Hi there! Currently we are deploying a base macOS Sierra through modular imaging, this 10.12.6 is comming from the default installer and recreated with AutoDMG. If i do the same with macOS High Sierra, AutoDMG does not recognize this version of macOS.Does anyone have a temporary solution for this or a workaround so i can proceed with the macOS High Sierra deployment. Thankyou! Greetings,Thijs Xhaflaire

Hello, We are using FileVault2 on all our clients. During the onboarding-process we create a local service account, which is also enabled for FileVault of course. When a new user logs in for the first time with his ActiveDirectory credentials, the account will be created locally on the Mac (Mobile Account). Our problem: After that, the user has to be enabled for FileVault manually, which causes a lot of unnecessary workload. I tried to auomate this with a script: #!/bin/sh ############################################################################################################# # This script will add a new logged-in user to the FileVault enabled list, using the JSS. # # # # by Marco Kolbas | Greentube I.E.S. GmbH | mkolbas@greentube.com # #

I would like to create a QuicAdd Pack so I can enrol a number of macs in our lab. We have Casper installed on Windows Server 2012 and I cant find where this Recon.exe file is located?

I'm new to AD on the Mac, so maybe I'm missing something. Local standard (ie non-admin) accounts can't seem to log into a machine after it has been bound to the domain. It doesn't matter how I bind the machine either - Casper or manually using Directory Utility. The standard account works fine before I bind the machine. But after I bind the machine the user can't log in. If I remove the machine from the domain I still can't log in with the standard account. Local admin accounts work. And I can su to a local standard user account. I've checked Directory Utility and the search policy order is set with /local/default as the top option (can't change that I don't think). Am I just missing something about local standard user accounts on machines bound to AD?

Hello! I'm trying to find a solution for attaching Dockutil commands to a policy. I want to embed the command within the policy, instead of creating a separate script for just adding one icon to the dock. I expected to be able to make a one-banger command on a per-Application basis through Files and Processes > Execute Command within the policy options, but I haven't yet been successful. Here's what I'm throwing in now. I don't know how the syntax compares to creating a bash script. I think my hangup revolves around the command running as Sudo, instead of the current user. /usr/local/bin/dockutil --add /Applications/DaVinci Resolve/DaVinci Resolve.app --before 'Fusion' "/Users/$3" Fomr the logs... Running command /usr/local/bin/dockutil --add /Applications/DaVinci Resolve/DaVinci Resolve.app --before 'Fusion' "/Users/$3"... Result of command: /Users/Library/Preferences/com.apple.dock.plist does not seem to be a h

Hi all, Still a bit new to the world of Jamf. I'm setting up MacBook Airs for our teaching staff. Current setup would be to create a local admin account (also a hidden admin account via PreStage Enrolment and DEP) and enable the Guest account. If teaching relief staff (or school officers) want to use the laptop, they can use the Guest account. I'm trying to decide if I should bind these machines to AD, for the sole purpose of letting other staff sign in with their own AD credentials, versus using the Guest account. I also would not be setting up a mobile account since the only person who should be taking the machine home should be the teacher who the device is assigned to, plus again since it's a local account, I don't think I need a mobile account. If I manually join the machine to AD after the initial setup, could there be any problems for the main local account (which has the same username as the AD username?) The reason for setting up the machines with t

via casper policy I install Office 2016 VL 15.17 and use a choices.plist file to not install Outlook and AutoUpdates. It all works fine, check for updates is not in the Help menu. I handle the updates through casper policies. update 15.20 was applied and all stayed the same, until 15.21.1 updates were applied now in the Help menu 'Check for Updates' appears, and if you click it, it says 'MICROSOFT AUTOUPDATE CANNOT BE OPENED. Microsoft autoupdate might be properly installed on the computer. To restore it, reinstall your Microsoft application.' is anyone else seeing this also happen to them ? I created a new .pkg with the 15.21.1 VL installer and get the same result, check for updates is visible in the HELP menu and if a user clicks it the would get the same message above. there is no differences in the ShowChoicesXML from the 15.17 to the 15.21.1 installer.

Hi, Is there a script that can be ran as a policy that removes all traces of Jamf from a machine that we can run after imaging, We run Jamf as an opt-in system but would like to use the imaging process for all machines in the business. Is it as simple as having a policy that runs sudo jamf -removeFramework or would that run into issues? Thanks

Our company is going to start experimenting iOS development environment. What type of environment is needed for this for 10 developers? I figured a Mac with xcode and an iOS device is sufficient but they are requesting Mac Mini to use it as a server? I'm not very familiar with iOS development so please advise me anyone out there with knowledge can give me what would be the recommended environment to develop, test, and deploy the application.

Our environment hasn't really had any need for a caching server, but I figured I'd test it out anyway. I took a server we had previously set up as a file server/time machine server as the guinea pig. Since this is a test only, it's OK if it will only work on its subnet. The problem is it doesn't work at all even with machines confirmed to be on the same subnet. Hardware: Mac Mini (mid 2011) macOS: 10.12.6 Server Version: 5.3.1 ip address: static client OSs: Range from 10.10-10.12.6 Permissions: All Networks + matching this server's network Peering: All Networks StartupStatus = "OK" RegistrationStatus = 1 CacheStatus = "OK" state = RUNNING AllowPersonalCaching = yes (temp just to confirm caching works) LogClientIdentity = yes AllowSharedCaching = yes ListenRangesOnly = no LocalSubnetsOnly = no As far as I can tell from Apple's documentation, this should be fine for something that runs solely on one subnet. It has always successfu

Using a DEP prestage enrollment, I'm trying to get the following script to kick off right after the user is at the desktop. If I scope a policy to trigger at "Enrollment Complete", the policy is being triggered for user "_mbsetupuser" and the JAMF Helper dialogue box opens up in the setup assistant rather than at the desktop. If I use "Login" as the trigger, the JAMF dialogue box opens at the desktop, but clicking "Log Out" doesn't cause the logout to occur. EDIT: I should add that I've scoped the policy to Self Service and manually ran it. It works as expected that way. I am a novice when it comes to scripting. The base script I'm using is something I found on JAMF Nation. !/bin/bash jamfHelper="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper"windowType="hud"description="To begin FileVault disk encryption of your Mac, you will need to log out and log back in. Pleas

Hey there, I was hoping someone could clarify some stuff about In-House eBooks. We have a number of teachers who are using "iBooks Author" to create their own ebooks, and they have enquired about the possibility of distributing these to their classes. We are trying to be as "device based" as possible. For our iPad carts, we don't use Apple IDs & we have the "lock account settings" restriction in place. I was looking at the Jamf Administrator's Guide, and it says (under requirements): *To distribute an in-house eBook, the eBook must be one of the following types of files: ePub file (.epub)iBooks file (.ibooks)PDF To install an ePub file, you need: A mobile device with iOS 4 or later and iBooks 1.0 or laterA computer with macOS v10.7 or later and an application to view eBooks To install an iBooks file, you need: An iPad with iOS 5 or later and iBooks 2.0 or laterA computer with macOS v10.9 or later and iBooks 1.0 or later"* I am aware that I need an Apple ID to distribute

I'm running JSS version 9.96 and created a search using the advanced criteria "number of available updates" = 0, which returns 194 records. However, 194 is the total number of computers under management and it hardly seems likely that all computers are completely up to date. I did a quick manual scan and can see I have a computer at 10.12.0 so I would expect at least one hit. Is the "number of updates" function broken? Seth

Is there a way to deploy Apple TVs with DEP/Apple School Manager? I have 25 Apple TVs registered in our DEP and it shows up in JSS for Pre-stage enrollment. However, the device doesn't show up in JSS after booting it up even though it says "assigned" in the pre-stage enrollment scope.

Has anyone had success registering and de-registering Tinkerplots v2.3.3? I've followed the recommended command line instructions on their website ( http://www.tinkerplots.com/network-installation ) but with limited success.

Hello, After updating certificates on the JSS console, I unloaded the Tomcat process from the command line to do a full backup (it's quicker that way). I reloaded it but was unable to connect using a browser or any of the Casper Suite apps. I am able to connect through vnc, afp, smb, ssh, scp, and web hosting on port 80 with multiple computers. Here's what I've done so far for troubleshooting:- tested networking- turned the server off and on again- restarted Tomcat- restarted MySQL- restored an earlier database backup- reinstalled JSS and rebooted- updated to JDK 7 u71 with Tomcat unloaded then rebooted I'm on 9.62 and the server is on 10.9.5. I'm about to do a decent-sized rollout of classroom Macs that need management starting Friday. Any suggestions? Happy Holidays! -Andrew

Hi guys, Am trying to create Smart Group over curl with the following attributes. However, its not as expected because of the missing bracket. How do i get bracket included in xml? Thanks <?xml version="1.0" encoding="UTF-8"?> <computer_group> <name>Test_xml</name> <is_smart>true</is_smart> <criteria> <criterion> <name>Computer Group</name> <priority>0</priority> <and_or>or</and_or> <search_type>member of</search_type> <value>Z-Google Chrome Install</value> </criterion> <criterion> <name>Application Title</name> <priority>1</priority> <and_or>and</and_or> <search_type>is</search_type> <value>Google Chrome.app</value> </criterion>

I am trying to do a silent install of LastPass on our Macbooks, I am following the instructions from this link. I downloaded the pkg and created a dmg using composer which will put the LastPass pkg in the users downloads folder. I then run a policy that runs the following script sudo installer -pkg lpmacosx.pkg -tgt / This is where I am having the issue, the policy fails stating that the package path specified was invalid: 'lpmacosx.pkg'. I do not know much about scripting but I am wondering if I am supposed to put the location of the pkg in the script for it to run properly. Any help is much appreciated.

I'd like to export the FileVault2 recovery keys and iOS device Activation Lock Bypass Codes programmatically on a scheduled basis. I know the JSS has an API where stuff like this can be done. Has anyone done anything similar, before I go re-inventing the wheel?

Hello! I try to automate the creation of certificate request files. Everything works fine so far, except the correct handover of the former entered values for the request file. I have eight variables with strings, this strings could have spaces, like "John Appleseed". I use this line to generate the request file: printf '%s ' $countrycode $state $city $company $department $name $email $nothing $nothing | openssl req -new -key /Users/Shared/Greentube/CertificateRequest/Files/RSA.key -out /Users/Shared/Greentube/CertificateRequest/Files/REQUEST.csr It works like expected as long as the variables don't contain any spaces, but it gets completely chaotic if there are spaces, because it does the "new line" after a word ends, not after the complete value of the variable ends. So "JohnAppleseed" would work, but "John Appleseed" would only enter "John" to one field and "Appleseed" to the next.. I'm sure its

We're a pretty large organization, and when a user calls our help desk one of the first things they ask for is the IP address of the machine they're on. A lot of our Mac users don't know how to get that information, even though it can be explained to them a better way would be to have a big button in Self Service that says "What is my IP Address" or something. Casper already knows each user's IP address. Is there a way to leverage that information into a script that displays it for the end user when they click the button in self service? I already have a script that uses jamfhelper to put up a hud window type, I can modify it to display the user's IP address, I assume, if I can find a way to get the IP address in the first place. And possibly to copy it to the user's clipboard when they click an OK button in the window that pops up. And before you ask, no, the help desk does not have access to casper and that will probably change in the future,

Hello Everyone, I'm trying to create a .dmg from a .pkg, but when I use Disk Utility - Image from Folder I can't select any .pkg. They are all greyed out. Any advice on what I might be doing wrong. Thanks, James

I have an enrollment script that does a lot of behind-the-scenes system configurations, installations, etc, but I'm having a timing issue with DEP and the Enrollment Complete trigger. I would like to create a LaunchAgent that kicks off the policy on the next user login (login trigger does not seem to work consistently). The policy's script would go through the process, delete the launch agent, then reboot. I can run the script locally, but since it requires a lot of admin privs, it's not practical because of the constant user nagging for passwords. Is this even possible?

Good morning all (morning where I am at least!) I'm having some trouble with customising my Self Service. I'm going off of the wonderful guide here by Emily Kausalik. My JSS is running on windows 10. I am trying to edit my login logo, and the default background colour of the login screen (referred to as JAMF BLUE by Emily) - I have set the corresponding values on the relevant .css files, (located at C:Program FilesJSSTomcatwebappsROOTstylesheetsosxselfserviceSelfService And replaced the default login logo (located at C:Program FilesJSSTomcatwebappsROOTuiimagesselfservice2) The relevant values and files in both of these folders are showing as what I have set them as (i.e. the changes worked), Yet these settings aren't pulling through to my actual Self Service app, this is after a machine restart, a SS refresh/close/reopen etc Is there some obvious mistake that I am making? Some of these changed were made hours ago, I would have thought they would have taken effect

Hello everyone, I've been working on getting 802.1x set up on our Macs using machine certificate authentication. Currently, my configuration profile is set up such that all of the necessary domain certs are installed (CAs, and intermediate CAs) and trusted, an AD Certificate request is performed to get the machine certificate from the private CA, and a network payload is delivered specifying the SSID, WPA2 Enterprise as the authentication type, TLS as the protocol, and the machine AD Cert as the identity certificate. If I leave the settings just like that and apply the configuration profile to a device, things work great for the most part. The user can connect to the wireless network by selecting it, specifying their device certificate for authentication, and confirming that they want to trust the certificate presented to them by the radius server. This is the behavior that I would like to update. I don't trust the user to correctly identify and trust the certificate belonging to o