Hi y'all! Hoping someone has run into a similar issue and has some relevant thoughts. My setup is clustered JSSs: JSS 1) used by admins for, well, admin work. JSS 2) Limited Access JSS that computers report in to. The LA JSS is open to the internet and so is behind an Apache proxy (running on the same machine). The proxy handles all the TLS. Machines report in just fine, we are able to add and manage machines, etc. The problem I'm running into: the JSS is reporting the IP address of each machine as the IP address of the LA JSS. I realize this is because the connection is coming from the proxy running on the LA JSS, and was hoping that enabling access logging in tomcat would start to report correct IPs, but no luck there. Relevant (I think) line from server.xml: <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" requestAttributesEnabled="true" prefix="localhost_access_log." suffix=".txt" pattern="%h %l %u %t "%r&quot ; %s %b" resolveHos

Hi, Anyone have better idea regarding the following? We are wanting to restrict the access of Macbook's USB ports, so no users can steal company data. We are wanting the USB ports to be read only, so users can still copy some things, but not write out to USB port. When looking into Casper configuration Profiles, the external Disks is either "Allow" or not. I have try this setting, and indeed the Macbook that I tested can no longer see any USB drive detected. So, is there anyway to have a read-only option for USB ports?

Scraping from some scripts here on Jamf Nation I have a small script attached to a policy that executes at login and sets the dock using dockutil. I want it to execute at login so it adds the user's Documents folder to the dock: echo "Adding Documents..."; /usr/local/bin/dockutil --add '~/Documents' --no-restart --position 11 "$LoggedInUserHome" This works perfectly in testing with the policy but I'd love to have this run at login only after a computer is newly imaged. I can't add it to my first boot script because it won't set the Documents folder, not knowing what $LoggedInUserHome is. Wonder if anyone has any thought on how to accomplish? I'm almost ready to just have our Team run this from Self Service, post login and post imaging, but reaching out to Jamf Nation first!

Before I ask the question, this is not an angry post! Just curious why... I have had a couple of open cases with Jamf Support, the latest being a rather important one and ongoing for about a month back and forth now, but then end up randomly being closed. I don't receive any notification of the support case being closed, I just "happen" to come across it. Has anyone else experienced this, or know the reason why behind it?

Hi all, I had no issues with dockutil under 10.11 but using the same script with dockutil on 10.12 machines will not work for some reason. Has anyone been successful in using dockutil with Sierra? I tried updating to the latest dockutil but no dice. I can share my dock script if needed. Thanks!

Is there a command or something that can be ran to report if a computer had a kernel panic. Much like we can report on if a computer's hard drive is almost full? I would like to create a smart group that would notify me if a user experiences a kernel panic.

Hi Guys, I'd like our clients default mail reader to be Outlook 2011.. i tried the com.apple.internet mcx plist but this doesn't seem to work? Any way of doing this via MCX on 10.7 clients or do i need to script the launch services plist?

Hello, I have a REPOSADO SUS and for some reason I don't get any update from Mac OS Sierra 10.12.x http://172.32.129.201:8088/content/catalogs/others/index-10.11-10.10-10.9-mountainlion-lion-snowleopard-leopard.merged-1_Production.sucatalog Can you please help me how to re-configure the reposado server? Do i have to redo the entire setup? I can't seem to find any settings. Thanks so much.

So I'm starting to work with Apple Classroom as a potential replacement for Casper Focus in our district. We currently have class sets of iPads and they aren't assigned to individual students. Right now we create static mobile device groups with the teacher's name and assign each set of iPads to a group. I have classroom working to a point - it can open on the teacher device and see the available classes, but none of the iPads in the device group assigned to the teacher show up. I checked here and apparently people were hoping that Classroom would support device groups by now. Has anyone gotten it working?

I want to be able to identify machines where filevault is enabled but the fileVault key isn't escrowed in the JSS. Does anyone know a way to report this? I don't need the key just need to know if its present or not. Thanks

Hi everyone, Our school wants to use 100-150 laptops for exams. In the past we've disabled and hidden Spotlight/notification center from the menu bar via script, but because of SIP we get errors until we disable it. Is there a way to completely disable this without having to boot to a recovery drive for each computer? Thanks!

Recently Chrome has stopped auto updating its built in Flash player and end users are getting a flash error when using Chrome with certain sites. Chrome itself updates fine, however, and is current on all machines I've checked having the flash issue. I pushed the PPAPI flash update to a couple of machines I'm testing on and haven't seen any issues as of yet. I also regularly update the NPAPI flash plugin for Firefox and Safari. Just wondering if anyone has run both of these plugins, or just the pepper plugin and had any issues? Thanks in advance.

Hi Guys, Anyone out there using jamJAR yet? I am trying to get it working but running into a annoying little issue... I keep getting an error that says LocalOnlyManifest not declared, however, I have checked the locations of Managed Installs folder and ManagedInstalls.plist and they are definitely present, if I run the munki command managedsoftwareupdate --installonly it works but the script from the JSS just says the above error. The naming convention of everything seems to match whats in the script. Might be the wrong place to be asking this but I figured since its trying to be run from a JSS...

So I am using the Reissuing FileVault keys with the Casper Suite. Followed this to the T (except the DMG for the ICONS). I am getting the follwoing error: Executing Policy Reissue invalid or missing FileVault recovery key Downloading AppleCustomScriptIcon.pkg... Downloading Verifying package integrity... Installing AppleCustomScriptIcon.pkg... Successfully installed AppleCustomScriptIcon.pkg. Running script reissue filevault recovery key... Script exit code: 0 Script result: Alerting user USER about incoming password prompt... Prompting USER for their Mac password... Successfully prompted for Mac password. Issuing new recovery key... **[WARNING] FileVault key was generated, but escrow did not occur. Adding personal recovery key.** Submitting log to https://comapny.jamfcloud.com/ Any ideas why the escrow doesn't occur? And not getting the key uploaded to my JSS?

I seem to be stuck on a part of the setup trying to connect our Active Directory server to JAMF. It keeps telling me that it can't find the account. I have all the right info for the domain. I have tried several known good accounts, but I still get "Could not find user". Any leads or ideas to point me in the right direction would be great. Thanks!

Need some help figuring out deployment of Mac App Store apps that I obtained a VPP license for. Scratching my head as the apps won't deploy and in the computers I scoped to, there are no "pending commands". Hoping this is really easy! In the JSS, I select Mac Store Apps and then add Pages. Distro method is set for "Install Automatically..", I have it scoped to 1 computer as a test and have the VP option checked off in the VPP tab. Sit and wait, check in time passes and nada, no app installed. WTH am I overlooking? Thanks, Tom From the Guide:"Distribute a Mac App Store AppWhen you distribute a Mac App Store app, you configure settings for the app and specify the users and computers that should receive it (called “scope”).1. Log in to the JSS with a web browser.2. Click Computers at the top of the page.3. Click Mac App Store Apps.On a smartphone or iPod touch, this option is in the pop-up menu.4. ClickNew .5. Enter the name of the app, choose an App Store country, and click Next.6.

Not enough room in the subject line to accurately outline everything. I don't even know where to start honestly so I'm just going to jump in here. This is regarding the full macOS 10.12.4 installer, not the updater We are not using imaging, this is for doing a standard "cache then install cached" in-place OS upgrade Hosted JSS w/corresponding Jamf hosted DP w/5GB limit. Unable to upload Apple's Install macOS Sierra installer via Casper Admin because it errors out every time With JSS v.9.98, able to upload larger packages to hosted JSS via Management Settings > Computer Management > Packages Using that method does not allow me to upload Apple's installer, as it shows up as ".app.zip" and the JSS does not recognize it as a valid format So far only successful upload has been when I went into Apple's installer package, removed InstallESD.dmg and uploaded that to the hosted JSS through the Packages upload in the JSS Once the InstallESD dmg had uploaded successfully and it had a va

We recently started rolling out JAMF at my company, as a replacement for MaaS360 and Munki. Currently, we're in the first phase, which is rolling out JAMF for MDM and maintaining Munki for package management while we finish setting up self-service and ironing out some of the problems we're having. Currently several of the computers that are enrolled in JAMF are shutting down after half-hour idle time. I haven't been able to establish a pattern yet, and to the best of my knowledge, it's not affecting every computer. I can fix it on the computers that are experiencing it by using the following commands sudo defaults write /Library/Preferences/.GlobalPreferences com.apple.autologout.AutoLogOutDelay -int 0 sudo defaults delete /Library/Preferences/.GlobalPreferences.plist com.apple.autologout.AutoLogOutDelay but I was wondering if there's somewhere I should look that I'm not to make sure JAMF isn't setting a flag somewhere, or if there's a known conflict with JAMF and Munki where I sho

I have a FileVault Disk Encryption Configuration with an institutional recovery key set to expire in June. Does anyone know if this needs to renewed? How does it effect the encrypted Mac?

Hi, At our organisation we are deploying device profiles to OS X devices to grant acces to our employee network. In the device profile are 2 domain controller certificates included of our primary and secundary domain controller. The issue is, one of or sysadmins upgraded the secundairy DC from win 2012 to 2016 so by that he has issued a new domain controller certificate. When we deploy that to machines it will only work when we delete the old device profile, in the past when the certificates getting expired we deployed a .pkg that deploys the same device profile with new certificates with the same DC name. Now when we deploy the new .pkg with the .mobileconfig files with new info it wont overwire but create a new device profile and only works when we manually remove the old device profile. is there any command we can add to our install/deploy script that it first removes that specific old device (wifi) profile? Quick help woud be appreciated! Greetings!!

My buddy has a wound we are taking care of, and I had this JNUC shirt that was too small for me. He's lookin' sharp!

I have a launch daemon and a script created to run after an OS upgrade. Results are that the daemon runs, and the script but only part of the script is executing. Below is a part of the script, the Turn SSH on piece works as I can verify that in the System preferences, when the script completes it removes the daemon and self destructs, but for some reason jamf policy isn't checking for and running the policies and ASU isn't running. I have the daemon and script in in place to set some preferences, run jamf policy and run ASU on first boot after an OS upgrade we have in Self Service. Any advice? #!/bin/bash # Turn SSH on /usr/sbin/systemsetup -setremotelogin on #Check for jamf policies jamf policy #Run Apple Software Update softwareupdate -i -a # Remove setup LaunchDaemon item /bin/rm -rf /Library/LaunchDaemons/org.name.post_os_upgrade.plist # Make script self-destruct /bin/rm -rf $0

Hello Casper admins! I'm relatively new to both the Mac world and JSS computer management. We are primarily a windows shop but as of this summer we will be offering Macs to users (due to popular demand). I have been tasked with coming up with a workflow to add our printer fleet to JSS and map them to their respective users, perhaps using self service (hopefully using Active directory OUs) I have no idea how to do any of this AD integration is even possible with JSS. Also I don't know if its possible for the endpoints to print to the print server rather than printing directly to the printer. My hope is to get some insight on some of what you guys are doing out there in the wild, perhaps get some information on how you did it. Also what the requirements are in terms of getting this up and running? Thanks in advance, Sincerely a Noob Mac admin

I have heard that there is a way to prevent users from running the "sudo /usr/local/bin/jamf removeFramework" command on their computers. Basically a way to disable that command. Could someone point me in the right direction on how to accomplish it? Thank you!

Hi Folks, I am testing bare metal imaging with Casper on the new MacBook Pro using NetBoot via the Belkin USB-C to Ethernet Adapter that is sold by Apple. Imaging works fine, but sometimes during the Setup Assistant, the presence of Ethernet isn't recognized. I was wondering if I need to run a script at postinstall time to ensure the Belkin adapter is discovered and enabled. Any thoughts? I'm testing a basic Sierra image with nothing on it but Microsoft Office 2016. There is a hidden admin account and we are forcing setup of a new account on that third boot. However, Office doesn't get activated and I am wondering if it is because the network connection is down after imaging until that first user account is created and logged in. Imaging log: Initializing Imaging Process... Mounting smb://*******/casper... Preparing disk for block copy... Performing Block Copy of osx_updated_170330-10.12.4-16E195.hfs.dmg... Cleaning up after block copy... Setting computer name to "MBProTouchBar15"..