Hi Forum, Word is coming down from the top that our senior leadership team wants to revoke local admin rights on people's Macs/PCs this year. Our people are currently Admin/Managed/Mobile accounts. As such, if admin access is revoked, what's the best process for users who wish to change their AD/domain password on their Mac if they can't unlock the System preferences pane?

Hello, I am new to the Mac and Jamf world and am in need of some advice. I need to deploy a script via Policy to change the "DisconnectOnLogout" value for each NIC on a device to "NO". The below AppleScript works but it prompts for credentials. How could I change this so that it runs silently? Any assistance would be greatly appreciated! activate application "Terminal"tell application "System Events" to keystroke "sudo /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport en0 prefs DisconnectOnLogout=NO"tell application "System Events" to keystroke returndelay 2tell application "System Events" to keystroke "sudo /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport en3 prefs DisconnectOnLogout=NO"tell application "System Events" to keystroke returndelay 2tell application "Terminal" quitend tell

I put this together and tested it, thought I would share. It should work, but I suspect it could use some refinement. Maybe others will find it useful.We need to know the profile size of Outlook 2016. This EA will pull in the Outlook Profile size, in case you needed to know. currentUser=`who | grep console | awk '{print $1}' | grep -v -i '_mbsetupuser' ` result=`sudo du -shc /Users/$currentUser/Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/` echo "<result>$result</result>"

We are using JAMFHelper to display a message when Software Updates are ready for install. Since the user has a chose of doing them now or waiting, some users are just moving the message box out of the way. This stops the machine from checking in until the box is closed. Is there a way to set a default response (2) and close the message box so that other policies and other check-ins happen? here is the code i'm using currently: if [ $Timer -gt 0 ]; then HELPER=`/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper -windowType utility -icon /System/Library/CoreServices/Installer.app/Contents/Resources/Installer.icns -heading "Software Updates are available for your Mac" -description "If you would like to install updates now, save all your work then click Yes (Then go grab a coffee or snack as you won't be able to use your computer). If you would NOT like to install updates now, click Cancel. You may choose to not install up

I am attempting to run a "first boot" script at the login window immediately after imaging a 10.12.6 computer with Jamf Imaging. Ideally, I would like to launch LoginLog to show the progress of the script and to prevent anyone from attempting a login while the script is running. I would also settle for using JamfHelper to put up a full-screen message to indicate that setup is taking place. Anything to just lock the screen while the script is running. I can get either of these options to work at the login window when I manually run the command through SSH or ARD, but if I have my script call either LoginLog or jamfHelper the script either hangs or proceeds without launching the specified app. It seems like lots of people have been able to successfully do what I'm trying to do here, but it just isn't working for me. Help would be much appreciated!

Hi everyone, I have a problem with NetSUSLP and Ubuntu 16. According to the product description NetSUSLP 4.1.0 is compatible with Ubuntu 16.04 LTS. Unfortunately when I launch the installer I get the following error: Verifying archive integrity... All good.Uncompressing NetSUSLP Installer..............Starting the NetSUS InstallationChecking installation requirements...Checking for a supported OS...Error: Did not detect a valid Ubuntu/RedHat/Cent OS install. if I go to check the logs I find this:Starting the NetSUS Installation[2017-12-19 12:35:12]: Checking installation requirements...[2017-12-19 12:35:12]: Checking for a supported OS...[2017-12-19 12:35:12]: Error: Did not detect a valid Ubuntu/RedHat/Cent OS install.[2017-12-19 12:35:12]:[2017-12-19 12:35:12]: Checking for a 64-bit OS...[2017-12-19 12:35:12]: OK[2017-12-19 12:35:12]: Aborting installation due to unsatisfied requirements. can someone tell me what or where am I wrong?the Ubuntu is virtualized and Version is Ubuntu

Hi there! Currently we are looking for a solution to restrict a user from loggin in onto a macOS device from our organisation except his own. Like we have on our Windows 10 devices, Logon restrictions, Certificate based loggin in into ADFS. Anyone having some good suggestions to prevent to have a user the availability to log-on multiple macOS devices. Greetings,Thijs - bol.com

Hey folks. We have our JSS and our main DP on the same server. We are configuring downloads over HTTPS but have issues with getting it to work. We can fetch packages just fine when opening a browser from a client and manually entering the URL for the packages on the server. When running jamf policy -verbose from a client we get the following error: We are not using a self signed cert. Also a sidenote question; When HTTP/S is enabled, does the clients only fetch packages from HTTP/S? And SMB is only used by Casper Admin to upload packages?

Does anyone know the proper certificate format to sign a quick add package? I'm using a .pfx and it doesn't seem to be correct... is .cer correct?

Hey all, I was asked if Jamf Pro could remotely unencrypt a device... is this possible? I did search but did not get many pertinent results. Thanks, Scott

We deployed about 600 iPads this year for a 1:1 and decided not to use AppleIDs for the students. With all apps (we thought) being deployed through Device assignment no one could find a good reason to add another login to the iPads. This was fine with all the stuff we added, but what about things that are already there? Being new iPads they automatically had Garageband there for student use. We wanted to use it so we didn't try to hide it.. but when students go to use it they are prompted for an AppleID. I though I could work around this by grabbing some free GB licenses through VPP and assigning them to these iPads, forcing out the app, and checking on "Make app managed if currently installed as unmanaged", but that didn't work. Students get prompted. Anyone know of a way around this prompt which can be deployed or must students have AppleIDs?

Got a bunch of ipads that I recently wiped and update to 11.2.1 via apple configurator so I can set them up as shared iPads. I've gone to start the setup and they are defaulting to the Cupertino time zone (we're in the UK) which means the MDM enrolment profile won't install because the time is so far out. I've selected United Kingdom as part of the setup but this doesn't help. I've allowed the location services screen to appear but it doesn't get that far because it can't download the enrolment profile. Is anyone else in the UK experiencing iPads defaulting to Cupertino during the initial setup phase?

Hello JAMF Nation, This is my first post so be gentle. I am trying to create a basic script that will delete the Microsoft AutoUpdate.app from the Library. End game = I do not want users updating their own versions of Office and creating a SUS is not possible. So I figure deleting the MAU app will suffice for now. The problem is I cant get any scripting to accomplish what Im trying to do. Any help would greatly be appreciated! Signed, Beginner JAMF guy.

I previously used a configuration profile that disabled the assistant entirely. That no longer works in 10.13. So I tried running the following command on the computers: /usr/bin/defaults write "${USER_TEMPLATE}"/Library/Preferences/com.apple.SetupAssistant DidSeeSiriSetup -bool TRUE That didn't skip it. I couldn't find anything in the Configuration Profile settings to skip over it. This isn't an issue on individual users machines, but I do not want this popping up for every single person who signs into our lab computers. That's just not a good thing. Does anyone know a way to skip over "Enable Ask Siri" that works on 10.13.2?

How can I generate a report that includes all apps deployed to a list of ipads?

Dear all After Jamf enrollment some of my clients have an issue as after longer period of sleep mode computer shutdown. So I can't find any settings regarding shutdown in Jamf. I do use configuration profile without energy saver payload. Have you experienced a same problem ?

Hello, I am having trouble getting JAMF to run an update on machines. I am able to get it to download the installer, but then not install it. Here is what i did: I went to apple to download the combo installer. https://support.apple.com/kb/DL1931?locale=en_US I went to casper composer and i turned this .dmg file into a pkg. I went to my JAMF console and created a package (only option i checked was - requires restart) Next, I went to create a policy. I made the trigger as a "reoccurring check-in" and changed the execution frequency set to "once per computer". Under Scope I chose a specific computer i'm testing with. (i do realize i can make a smart group when i'm ready to do this in bulk) filled in some dummy messages under "user interactions" I went to packages and then i chose "cloud distribution point" and then i found the package i created in step 3. I then waited patiently for the machine to pick up the policy on check-in and then it downloads the package and then it display

I'm new to NetSUS (I just setup mine for the first time version 4.2.1).I'm able to block "Pro Video Formats 2.0.6" but I don't know how to block "Final Cut Pro version 10.4"any help would be appreciated...thank you.(fyi: I'm just doing a test on blocking "Final Cut Pro version 10.4" since that's what I'm not being able to block)

Anyone using examview Test Generator 8.1 with 10.10? Figure out a way to get it to print? It seems it only will print single blank sheets. The company states that 8.1 doesnt support 10.10, and that we need to subscribe to their new version to get 10.10 support. I'd rather figure out a work around. Any ideas? I think its a Java problem personally. Gabe ShackneyPrinceton Public Schools

I've read through forums and on the web and have seen a lot of different ways to do this, but I don't understand why I can't get the Self Service Icon to pop up in the Dock by using a simple policy with a Dock Item. The only thing I have had show up is a grey '?' with the path of Self Service.app" when you hover over it.I know the path I typed is correct because I have other modified Icons in the Dock that have been removed or added, and they all work perfectly. I just mirrored the syntax from those and replaced it with Self Service.app. I tried with and without spaces. I was going to try using composer to take a snap shot of the dock after manually dragging it down there, but I want to know logically why it doesn't show up like the others. It opens right up when clicking on it in the Applications folder. Any Ideas?

Hi all! I'm writing a script to allow users to send a management command to their iOS device directly from a Self Service policy on their Mac. Looking at the API documentation, the process for sending commands to iOS devices is fair bit more complicated than the standard API PUT and POST schema. I'm not really sure that I understand what is needed, so any help would be greatly appreciated! Does anyone have an example of an XML file that they've created for the purpose of sending management commands? I can't seem to find any detailed information on this anywhere! Thanks in advance!

I am having a serious brainfart and my google searches aren't giving me what I need. My MacMini server running Sierra that I'm using for Netboot and Caching (and hopefully soon Profile Manager) is telling me that the Apple Push Notification Service certificates are expiring soon (March 14) and it lists apns:com.apple.alerts apns:com.apple.calendar apns:com.apple.contact apns:com.apple.mail apns:com.apple.mgmt although I'm not using calendar, contacts, and mail at this time. The notification tells me the cert can be renewed in Server. I go to Server > Certificates and the only cert it shows is "Server Fallback SSL Certificate" that I don't remember ever setting up. I logged into the Apple Push Certifications Portal and I see my server listed but only a Revoke button next to it. How on earth do I renew the cert or even just start over with a brand new one? I can't find anywhere on the server nor in the Portal an option to create a new APN cert.

I've seen this occur on average, every 1/100 devices (these Macs are all on 10.12.6 Sierra) where after completing the jamf enrollment and rebooting the mac, a large number of applications begin to exhibit behavior where the apps quit unexpectedly upon loading.The most unique thing about our enrollment is implementing the CIS script by Jamf and enabling FV2. An sample screenshot of the error is below Thoughts on how to fix or troubleshoot this??

Hi Jamf Nation Inside the Office 2016 Volume License DMG from the Microsoft Volume Licensing Server Center there is a PKG called Microsoft_Office_2016_VL_Serializer_2.0.pkg. How many times can you install this package? Is this package different for every Volume Licensing Server Center customer? I'm asking because we have multiple school which are using Office 2016 and they have the same File Share Distribution Point. It would be nice if they can use the same package instead of creating a package for every customer. Best Anver

I'm trying to create a script that will output a png file from an icns file using sips command. The script uses read to capture path to icns file, and to capture name of the png file it outputs. The script outputs the png file to /private/tmp/ directory...or it should: #!/bin/sh # Prompt for source file /usr/bin/read -p "Drag ICNS source file into Terminal and hit RETURN: " SOURCEFILE # Prompt for output file name /usr/bin/read -p "Provide output file name (no spaces!) an hit RETURN: " OUTPUTFILE # Create file /usr/bin/sips --setProperty format png --resampleHeightWidthMax 128 "$SOURCEFILE" --out /private/tmp/"$OUTPUTFILE" exit 0 The script is executable (755). I navigate to the folder and run the script (using obligatory "./" since I'm in the directory the script is in). I'm using BBEdit 12 for test. Here is what I get: $ ./createIconJSS120png.sh Drag ICNS source file into Terminal and hit RETURN