : The specified item could not be found in the keychain.} Wed Feb 07 13:54:01 MacBook Pro jamf[619]: Error submitting enrollment status to the JSS: Security Error - A security error has occurred. Wed Feb 07 13:54:01 MacBook Pro jamf[619]: There was an error. Error enrolling computer: Invalid Message - The message could not be parsed. The Mac has the MDM Profile installed but nothing else. Running "sudo jamf enroll -prompt" or downloading the quickadd.pkg from the

Running JSS 9.101.0-t1504998263. after updating any device to iOS 11, devices stop communication with the jamf server. tried to wipe a device and reconfigure, i get to the remote management page and it tells me " The configuration for your ipad could not be downloaded from....... Canceled." anyone else having this problem?

I have several iPads that we were managing (poorly) that we are trying to migrate from our old server into the new server of jamf. I am running into the issue where one device I have has been entered into DEP via deploy.apple.com and the device is displayed in our pre-stage enrollments. However, when walking through the setup process for this iPad, it never actually enrolls into our new jamf server. The device stays in unassigned in our pre-stage enrollment. Our new server of jamf is a cloud server. We have no issues with brand new devices being enrolled into our new jamf server. The iPad is on iOS 11.2.5.

I recently began testing a script that calls jamfHelper in full screen mode, this time as a Self Service policy. The script behaves normally except when executed from Self Service. The full screen window will not disappear, but I can manually dismiss it via Command+Q on the machine itself. Am I missing something here? I have tried killing jamfHelper every JAMF documented way, and also via kill -9 <pid> and killall -m jamfHelper. Nothing works except Command+Q. The script is a modified version of the Apple Software Update helper script created by lisacherie.

We are having with 10.11.x Casper Imaging. Our problem is that after the OS installs and restarts to install additional software, the machine boots to the Temp Adobe Admin account and remains on the desktop until the installation is complete. I have a ticket open with JAMF Support, but so far we haven't been able to establish a root cause. The problem follows to all El Cap versions, no matter how it is imaged, regardless if it is Netboot or target disk mode. Even just the installer from the Apple store with a just a single software pkg will produce the problem. We running 9.91. Is anyone else having this problem? Any help would be appreciated. Thanks!!

I wrote a script to rewrite the computer name. We're using Enterprise Connect, and I have a bash script that's deployed (pkg) to /Library/Scripts/ec, and then gets executed to write the computer name to /tmp/ecUser: #!/bin/bash echo $1 > /tmp/ecUser exit 0; Here's the script that gets executed, per policy: #!/bin/bash if [ ! -f /tmp/ecUser ]; then jamfUser=$( echo $3 | sed 's/./-/g' ) /usr/sbin/scutil --set ComputerName $jamfUser /usr/sbin/scutil --set LocalHostName $jamfUser /usr/sbin/scutil --set HostName $jamfUser echo $jamfUser else ecUser=$( cat /tmp/ecUser | sed 's/./-/g' ) /usr/sbin/scutil --set ComputerName $ecUser /usr/sbin/scutil --set LocalHostName $ecUser /usr/sbin/scutil --set HostName $ecUser echo $ecUser fi exit 0; Here is the result from the policy, in this case the username is coming from /tmp/ecUser, which is matt.marshall, rewritten to be matt-marshall: Executing Policy e Change Computer Name Running script Change Co

Has anyone been able to install CB Response via self service. I created a package with the following steps in composer: private mpCBResponsefilename.pkg post install script: #!/bin/sh ## postinstall sudo installer -pkg "/private/tmp/CBResponse/CBResponseClientSetup.pkg" -target / delay 60 sudo rm -r /private/tmp/CBResponse exit 0 ## Success exit 1 ## Failure Self service reports a successful installation but the computer doesn't show up as a sensor. If I run the pkg on a computer and go through the prompts it installs just fine.

Hello all & Merry Christmas!!! We have SSO setup using ADFS and LDAP using the Jamf Infrastructure Manager with LDAP proxy set in our Jamf Cloud instance.I can search LDAP and bring a user in who can log in and access what they are allowed to access, equally I can add an LDAP group. What I would like to do is manage everything through Active Directory. So my theory is, bring in an LDAP group and members of that group can log in to Jamf and get what they are told they can get! So, I have brought in an LDAP group that I know contains a user, applied site access to that group and applied audit permissions. However, when the user attempts to log in, they are presented with Access Denied. I have tested the mappings, Jamf knows that the group exists in AD and the the user is a member of it. So, my question is once an LDAP group is imported, does it bring the user(s) with it?

In the environment that I work in, Kerberos was just enabled over the weekend on the Exchange servers. I currently have 250+ existing Mac Users with Outlook that currently are set to just use the User Name and Password. I would like to get these existing users flipped to Kerberos. It is a simple change to make but I am looking to automate just changing that one item. I am not that experienced in scripting but I would like to deploy this change via JAMF / JSS. Talking Moose's Outlook 2016 script is great for new users that are just logging onto a machine for the first time but when I run this on an existing user, it creates a second mailbox. I appreciate any guidance anyone can provide.

We're looking to move multiple VPP accounts into JSS and would like to allow those staff responsible for their sections access to JSS so they can manage the entire process from purchasing in Apple VPP through to deployment to their iPads. Can this be done?I'm not sure which privileges I should be giving to allow this without allowing access to everything. Is there a spreadsheet or something similar available that would help with this?

Whenever a new version of a browser comes out, I create and upload the pkg, and then upload it to the JSS and set it to Make available through Self service. What is the best practice for killing and (removing if necessary) the existing sessions and editions of say Chrome and Firefox? I've noticed after installing them, and then launching the browsers, they both seem to request a restart to update - which isn't ideal Do you put in a pre-installs script to remove the older version? If so, does this work without removing all of their bookmarks and extensions?

I have a bunch of policies that I dont want to run more than once per day, so curiously enough they are set to "Check In" and "Once Per Day" and are each scoped to a specific building. However, I have 1 particular set of circumstances that should only realistically happen once per machine, where a policy is triggered that intentionally changes a setting to a default value, I then need to trigger my "Once Per day" policy to immediately change them back to the site based one. Any thoughts

example: 2018-001 updates for Sierra, et all - short of user caching the software and doing a remote install (package receipt would be a good way to track deployment), how can we track it via natural installs of updates? i can go to system information > software > installations > and find the installer that im looking for, but how does that translate to a trackable table or extention in JSS?

Hello Jamf Community, I am looking for a script, to change the DNS "Search Domain" to .local on Wi-Fi and Thunderbolt Ethernet. I try a few comands but no one works... Hope everyone can help me. Many ThanksChristian

I forgot to enable screen sharing for new imaged Macs and now I can't use Casper Remote to remote to the devices. How can I enable screen sharing via a script or profile?

The Major point of what I am trying to achieve here is to force a full policy Refresh at boot. There is nothing in a policy that allows for this. I have a Startup Policy that runs a script that SHOULD achieve this but it does not work in this instance, in other areas though the script does work. The Heart of the script is basically the below command (plus the echo above it to make the logs easier to read) that chains the 10s pause and the policy refresh into a seperate windows that it does not wait for completion. Echo Pausing for 10 Seconds to let this script finish, then Re-Check for Policies sleep 10s && /usr/local/bin/jamf policy & Any Thoughts ?

Today I noticed that I can send a command from the JSS to remove local user accounts on Macs. It doesn't show up on all. I am trying to figure out the criteria to see this. I thought it may be High Sierra, some of my High Sierra Macs show this option, some do not so it doesn't seem like a versioning issue. Most of these Macs should have the same configs and policies. I am just trying to figure out if this is a new feature or maybe I turned something on and didn't realize it.

I've added a few applications to my VPP account which I can see in JSS but none of them appear to be Device assignable. Microsoft products in particular. I have to copy the URL from within App store and paste within VPP console. But even when I search using JSS I get the same thing. Assuming this is correct, can someone suggest a free App I could use for testing? If this isn't correct can someone tell me what I'm doing wrong? Thanks

We setup DEP and preStage successfully. preStage enrollment requires Active Directory credentials, which we verified to be working before enrolling. The Active Direcotry login populates the local user information (e.g. First, Last name along with uid) correctly. The local account is created correctly, and when it loads, the managementFramework enrollment is not fully complete. In JSS, the computer status ends up in an 'unmanaged' state. Conversely, when using the QuickAdd.pkg (downloaded from user-initiated enrollment page) with the same login credentials, we observe that the enrollment is fully successful and the computer is Managed by the Management Account. We have reproduced the same issue on multiple computers with multiple user credentials to rule out any potential anomalies. Additionally, we have verified the JSS hosts are able to communicate with APNS, HTTPS, etc.

Hello, I am using the Casper REST API to populate our Asset Management database in ServiceNow. I am using the resource URL ../computers/subset/basic This URL provides most of the information I need for my queries. However, I need BOTH the Primary Mac Address AND the Secondary Mac Address. That URL provides only one field <mac_address>. Also, I tried building a computer report and pulling from ../computerreports However, the report builder only provides a single mac address. What resource URL can I use to query both network adapters for a single computer? I’m unable to locate a table that stores network adapters specifically. Let me know if anyone has any advice! Thank you!

Hello, I have run into numerous printing errors when adding this model printer to Jamf Admin and deploying through a policy triggered by Self-Service. It seems HP have given up on supplying specific drivers for this fairly new printer model, using the supplied auto config driver when adding using CUPS results in postscript errors and blank pages being printed. Using the General Postscript Driver seems to yield better results at the cost of customization settings when printing. Hp Easy start is a disaster and will not even find the desired printer using IP discovery. Printer Firmware has been updated and we are running OSX High Sierra(10.13.2-3). Any insight is much approved, has HP abandoned enterprise support for Mac? Thanks, Matt RoyTechnology SpecialistISD659

Hey folks I'm pretty sure I know the answer to this, but I thought I would ask anyways.We would like to set the names of our iPads with a slightly different format than our Apple TVs and I can't see a way to do this with prestage enrollments; does anyone have a suggestion? ThanksDeano

Afternoon Jamf Nation We are switching from Profile Manager to Jamf Pro in the coming months, and I have been tasked with this transition. One of the things that I am having trouble with is our Code Signing Certificate. It expires next month (which I'm not sure is beneficial or detrimental), and our higher ups want to continue to have that that nice green checkmark that says Verified when a device is manually enrolled. Problem is I didn't setup and implement our original Code Signing Certificate with Profile Manager, so this is my first time in that particular rodeo. As I am also not familiar with the inner workings of Jamf yet, I'm having some trouble figuring out where to start in this whole Code Signing Certificate endeavor. I know we will need to either renew or purchase a new Code Signing Certificate in order to get that green Verified checkmark, but I can't seem to find anything about steps that are needed after purchase to get it up and running Jamf. Any help, information, t

My bosses are about to implement a conference room booking system that may use iPads mounted at the entrances to rooms to display room status and allow for booking etc right on the iPad. I am told that we will need to manage these iPads especially to get them on our 802.1x network. I have never had a need to manage iOS devices until now. I don't even know where to begin - especially with the 802.1x. Am I going to need to get VPP working? Will I need to use Apple Configurator? Will I have to create AppleIDs for each iPad or can I use a single ID on them all? Is there a JAMF Pro "getting started" guide for iOS management? (DEP is out of the question here.)

Has anyone come up with a way to check the version of the currently installed DisplayLink drivers? There's no app and I can't find where the actual driver files are installed to query.