Hi everyone! Building out a new JAMF Pro environment - I'm in the testing phase. The new environment will have an application server and a distribution point in the DMZ. Internally we have a JSS running JAMF Pro and SQL on the same server, and the primary distribution point. Right now during testing I'm seeing the following issue - if I create a new policy, internally the clients I'm testing see it right away. However, externally, when they check in with the JSS they don't see the the new policy. Externally I can connect to the JSS without issue, and run a recon, with no errors. If I restart the JSS on the DMZ, it then grabs the "updates" from the internal server, and I can then force the policies to run via command line or self service. This new environment is much different than our existing. I'm moving from running JAMF Pro on XServes that are internal only to new application servers running on Linux (Cent OS) VM's and distribution servers running virtualized Windows Server

Hi I'm trying to reduce the multicast DNS timeout by editing mdns_timeout, but when I do that I get: 2017-03-17 13:42:04.643 defaults[1706:22397] Could not write domain /System/Library/SystemConfiguration/IPMonitor.bundle/Contents/Info.plist; exiting thank you for your help

Hi All, After enrolling one of our laptops now it seems that we need to un-enrol it. the reason for this is the machine will be used off site. is there a way to do this? I know that it will not be able to check for policies, but the checking windows still appears.

Hi folks.I have an imaging configuration profile where I1. Bring down the OS2. Install a small PKG (contains just a background)3. Start a script. The PKG is there so that the adobeinstall account logs on after imaging (by the way, can we not do this without a dummy pkg??).The script basically does a jamf policy -event customevent which will fire off a load of policies for install. I have a machine that was doing nothing. The jamHelper screen was up and nothing happening for a very long time. My script logs showed the event was to be triggered, but the jamf.log show no event being triggered. No activity in particular was happening on the machine. I SSH and kill jamfHelper and.... suddenly the policies are triggered, and the processes lurch into life. All now works well. I don't get this behavior on some other machines that I image.Any ideas as to why jamfHelper is... well, essentially blocking the progress here? Thanks

Hello, In the FV2 admin guide, it mentions that you can go to Local Accounts and create a new account with the Filevault check box. If I want to enable a local account that already exists, will following that same process just enable the account? Or does it have to actually create one?

I have a little over 300 laptops that I would like to shut down every evening between this time and that time. I am able to make adjustments for this in configuration profile. However, a pop up window comes up warning the user that the laptop is going to shut down in x amount of time, and allows the user to cancel the operation. I do not want them to be allowed this option. I also have noticed if it shuts down as noted, the user can boot it back up and continue to use it. Any solution to this problem? Any help would be appreciated.

Hi everyone, Starting thread in case others have come across this. I wanted to just report a strange issue I came across, which began around Feb 21st 2017. Installation of Creative Cloud 2017 began to start failing during imaging, deployment or manual installation as of the above date. Error code 112 in the logs. The installer itself hasn't changed and the imaging process also hasn't changed. I couldn't pinpoint what the cause was so I recreated the installer packages using the Creative Cloud Packager this morning. Since doing so, the installer still fails. I'm creating a test system with a base empty install image of sierra to test this out. I found the whole ordeal very strange. I considered licensing issues. I considered data corruption. I'm not convinced of either right now.

Ok this one may be pretty silly. We are working on setting up our Casper Server and have begun building / testing images to deploy over summer. I have an image built that is having issues when logging in with an AD user. The local admin account logins fine. Then when logging in with a network account it constantly displays the "Setting up your Mac" screen then throws a Keychain error "A keychain cannot be found to store 'xxx'." Any ideas on where I should begin looking? Thank you!

Jamf Nation, Does anyone know if it is possible to have a message display during the pre-boot splash screen on a Mac with FV2? This would be during the "Apple" loading screen at first boot. OR Would it be possible to display a message during the disk unlock loading screen after you enter reds in FV2? I am familiar with the "Security and Privacy" solution that displays during a login. I am also familiar with "Sudo" command that can be executed like so... sudo defaults write /Library/Preferences/com.apple.loginwindow LoginwindowText “Your Text Here”. It looks like from the research I can find, the above questions cannot be resolved because the data we can write is on the disk, which is not loaded during a pre-boot and disk unlock process. I am just looking for confirmation if that is correct or if there is some other way. Thank you

On 8 out of 500 machines, I'm receiving errors when trying to reset password's through the JSS. The password has a symbol, number, and lowercase. I'm trying to understand why 8 machines are receiving these errors while others are succeeding. Worst case scenario, does anyone know of another way to reset passwords through terminal? I can SSH into their machines and reset it that way. Executing Policy Reset macadmin passwordFailed global policy "ProfilePayload:6XXXXDE-6734-479B-AXX4-05EXXX1C6E:requireAlphanumeric"Error resetting the password for user macadmin and Executing Policy Reset macadmin passwordPassword change failed because password does not meet minimum quality requirements.Error resetting the password for user macadmin

I'm in the process of install a fresh new JSS Server, and have ran into a snag. I have installed the following leaving all defaults for settings.Mac OS X 10.11.6Java 1.8MySQL 5.6.xApache Tomcat 8.5Java JCE Now running the JSS Install (9.97.148xx)it stops at the Server name, Server port screen and says (Error: Please verify server, port, username, and password. Server Name: localhostServer Port: 3306DB Name: jamfsoftwareUsername: jamfsoftwarePassword: jamfsw03 I can't seem to find any answers on how to see if this info is correct on my machine.

Hello all. Has anyone had experience in setting up a JSS with a partial hostname, (server.name) with DHCP providing the search domain, so that a client acquiring a DHCP address has company.com in its search domain and requests for server.name correctly complete to server.name.company.com? I find that 10.11.5 respects this configuration for everything except DEP. I have more testing to do, but it seems like the ManagedClient process on a newly set up mac refuses to trust an MDM server with a partial hostname, even though the OS should be 'completing' the hostname with the search domain set by DHCP. Debug log from the ManagedClient process below; Device Enrollment server connection returning error = 500 (The MDM server for your organization returned an unexpected status (500).) Jun 28 18:39:39[268:0]:+MIG_CloudConfiguration mcxUsr_cloudconfiguration returned error: 500 (The MDM server for your organization returned an unexpected status (500).) domain = CPProfileManager Relatedly, I

Hi - (Forgive me ahead of time if I get the terminology wrong... thanks) I currently have a Mac App Store App Deployed in our environment (OneDrive) under our VPP license as a Self Service install. Today I had a user running 10.10.5 try and open the Self Service app and download OneDrive. When she went to click "Install", it opened the App Store app, and then presented her with the "Get" option within the App Store. Clicking on that prompted her to sign in to her personal App Store account instead of using our VPP license. I do see the checkbox for "Assign VPP Content to computers with OS X v10.11 or later", does that simply mean the user needs to upgrade their OS to 10.11 to use our VPP? Otherwise (if that's not the case), shouldn't the install use the VPP license since it's in Self Service instead of a personal App Store license? Thanks in advance!

Hello All, What has been your procedure for upgrading all your machines to the new version of ARD (3.9)? I have tried utilizing the following, but am continuously told that there is no update available. softwareupdate -d RemoteDesktopClient-3.9.0 Do our machines need to be logged into a valid AppleID to communicate properly with the App Store? That may be our biggest issue with teachers is that they simply don't want to link their personal ID to their work machine—expecting that to change when we rollout Apple Enterprise! But for the time being, this is not an option we can change. I suppose my next step will be the deployment of Sierra 10.12.2. I see there are compatibility issues with Macs that are on anything less than 10.11.6—all the machines having issues are either on 10.11.5 or 10.11.6 with failure on both. Should I just push out the .pkg that can be snagged from Apple?

I'm trying to change the wallpaper via the Configuration Profile. I set the Level to Computer Level, and the Restriction Payload is configured so that the Functionality tab has the "Desktop picture path" set to "/Library/Desktop Pictures/beach.jpg". Although the Configuration Profile runs, the wallpaper is not applied (tried logging off, restarting etc). However, if I place the wallpaper somewhere else (ie. if the wallpaper is set to /Users/Shared/beach.jpg), it applies the wallpaper as expected immediately the profile is executed. Any ideas? CheersPaul

I'm trying to determine if it's possible to downgrade the ARD client from version 3.8.4 to 3.8.2. I've not had any luck finding a way to do it thus far. I suspect that version 3.8.4 is causing a performance issue and I'd like to downgrade a few systems to 3.8.2 to help test that theory.

What permissions are required for running MUT to make updates to username, full name and email? I would prefer not to run as full admin account. I think I have just about everything else dialed in except for permissions to run MUT. I can do updates manually via jss, and I can run as full admin and MUT works, but I don't want extra access if possible. Dan

Apple just released 10.10.4 update and I'm looking for the best method to deploy this via self service. I've tried pulling the pkg from the dmg and dropping it into Casper admin, but when I deployed it to my test system it didn't installed nor did it reboot my machine. Then I tried dragging the dmg into Casper admin but despite looking like it installed , after I rebooted it still showed 10.10.3. I do not have an ASUS server and the App Store is literally blocked. My only method of getting the update to the users is a flash drive and going around to users macs and updating there machines. I would greatly appreciate your inputs as to how y'all get around this. Any solution will be appreciated.

just got a MacBook Pro 13" with Touch Bar, imaged it to 10.12.3, logged in, encrypted with FV2, and attempted to setup Touch ID. I get the error: "Fingerprint limit reached. To add a new fingerprint, remove a fingerprint from any account on this Mac." This is a brand new user on a freshly imaged machine.. Anyone else seeing this? Only thing I've seen pertaining to this hints it might be related to FV2: https://discussions.apple.com/thread/7761102?start=0&tstart=0

Maybe I am imagining it but I am sure I saw posted a new set of command line tools for adding and removing users with the same options you get through the GUI i.e. keep home folder etc...Can't find it anywhere and my google is clearly failing today...

I am looking for a way (extension Attribute) to determine the version of Junos Pulse.app that is installed on client machines. The app has a .ini flie in the apps contents/resources folder that I'm looking to query clients to identify installed versions. Does anyone have an extension attribute that I can use to find if the specific version used of the Junos Pulse app?

After purchasing Jamf Pro 12 months ago (when it went by a different name), and going through the Jumpstart, we didn't really touch our JSS or enroll any users. (For complicated business reasons, we just didn't have time.) Now, a year later, I'm coming back to my JSS and we're starting to get things set up and enroll new users. I'm noticing that I managed to originally set it up to create a new user account on each machine, so in addition to whatever user accounts are already there, it creates a new "companyadmin" user with admin bits. I've looked through all of the settings in the JSS, all the policies and profiles and everything else, and I cannot find where this setting lives anywhere. This user is created when someone goes to the enroll URL, downloads the QuickAdd.pkg and runs it. Any ideas? Thanks.

Does anyone know if the latest dot release of 9.97 includes a higher version of Tomcat other than originally deployed with 9.97 (Tomcat version 8.0.39)?

Hi all. I've been working on a script that is used in self service which allows users to enter a tag number for a printer and then the printer is mapped. The script pulls from a CSV file. We have been able to make this work for all non-MFD machines and MFD machines separately. Unfortunately I cannot manage to get a combined script that will do both.The reason this is occurring is that no matter what it always goes to the very last conditional statement, in most cases the else, even if the statement is true. In these screen shots, you can see the script and what happens when I run (I excluded the prompt asking for the user input tag, but included showing the tag entered and showing that Canon is the manufacturer. I never receive the pop up, as I should since the if [ "$Manu" = "Canon" ] statement is true. I've tried many different combinations of syntax for this if/nested if/loop statement, and all results have it ignoring and going right to the final conditional. Any help would be gre

At a loss here. I need to redirect AD users network homes to a different path than the one in their AD profile for a client using Casper. This is easy with Centrify but can't work out a scriptable method. It's easy enough to mount wherever with a LaunchAgent script and if all I needed to do was mount that as a desktop alias that would be fine. But can't work out how to set the users actual home dir to it. I could symlink I suppose but if I recall correctly this freaks out a lot of software. Is anyone doing this and if so how?