Hi guys, Recently having an issue where config profile is stucked in Pending state. There are some computers that are in pending state for a few days and suddenly the payload is applied. Checked the log and saw a lot of Error in sending push notifications. com.jamfsoftware.jss.pushnotification.connections.ApplePushNotificationServiceConnection@3ass0bn82. Software caused connection abort: socket write error 2017-05-26 03:13:11,861 [WARN ] [neralPool-9] [PushQueueManager ] - Error sending push notification I have checked ports are opened for the following: gateway.push.apple.com:2195feedback.push.apple.com:2196 Have also done the following:sudo jamf removemdmprofile and sudo jamf mdmsudo jamf reconscope and rescope the config profile. Thanks

Here's the scenario, 5th-12th grade have MacBook Air's. 5th grade, however, is treated differently since it is elementary school. They do not take the devices home, but rather stay in a cart in the classrooms. That being said, we set passwords for the student AD accounts according to which teacher they have and which number they are in the cart (ex. Teacher05). Since we do it this way, we do not like passwords to be changed for 5th graders...although, 6th-12th graders CAN since they carry their devices and it's more "theirs" than sitting in a device charging cart in a class. Here's the problem, since we globally push the same preferences and settings in JSS to this same MacBook model (it's easier this way), password changing is ALLOWED on all the MacBook Air's, including my 5th grade students. While this is not a major deal, it can crop up an issue here and there. A student will change their password and then proceed to say they are locked out of said device, whether it's on purpose o

Hello, I am just starting to use the API queries with python. I am having some difficulty getting anything to 'PUT' changes for existing devices. I keep getting a HTTP Error 500: Internal Server Error. I am unsure where to check for logs on the server side for API access attempts or if there even are any such logs. I have tried multiple attributes but keep getting the same error, here is a sample below. I have a test.xml file and in that test.xml I have the following<mobile_device><location><username>testusername</username></location></mobile_device> code as follows:------from urllib2 import urlopen, URLError, HTTPError, Requestfrom xml.dom import minidomimport base64 my_xml_doc = minidom.parse("test.xml")url="https://myserver:8443/JSSResource/mobiledevices/id/9999"req = Request(url, data=my_xml_doc.toprettyxml())req.add_header('Content-Type','text/xml')req.get_method=lambda: 'PUT'bas

We are preparing to scale from about 1500 iOS devices to 10,000+. We are currently running the JSS in a virtual Ubuntu environment with our SQL server separated out on its own VM. We plan on standing up two more JSS boxes and placing a hardware based load balancer in front of them. I have heard varying advice regarding sticking with Ubuntu in a virtual environment or moving to several Mac Minis running OS X Server. I am wondering if anyone has any advice. Thanks

Hi All, On my 10.8 image, i'd like to change the default mail client from Mail to Outlook.. so far without much luck (original post was here: https://jamfnation.jamfsoftware.com/discussion.html?id=4085). I've tried the below MCX, but this doesn't seem to work on 10.8: Display Name: Default Email Application Application Domain: com.apple.internet Key Name: mcx_defaultEmailReader Key Type: string Key Value: /Applications/Microsoft Office 2011/Microsoft Outlook.app If I try the below, then the launch services plist gets overwritten at login. (due to the JSS's inability to other MCX settings that work Once for AD accounts https://jamfnation.jamfsoftware.com/discussion.html?id=4499). Display Name: Default applications Description: Sets preferred applications. Apply Setting To: User Level At Every Login Domain: ~/Library/Preferences/com.apple.LaunchServices Key: LSHandlers Value: <array> <dict> <key>LSHan

Hi, So with the changes in Sierra meaning that only 1 local account per machine is MDM enabled we have hit a wall. As we did not have a Directory Service in place beforehand we are trialling JumpCloud. However their user provisioning appears to be that it creates a local user, so still not MDM enabled. Does anyone know a way around this or if I am doing something wrong? Thanks

Due to Sierra only allowing one user with MDM. Is there a way to switch this between accounts on a device during login?

I'm looking for a way to make this work. In Windows, we use a powershell script that continuously run and monitors for network changes, sets proxy based on your network segment. I suspect we can achieve this with a script teamed up with an Offline Policy, set on Logon and Network State Change.Use network segments in the scope to define 'limitations' for which proxy they will get. (we have two) What I can't figure out is this.If I use exclusions for those same network segments I'm applying it to, will this remove the proxy, or will I need another script to disable it on a cloned policy (but using exclusion instead of limitations) ANDWe will have users connected through various ethernet adapters to the LAN (Docking stations, USB-C to Ethernet, etc...). There is no real way to predict which will be used. Is there a way we can target ANY network interface that is connected?

Script is being used to force a mail server address into the current Outlook account. Clients do not have admin rights and the script needs to be run under the logged in user. The markup below works great from within terminal while on the clients machine. However I'd like to have the script available within Casper Remote. I've looked through most of the threads that relate to 'executed by logged in user' without success. Thanks. osascript -e "tell applications "Microsoft Outlook" to set server of exchange account 1 to "https://xxxSERVERxxxADDRESSxxHERE""

I have an applescript that takes the three standard arguments and a string passed as Parameter 4 from the Policy. Everything works as expected when I run that script from the command line with the set of expected arguments. But when I run the same via a Policy from the Self-Service all arguments are concatenated and interpreted as one single argument, so the poos script is completely lost. Any idea what might be wrong?

Hi Admins, I would like to get some guidance on how to properly deploy Webloc Desktop Shortcut / FUT-FEU dmg. I got a very helpful guide from this post. https://www.jamf.com/jamf-nation/discussions/23531/create-shortcut-on-users-desktops-that-cannot-be-deleted#responseChild147521On my testing computer, it successfully created the Desktop Shortcut using the guide from the post above. I scoped it on my test computer. When I tried to deploy it using ldap group, it corrupts the Library of the logged in user. I receive "macOS needs to repair your Library" error. I would like the shortcuts immutable by changing the permissions, but I think its the changing of the permissions thats causing the error. I created a Self Service plug ins for this shortcuts but our Users just want it on their desktops instead. Thanks in advance.

Hello, I've discovered the following problem:After installing System Center Endpoint Protection on my Macs (10.12.4) managed by a JSS I recognized a massive lag after the login of the user (because the SCEP.app is configured as a login item). During the lag the whole system is frozen for a couple of seconds (sometimes it takes up to 20 seconds). The system also freezes for some seconds if I start the software manually after a restart without having it configured as a login item.Even a blank macOS with just the SCEP.app and the jamf framework installed causes this problem. The system does not freeze if the client is not bound to the JSS and if the jamf framework is not installed.Furthermore it does not freeze if the real-time file system protection in SCEP is disabled. Configuring some protection exclusions in SCEP wasn't successful either. Has anyone experienced the same problem or knows how to fix/prevent this issue?

Hi, I'm having an issue with JDS where by it will not copy new packages across all JDS DPs. I have tried lots of things:- checked connectivity between JSS and the JDS- checked connectivity between master JDS and a child JDS- checked DNS wasn't an issue- Ran inventory on each JDS - Restarted the JDS instances- Changing master distribution point and uploading to that.- Restarted tomcat service for jss incase there was anything on that side. I can see that existing packages are replicating fine because i have a test jds server that i can use to select specific packages, which works. The problem is uploading new packages. See the screenshot of the JDS dashboard. The package is visible to the servers but not is happening. Please help!

Anybody else using the "Restrictions" options in a MDM Profile for their Macs? We are trying to but have noticed that it will block access to burning or even mounting an optical disc. There appear to be two settings that are piggy-backed in on the MDM Profile for media support. One disabled burning anything, and the other disables Finder Burning. There is no way we can find to set this in the JSS, so the only options we have are to either build our own version, or to remove the MDM Profile entirely. Anybody else see this or can they test it and see if they get the same results. Thanks, Chris

Working on moving to a new Ubuntu Linux server. Everything was working great, I had my users set up, I could log in, blah blah. Yesterday I tried to restore a more recent backup, it showed it was successful but now I've lost all ability to log into the web interface. When I click on "Log in" it just blinks. I've tried everything I can think of and nothing seems to be working. I even restored the snapshot of the VM to before the Restore and...still nothing. What am I missing here?

Hello. I've done a lot of searching on this, but I haven't found a solution. I feel like this is something that should be easy, but thus far that has not been the case. All I want to do is set user preferences for Google Chrome, so that when a user opens Chrome for the first time, they don't see the first run prompts, and it takes them to our homepage. I also DO want the users to be able to change the homepage/preferences if they want to. I've seen a lot of suggestions, and I've tried several of them, with inconsistent results. So I figured, okay, I'll just use snapshots. But now I'm getting permission issues and I'm not exactly sure how to solve it. I recently took/passed the CCA, but I am still fairly new to this stuff. So, I'm using Composer. I take the before snapshot, install/configure chrome, then take the after snapshot. Once the second snapshot is finished, I tried just leaving permissions alone, build as .dmg, and enable FUT. This results in an error message, somethi

Hi everyone, I want to install the application Poll Everywhere on all machines. I created a smart group that finds the machines that do not have Poll Everywhere installed. I created a Policy that any computer within that group will have Poll Everywhere installed. Unfortunately, it's not installing on the machines. I have set it up exactly like one of my other policies, which works fine. Does any one know why this would happen?

I've got an odd Apple Remote Desktop issue with Casper Admin. When I need to use the Option key trick to point Casper Admin to a different JSS, the Option key thing doesn't work. It just takes me to the last used JSS and I don't get the window to change the JSS. At first I thought no Option key keystrokes are hitting the remote Macs, however I can use the Option key to expand and contract folder hierarchies in the Finder. Opening bookmark folders with the Option key also works in Safari. So I know my local Mac is successfully sending Option key commands to remote Macs. Thoughts?

Hi,We have an older iMac (education model) that does not have built-in bluetooth. OS X10.11.6 It is being used for a specialized purpose and they would like a wireless mouse.Can anyone recommend a third party setup that will work as close as possible to Apple mouse functionality?Trackball w/ 4 direction scrolling, programmable buttons, usb antennaThanks in advanceSandy

Hello. I am trying to create an updated package for MS Office 2016 Pro Plus. The installer that I have is about 6 months old. It works fine.. when I install it on a machine, our users are able to sign in with their network account and everything works fine. However, if I download the updates from MS Office Update History and push those, then when a user logs in, they see a message that says their account is "read only", and they get the option to continue in offline mode. So, I tried making a new package using Composer. I take a snapshot, then install Office and run all updates, then take the second snapshot. I then apply permissions to all enclosed items for each root-level folder. On my package-creation machine.. the update works fine and I can sign into Office no problem. But when I use that package and install it on another machine, I get the same issue as stated above.. account is "read only" and I can continue in offline mode, or quit. Has any of you experienced this be

it seems great

The subject kind of says it all. I'm looking for valid client id tags to use in the preStage enrollment directory payload. $SERIALNUMBER works, but i'd prefer to be able to get username-mbp working and would like to know what the options are. Thanks!

Our old practice was to have the "Use UNC path from Active Directory..." checkbox selected to make the home share path available in the Dock. We would like to deselect that option and instead use a script to provide a dock item to the home share. This is working fine for Macs that stay on the LAN, but a login when OFF the LAN is still providing the home share path error during login, and dock item being added (in addition to the one that we are putting their via script). I've tried deleting the dock.plist then 'killall Dock' and that does remove the dock item that the OS has placed, but a subsequent login will put it back, despite "Use UNC path from Active Directory..." being unchecked. Is there something in addition I need to do in order to turn this off? I am testing on 10.12.4. The only thing that seems to have a permanent change is to delete the local mobile account. Creating the new mobile account at first login will respect the "use UNC

Our go live is later this month, in the meantime, we are having to send a few devices abroad - is it possible to have users visit the URL and perform the enrolment themselves? Or will they have to be connected to one of our networks in order for them to do so, or can we have either setting?

Hello, Just got a question about some users that travel frequently. They would like the ability to remove SSIDs because when they return to a site the WIFI password has changed and since they do not have admin rights, they cannot remove the SSIDs to re-add them with the new credentials. I've done some research but I have not seen anything with a resolution for this issue. All feedback is greatly appreciated. Thank you