Hi, We have a policy set up to automatically upgrade to the latest version of the Java Developer Toolkit.We get the new package from AutoPkg and then run it through a scoped policy.The policy should exclude all members of a Smart Group that contains computers running JDK 111 or 112. One machine however keeps getting the package installed through the policy on the recurring check-in trigger (every 15 minutes). For some reason it never moves to the Smart Group so the policy keeps installing the application, despite the policy also running a forced recon afterwards to update the inventory. Have you ever experienced something similar?

I am deploying MS OFFICE 15.16 to all our machines and serializing it. Works great. When a user opens an application like Word for the first time it prompts them with a setup that says "skip sign in" and then "start using word" or something like that. Does anyone have a way to skip this prompt and just load the program? Thanks in advance for any help.

Running OSX 10.9.4 & Server 3.1.2 on a Mac Mini. Went through the tutorial about where to download Java and MySQL from the JAMF pdf file. Followed everything and when I click on the preference pane to start the MySQL server, I verify my password, little beach ball spins for a minute and nothing happens. I replicated the process on a macbook air and the MySQL server started up fine following the same PDF, same versions of Mavericks and Server. What am I missing? Please use small words as I am REALLY new at this stuff.

Under Management > Polices one can create a policy that create a new admin account. How can this account then become hidden in OS X, Sys Prefs > Users & Groups, as to prevent users from seeing / and or deleting the account. Thanks in advance. John

I am trying to add a restricted user account that has read only privileges. I would like this person to be able to search for computers in the JSS only, so they can see when a computer was logged into, where it was logged into, and by whom. I created an test account that had JSS read privileges, but it said I had to add some dashboard items, this is not what I want, they need to be able to search for these devices.Is there a way to create this account to do this search?

Hi, anyone having experience with the following situation and might have a good solution for this: I have iPads set up as a shared device, and also a bunch of managed Apple IDs. All the devices uses our Wifi at work. Recently I had a teacher bringing along a couple of devices outside the range of our wifi network. They had another wifi in range nearby but never connected to it before, is there a way to connect to a new wifi network on shared devices before logging into the devices? I did some testing:On iPad 1 I logged on to before leaving my corporate wifi and logged out before leaving.On iPad 2 I had the same account locally but it was surely 2 month ago that I used that account on the iPad. But I did not log in when at work.Then I brought the 2 iPads with me outside the range of my wifi. I had no other wifi in range.On iPad 1 I could log on with the account locally. On iPad 2 it says to me that I need to connect to internet before I log on.On iPad 1 when logged in I can connect to

Hi jamf Nation. I'm pretty new to jamf and this discussion board is so helpful, thank you so much.I now have a Problem where I couldn't find a hint here so try to start a new discussion about it. We are using JSS 9.96, and macOS Sierra 10.12.0 We want to encrypt the Harddrives of all Macs via File Vault2.I have set up personal + institutional key on jamf and put the start encrypt policy into self server so the user (or at the moment test user) has the chance to decide when he wants to start. We want to use the logged in user (an AD account) so the user has just to enter his password once and the computer will boot up into is Desktop.But it will happen that a user forgets his own password (happens really often in the Windows world, so it will be the same in the apple world).It is no problem to take a look at the recovery key on JSS, and it will unlock the drive without any problems, BUT:The user is forced to change his password after the boot (no Desktop, only login window) but this

I have been trying to build a new Casper Imaging configuration for the just-released version of Sierra with Casper Admin 9.96, but keep getting errors on the compile. It appears that the blank disk image that it creates is either not a valid target of possibly not large enough to take the Sierra installation. I get the attached error message... The disk image it creates is a 11.63 GB sparse disk image (compressed format), owned by system:admin (system: Read & Write, admin: Read only permissions). Any ideas? Anyone else experiencing problems creating a compiled configuration?

Hello, I recently inherited an older JSS at version 8.63. We are looking to upgrade to the latest version. I've never made this big of a jump before. Are there considerations or reservations you could advise on for this jump? Any gotchas? Tips or best practices? What would you do or have already done? Contacted TAM already. Open to any and all tips. Here are some tasks I have in mind and a little bit about the environment: • Test environment • Delete old policies and profiles/MCX entries• Delete old packages• Back up database • Upgrade to JSS 8.73 • Upgrade to JSS 9.96 Environment: • JSS currently on Xserve with 10.7.5 server• 200 Macs enrolled, bound to AD • Macs range from 10.6 to 10.12 Thanks for any tips...

Hi Is there a way of exporting/finding out (without clicking them one by one) which app has been assigned to which group etc. I want to keep a record to show certain members of staff.

Greetings, all! I have a pretty (what I believe to be) nifty script which checks to see if specified processes or applications are running before executing a policy. My first really application for this is to be used for Office 2016 updates. I would pass the five Office applications (Excel, OneNote, Outlook, PowerPoint and Word) as the processNameX variables where X is an incremental integer beginning at 1. I also pass the jamfPolicyType and eventorIDName variables in the policy itself with "-id" and "841" respectively. The 841 integer represents the policy that I have created which simply installs the package when it is called on. I have a similar script but it only has 1 processName variable/parameter and it works flawlessly both locally and when used in the JSS. I made a few modifications, all of which were pretty simple, to accommodate for the added parameters being passed. This script runs beautifully when I run it locally and in the JSS when I pass the variables in the script it

I configured Casper to enable users photos with Custom Image URLs.Everything is ok, I see the pictures in Casper, in Apple Classroom but not on the shared iPads. Is there anyone with a solution ? :)

I know this is a long shot but am trying to resolve the problem of users remoting in from their own machines at home to their work machines in a shared office. With the Screen Sharing application being useful and working fully the only major downside is that it leaves their monitor and account open to view by anyone in the near vicinity of their work office machine. Is there a way of turning on a curtain facility or do users have to go out and buy an application to be able to do this???

Hey guys. I am trying to figure out a way to allow the users to assign the current device to them. The idea is we would hand the devices to a large amount of people. Have them log into Self Service with their Active Directory accounts, and then click a button to then assign that device to them using those credentials that logged into Self Service. Anyone have a idea how to get this done?

OK, so I commented on an old thread but do not want to take that thread up anymore.So this user created a command to disable pop-up blocker in Safari. However, it is not working for me, so I decided to test an older version which is..."defaults write com.apple.Safari com.apple.Safari.ContentPageGroupIdentifier.WebKit2JavaScriptCanOpenWindowsAutomatically 1"1 meaning disabled, 0 meaning enabled. This works great. However, I can't get it to work in JSS as a script running through a policy. I need to know how to apply this to a user-based level. I know JSS uses $3 to indicate the currently logged in user, but i'm unsure how to indicate this in the script so the command will apply to the currently logged in user and not globally. Any ideas? Side note: it would really be better if I could have the script to write only if the file in plist is set to 0, but if at 1 make no change.

Hello all, We are pushing a large package for the first time after our JAMF deployment. We want to cache/install cache to reduce user downtime during installation. We will use two separate policies: one to cache the package, the next to install cache via self service. Will I need to check FUT/FEU under both policies, or just the install cache policy? Does it make any difference? Thank you

Hello everyone, I am trying to implement an extension attribute to pull the version of SafeGuard. Below is my script: The extension attribute will populate the correct information if I'm physically on the machine running "sudo jamf recon". I enrolled a new machine and it did not pull this extension attribute until I ran "sudo jamf recon" Also worth mentioning, we do not have SSH open, so Casper Remote's inventory functionality isn't feasible in our environment. #!/bin/bash #determines whether or not SGN is installed on the machine if [[ -e /usr/bin/sgdeadmin ]] || [[ -e /usr/local/bin/sgdeadmin ]]; then echo "<result>`sgdeadmin --version | grep Version | awk '{print $NF}'`</result>" else echo "<result>SafeGuard Not Installed</result>" fi

Hi all, We are testing to enable FileVault (2) on our machines. I have followed a white paper to setup the Casper Suite to enable FileVault via Casper/Self Service and I have noticed that not all machine are FileVault Eligible . I have no clue why this is. All systems are 10.11.x + We have around 645 Machines and 92 are not FileVault Eligible.. Any insights are appreciated!

Since imaging with 10.9.5 and binding via the Apple Built-in AD Bind, when i login in as a new user, I get the following message: "A Keychain cannot be found to store "username"". Has anyone else seen this?

I have not been able to find a way to send the 'Allow Activation Lock' command to supervised devices. Supervised devices are reporting the bypass code with inventory, but Activation Lock is not enabled if these devices are restored using Recovery Mode. Here are the relevant commands from Profile Manager: external image link external image link

Cloned a working profile, to set up a "Teen" profile with different restrictions. Now, though, whenever I attempt to add ANY app, including Self-Service, it's asking for iTunes login info. VPP is set up properly. I tore out all apps EXCEPT for self-service, and it's still asking for an itunes login. What am I missing?

Hopefully someone can help me. I am very new at this. After upgrading to JSS 9.96 I can no longer install software from the Self Service App. Right when it gets to downloading it fails, from the logs it appears it cannot find CasperShare. So I recreated CasperShare in File Sharing in OS X Server, if I open Casper Admin the CasperShare now mounts (which did not before). But still Self Service fails at download. I kinda fell into supporting this, since taking over I have only updated JSS Here is what my JAMF Server is...OS X 10.10.5OS X Server 5.0.15JSS and Casper 9.96No JDSTomcat 8.0.36

Is there any way to stage a large package rollout for example to 5 computers at a time in a smart group? Example: Each of our labs have approx 30 computers. When we try and rollout a large package to a lab it ends up not having time to finish after running all night because every single computer in the smart group tries to grab the large package all at the same time. Can we specify to only allow 5 computers in the smart group to download the package at a time and have the other computers in the group wait until a spot opens up?

Anyone know of a way to complete this, i have machines with vpn profiles that are not all nam,ed the same. I want to standardize the adapter via a configuration profile , is there a way to script the removal of a profile with the name VPN in the service title?

So to make things short, we have been through the ringer with Jamf Support, Questar support, and using our own knowledge and hours trying to figure this out. Issue: Questar testing for students on iPad requires Autonomous Single App Mode OR guided access restrictions to be enabled. Guided access requires us to touch thousands of devices AND a passcode to be enabled, which is not ideal at all for us. So we have tried Single App mode. We enabled Single App mode with that particular app in our configuration profile. It's to my understanding that if we use Casper Focus, using the focus to pull up a single app is using single app mode, right? Because the user can't exit the app or do anything until it is removed focus from Casper.If that is TRUE, then something is not working right. We focus the device to the Questar app, HOWEVER, we still get guided access errors. According to another discussion I read, SAM uses the same SDK as guided access...so why are we getting these errors? According