It appears that an installation of CarbonBlack (6.0.4.70328) crashes macOS High Sierra 10.13.2 and systems that are running CarbonBlack (6.0.4.70328) will not boot after an upgrade to macOS High Sierra 10.13.2. Removing CarbonBlack appears to heal all wounds.

Mac OS 10.11.6Casper/JSS version 9.9.6 On my first attempt at setting up automatic installation of VPP apps, I have run into a situation where only some of the apps will install automatically. I have six free VPP apps that I am trying to deploy via the automatic installation process within the Mac App Store Apps settings. Each time only three install on first login. TextWranglerNumbersPages The three remaining: Microsoft Remote Desktop, Keynote and xCode do not install unless I un-scope them from within Mac App Store Apps --> Application, then re-scope them. I have my configurations for all six apps the same. I have tried this with the apps scoped in a Smart Group/All Users or Single Client/All Users. In each instance it is the same apps that will install or not. Is there a limit as to how many apps I can automatically install with this process? Is this a known bug? Cheryl

We have some software that we want users specifically request by calling/mailing our helpdesk, and then our helpdesk can assign the software to the users computer. Is static groups the best route for this? For example a user wants SPSS 24. Sends a ticket to helpdesk, they log in and assign the computer to a static group called Install SPSS 24 that is scoped to a policy that installs SPSS 24. Any caveat with this or would you rather just add the computer directly to the policy instead?

I've been working on a script that validates if a Mac's binding to AD is still active or not. This is an issue that seems to be caused when the computer is off the corporate network at the time of kerberos key cycling, typically set to 14 days (see dsconfigad -show; setting it to 0 will stop this cycling, which I am currently testing to see if it stops bindings from breaking). This has been working fairly well, except for that we are getting some false failure reports when using the id command. Has anyone had to do this and found a more consistent way to see if a device binding is working or broken using the id, dscl or other commands? #!/bin/sh adserver="directory.contoso.com" testuser="_MacComputer" pass="AD Binding OK" fail="AD Binding Failed" offline="Not in range of DC" notbound="The Mac is not bound to contoso.com" # Check if we can ping the AD Domain Controller, if ping was successful check if we can query a UPN # If the ping was successful check if we can we query a UPN?

Hi folks, I've got a curious problem. My scripts, part of a configuration used at image time, seem to get cut off half way through. I think this is to do with the jamf.app doing an upgrade when the Mac boots for the first time (and seemingly while the script is running). The script works normally if called at any other time after imaging. JSS version 10.1.1-t1513360285However, the imaging.app simply shows as 101.1 - autocaspernbi reports a minor version difference, but is happy to build the nbi. There is no higher version available to me it seems. I assume that an older jamf binary is in this "older" imaging.app that nbi uses, which then gets upgraded as soon as the image is delivered and booted up for the first time. So, at least to troubleshoot this issue, can I somehow get the upgrade to be delayed? The upgrade is automatic so I'm assuming no? Should I create a quickpackage and add to the configuration? Or is there another imaging.app that I can download somewhere? For referenc

Ok. So, I have been all around JAMFnation and found the following article that is supposed to fix the exact issue that I am having: http://www.macos.utah.edu/documentation/administration/setup_netboot_service_on_mac_os_x_10.6.x_client.x_client/setup_netboot_service_on_mac_os_x_10.6.x_client-diskless_netboot.html The problem is that I can download the file, but not put it in the directory since it is a "read-only file structure." I have tried editing the file with the same results. I have tried making a copy of the NBI and editing it outside of the netboot directory and even enabled the root account and tried to edit it using that. Same error in terminal for those that are thinking it... I am unsure what to do now and where to go from here.Do I need to build a new MBI with the rc.netboot file built into it? Does anyone have a suggestion on how to get rid of the original error? System info:OS 10.10.4JSS 9.72 Any help would be appreciated,Dan

I have a few programs that gets installed when a computer first gets enrolled with the Enrollment Complete trigger: Office 2016, Acrobat Pro DC, Skype for Business and so on. Is there any neat way to skip installing the program IF the program is already installed? Say a user enroll a machine that already has Office 2016 installed via a user initiated enrollment - I don't want the policy to re-install Office 2016 since its already on the machine. Any tips?

Hey folks Sorry, another newb question here.Just starting to throw some Apple TVs into Jamf and I noticed that they're automagically being lumped into my Smart Groups that have no criteria set.Can anyone offer a suggestion for an easy way to tailor my smart groups so that the iPads and the Apple TVs stay separate? ThanksDeano

Hi. I was wondering if there's a script available that will allow me to trigger all of my policies in the order I desire. Uploaded my current script (not fully grasped the usage of scripts yet) I'd like it to be a manual trigger for all of my policies but ordered e.g. 10GoogleChrome,20IssueFilevaultkey etc Please help :D

Has anyone here successfully configured Securly to work in their OS X environment. We are testing it for a possible future purchase and have gotten it to work with the iPads and Chromebooks. I followed their instructions from a conference call, adding their DNS forwarders to our DNS server, editing their uswest_OSXDNS.sh script to add our DNS server address, creating a Configuration Profile with their self signed .der file, and a Policy to run their uswest_OSXDNS.sh script during startup, login, logout, network state change. The Configuration Profile installs, but the scrip policy fails. The error we get in the policy is: Our script consists of the following information (the IPs have been removed for security): !/bin/bash servers=“###.###.###.### ###.###.###.###"networksetup -listallnetworkservices | sed 1d $file | while read adapterdo networksetup -setdnsservers "$adapter" $servers networksetup -setv6off "$adapter"donedscacheutil -flushcacheexit 0 We are not getting a

Anyone else seeing an issue with 10.13.3 devices even after receiving the FV profile. End users are not being prompted to enter password? Within Jamf Pro 10.0 console. The device is not encrypted yet it still says the enduser is a FV user and FV has yet to be enabled. 10.13.2 and below not an issue.

I've been playing around with DEP and user creation when staging a computer for users. We have a 1:1 environment. I have ticked in Require Authentication and Skip Account Creation in our PreStage Enrollment, so a new user must authenticate with their LDAP credentials. So only a hidden management account and an extra admin account it created on the machine. Is there any way to create a local user on the machine with the credentials provided from LDAP in the DEP enrollment? Like, without binding the machine to AD, if it makes sense? Sorta like a one-way operation, users log in during DEP, and the computer creates a local account from the credentials. Does this makes sense?

Hi Everyone, I have been given a script by JAMF to help with adding users to the FileVault list at login via a policy, we have a epic amount of Freelancers and they are not always the type to bring the machine back to have themselves enabled, they will then go on a shoot/leave the building and cannot access the machine. Here is what I got from JAMF: #!/bin/bash ###################################################################################################### Copyright (c) 2013, JAMF Software, LLC. All rights reserved.## Redistribution and use in source and binary forms, with or without# modification, are permitted provided that the following conditions are met:# Redistributions of source code must retain the above copyright# notice, this list of conditions and the following disclaimer.# Redistributions in binary form must reproduce the above copyright# notice, this list of conditions and the following di

SOLVEDThe title is a bit confusing so here's a better explanation. We have an established policy that has been working great since we starting using Jamf earlier this summer. Lately, when I go to add a Mac to the policy(scoping to individual computers) sometimes the Mac will not take the policy. I'll set up another Mac and it will take just fine. I can seem to figure out why on some Macs the policy will take and others it just wont. Below is what I've tried thus far. Remove and re-add policy to ma Force check for policies with sudo jamf policy Unenroll, delete from Jamf Pro, enroll again Re-image Mac Removed MDM profile and re-enrolled Clone the policy and scoped to just the troubled Mac All of the above has not resolved the issue. However, if I create a brand new policy(without cloning) it works fine. At first I thought it might be an issue with replication of policy with Jamf Cloud but, that doesn't seem to be it since I can create a brand new policy and it takes and works im

Hello everyone, I am trying to find out how to enable a Chrome flag on the Chrome manifest. The flag I want enabled is SitePerProcess which is Strict Site Isolation, the reason I am doing this is because of all this new specter and meltdown issue. I have looked into the Policy List on Chromium : [http://www.chromium.org/administrators/policy-list-3#SitePerProcess](link URL) The problem I am having is I don't know which is the proper way to add this to the manifest. Does this look right ? This is just an example, any help will be greatly appreciated. <?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>SitePerProcess</key><true/></dict> Let me know what you all think, thank you.

Is setting a firmware password just involve using the EFI Password Payload ? setting Security Level to 'command' ? and giving it a password ? I read this article https://jamfnation.jamfsoftware.com/article.html?id=58 does it still apply ?

Hello,I was wondering if anyone has tried using this to schedule and deploy OS upgrades/updates?We've tried setting up a combo update of 10.13.2 (from 10.13.1) through Self service and it looks to work (no real info from the UI telling us the %done or whats going on in side SS) and it reboots but doesn't actually update the OS.The JSS log for the policy didnt say anything.Local jamf log shows that it downloads the DMG successfully from the repo. The mac is a fresh 10.13.1 install so there should be no problems with functionality or corrupt files from usage from a user. Anyone else tried this yet and had more success? Below is the jamf.log from the mac. Wed Jan 17 15:09:03 macbook1 jamf[2497]: Checking for patch ID 1 Wed Jan 17 15:09:03 macbook1 jamf[2497]: Executing Patch Policy macOS Wed Jan 17 15:15:26 macbook1 jamf[2544]: Checking for policies triggered by "recurring check-in" for user "test"... Wed Jan 17 15:15:29 macbook1 jamf[2544]: Executing Policy Update Inventory Wed Jan 17

Anyone else seeing this?

Hey guys, is there a hidden button or anything else to force update the patch reporting software titles? A Flash update was released yesterday but the new version doesn't show up in our JSS. Michael

Is there a way to turn OFF parental controls using a command line. The target client is on Yosemite. I need to be able to find a way to disable that checkmark under SYstemPreferences -> Accounts -> user

So I have a restricted software to stop users from actually installing High Sierra. But when they are at home and on their own networks, they get the notification that High Sierra is out and if they want to download it. Some of our users have been downloading it, and trying to install it. Thankfully we've blocked the installer. Is there a way to stop the notifications from Apple telling them about High Sierra. I vaguely remember there was something to stop Sierra ones when they came out.

Hi all, Did something stupid... I used sudo firmwarepasswd -setpasswd to change the firmware password I got the following feedback, so I thought the password change was successful "Enter new password:Re-enter new password:Setting Firmware PasswordPassword changedNOTE: Must restart before changes will take effect" But when I type in the new Firmware password at the recovery screen (Command+R), I am padlock locked and can't get in. I tried the command again to see if I can change it back, but I get an error:"ERROR | setPasswdFromCommandLine | Unable to verify passwordERROR | main | Exiting with error: 4" This really is my Macbook, it's not stolen. Anyone know how I can reset the firmware password?

I noticed that my MacBookPro13,2 (10.13.2-17C88) wasn't successfully sending inventory reports to Jamf Pro (v10.0.0). I tried to remedy this by initially running a sudo jamf manage command and then escalated to full-on framework removal via sudo jamf removeFramework and re-enrolling. When doing so, I received Enroll return code: 2 in the /var/log/jamf.log file. I repeated these steps by trying to enroll into our development Jamf Pro instance running the v10.2.0 beta release but receive the same error. FWIW I've tried a QuickAdd package and also user-initiated enrollment through the web interface. Neither work and I've rebooted and deleted the asset/device from Jamf each time. DEP is a non-issue as they aren't any PreStage enrollments scoped to this particular device. Any thoughts?

Beta 2 for Jamf Pro 10.2 continues to fix bugs and improve performance. This release will expand on the patch management framework by adding support for external patch sources. Software titles hosted on an external source can now be used for patch reporting, patch notifications, and even patch policies. Keep all your third-party software up to date and secure with both built-in and external patch sources. In addition to the patch management enhancements, there is support for new user fields in Apple School Manager to sync back to Jamf Pro, a new DNS Proxy payload for iOS, and the new Approved Kernel Extensions payload for macOS. How to Join the Beta: If you would like to participate in the beta program, please enroll at the beta homepage on Jamf Nation under My Assets. After enrollment, please reference our Release Notes for a complete listing of what is included in the beta build. Remember, this is a beta release. We strongly encourage that you not install this software in a produc

I have a Policy that does nothing but Enable FV2 using our Pre-Set Encryption Configuration. The Configuration just Enables FV2 using The Management Account and sets Institutional and Individual Recovery Keys. Oddly this seems to work if I take a machine and enroll it, but I get this error if the machine comes in via DEP !!! Any Idea's ? I when DEP is used the JAMF account is created first and has an ID of 501, whereas if another account already exists, it gets ID 80. I did try changing the ID to 80 but it didnt help.