We are currently on JSS v9.61 and use the Restricted Software function. Most of our machines are Mavs/Yosemite. We typically restrict using both with and without the .app on the end. Do you know if there will be a space between "El Capitan"? Install OS X El CapitanInstall OS X El Capitan.app Is there something more specific that you can provide to block the El Capitan update? Thanks!

Time has come to reach out to the community of experts. I'm trying to push out Egnyte Desktop Sync to all my client computers. The vendor package is a DMG that contains an Installer.app file. Just after some ideas on how to manage and deploy a DMG like this? Thanks in advance

I accidentally sent a managed preference to set scroll to not natural, to a bunch of machines that were not supposed to have it. I have removed them from the scope and restarted the machines with no luck. I have also tried flushPolicyHistory, flushCaches and sudo jamf mcx to no avail. It is still greyed out and unchangeable Any help here would be much appreciated

I need to give my end users the ability to enroll their own devices, or at least let me assign their AD username to a device that I'm enrolling. To facilitate this, I have added in my office security group to the JSS User Groups with their privileges set to "Enrollment" I'm an admin, so I'm both a member of the IT security group, AND the office security group. The admin group is assigned Administrator level privileges. Today I log into the JSS and my personal account (the one in the admins group) has no administrative access at all. It appears that adding in the office security group has overwritten the admin security group, leaving me with no admin access on my account. This is yet another AD issue that I'm having with 9.93. Can anyone tell me if I should be approaching this differently, without having to add in hundreds of users individually?

Hello, I am trying to use a script to change my DNS settings for the Thunderbolt Ethernet. I am using this script #!/bin/sh networksetup -setdnsservers Thunderbolt Ethernet DNS.Address.here When I run it though I am getting an error saying that Thunderbolt is not a recognized network service. I used the same script for Wi-Fi and it worked without any issues. Is there other wording I need to use instead of Thunderbolt? Thanks

We enable a user home drive to auto mount in AD when a user signs in. I was told we need to keep this enabled but as soon as the computer goes offsite it takes a few minutes to show the error message that it cannot find the network drive. I would like to fix this if possible by disabling the auto mount within the OS but still keep it enabled at the AD level. Is that possible?

Directory Utility question...how to make a domain a default domain? I'm trying to make a specific domain the default or make it the preferred domain (first in the order) thank you for your help.

Does anyone know if there is an easy way of differentiating between an application installed from the App Store and a native/built-in application? Does the OS drop a receipt or a special attribute of some sort that would make this logic fairly easy?

Hi All, We are running Casper Suite 9.81 in our environment. In 9.81, we can see "Software Updates" in Inventory details of the computer but it is missing in JSS 9.93. Is the Software Updates moved somewhere else? Also I observed in 9.93, "Number of Available Updates" shows as 0 even if there are Apple Software Updates need to be updated. The same computer shows 3 updates available in 9.81. Can someone help me identify the issue or this is same in 9.93? Thanks & Regards,Karthikeyan

We have the Terminal app, as well as others, blocked via 'Restricted Software' for our students. This works fine; however, this is causing some headache for my technical staff to perform troubleshooting steps. The scoping of these restrictions only allows to focus on computers instead of also allowing users, so right now, we have setup a static group that is excluded. If we need to access terminal on a Mac, then we have to put that Mac in the static group, wait for that to propagate, then we have access (assuming we have 100% working communication between the Mac and the JSS, which is not always the case for whatever reason). Does anyone have a better workflow for this scenario? Thanks.

Hi I want to recursively remove all printers of a certain model number with a script, what I have so far is the below but while testing the script seems to exit with 0. #!/bin/bash function rmPrinters { thisPrinter="" thisPrinter=`lpstat -p | grep X7855 | head -1 | cut -d " " -f 2` if [ -z "$thisPrinter" ]; then exit 0 else lpadmin -x $thisPrinter rmPrinters{} fi } Can anyone help figure out why this is not working?

Hi all, I'm after some documentations or instructions of Casper JSS (server) upgrade. Specifically from JSS 9.81 to 9.93. We are running our Casper on a WIndows 2008 server. Thanks in advance.

Some of our older machines take a bit longer to login and some users think that they need to pull the power cord (it makes me cringe) and restart them. I would like to have a script (or something else) that would show them the status of the login (applying profiles, applying. . ., logging in) at the corner of the screen. Does anybody know of something that can do this? Maybe a login script? I have added lock screen messages but, nobody really reads them! Thanks,Jared

This new proxy is going to be the death of me. I was able to finally convince our InfoSec folks that it was absolutely imperative to open up access to Apple's 17.x.x.x network through our proxy. Good. MDM and push notification work again. However I discovered a new wrinkle. Imaging a computer involves booting up via NetBoot and running Casper Imaging, applying the DMG that contains the OS, and a few DMGs with some small apps, set the computer name, and reboot. Normally upon that very first reboot, the computer talks to the JSS and relies on MDM and Push Notification to initiate the enrollment process and start pulling down all the policies and config profiles it needs. BUT with the proxy in place that can't happen because I can't figure out how to apply the proxy settings BEFORE this first reboot. I've been told that the only way to allow any computer to talk to the outside world without going through the proxy would be to poke permanent holes in the firewall and &

Does anyone know anything about this new feature that was announced with the release of OS X Server.app 5.0.3? iOS 9 users can easily access and store documents on OS X Server. Once a share point is created, it can be shared to iOS devices and made available using traditional file sharing protocols such as SMB and AFP. This allows users to open, edit and save documents from both iOS 9 and OS X 10.11. I wonder if this will be possible with the JSS and arbitrary SMB shares not hosted on OS X Server.

There is a document my IT director needs pushed to all computers. I was thinking about putting the link in Safari and either adding the document or shortcut to the dock or desktop. I am not quite sure how to accomplish this, I only have experience creating app packages and deploying them. Is this done under a configuration profile or policy?

I hate being such a script noob. I feel like I'm really close but am missing some critical piece of information in order to get this script to work. This script is intended to get the name of the current user and then make that user an admin, or make them a standard user, depending on whether I have the -d or -a in there. I can get the first line to return the user name on its own, and I can get the second line to set or remove the user as an admin as long as I put the name in rather than using a variable, so I know I'm close. I just can't get the two lines to work together, i.e. to get the first line to grab the username, set it as the "userName" variable, and pass it to the second line via $userName. #!/bin/sh userName=ls -l /dev/console | awk '{ print $3 }' sudo dseditgroup -o edit -a $userName -t user admin Searching for how to create functional variables hasn't turned up anything relatable to what I'm doing here. Anybody have some p

I've been tasked with coming up with a script to mount an smb share where the share will be a user's name. This share needs to show up in the Finder sidebar with the name "Home". I've been able to do the following... mkdir /Volumes/Homemount -t smbfs smb://pc-fs2.pc.parkland.edu/home2$/$Current_User /Volumes/Home I figure if there's a way to get /Volumes/Home created as a shortcut in the Finder sidebar then things are good. Any ideas? I was sure a few months ago I saw an application someone created that would do this but now I can't find it. Maybe I saw it in a dream...no idea. At any rate it'd be nice if I could pull this off.

I've recently been replacing our drives with SSD in older MacBooks and MacBook Pros and have started using a scripted version of enabling trim support if there is an ssd installed, however I wanted to make an extension attribute to check that it is acutally enabled. Any ideas? Gabe ShackneyPrinceton Public Schools

Two applications (Logic Pro X and LogicWorks) have been purchased through the VPP site. However when I "populate" them into our JSS, no VPP information comes through. It works as expected for other free and for fee applications , but not Logic Pro X and LogicWorks. I have tried updating the content to no avail and revoking the license. Any thoughts?

Hi all, I just setup a new Casper JSS within a linux server. Everything seems to be ok. When I go to the Casper's URL (https://<my url>:8443), it works. I installed Casper 9.93. I next tried Casper Admin. When bringing it up, it asked me for username and password, which I input correctly as it would be the same used to log onto its website. But then the next screen comes up with an error:"You have not specified a master distribution point in the JSS" What is this master distribution point and where do I set this up?

We have slowly rolled out FileVault 2 across our fleet of Macs with a good deal of success. However, I've found that a good number of our Macs were encrypted prior to our official deployment. These Macs do not have institutional keys and neither our management account or local admin account are listed as FileVault enabled on the Macs in question. Looking at worst case scenarios I'm predicting a situation where someone leaves on bad terms and we're tasked with trying to unlock a Mac that they encrypted on their own. Obviously I'd like to avoid this. So, do I have any options for programmatically disabling/decrypting these existing FileVault encrypted Macs, then re-encrypting them using Casper, thus giving us the recovery key and enabling our local admin user? I imagine not but figured I'd see if anyone found a creative solution before I start working with a couple dozen people to decrypt their Macs.

As I wait for a response for JAMF support - I'm in need of help and a sanity check surrounding the Database and JDS Ultimately, yesterday I uploaded a 7.14GB dmg... twice.. First time using Casper Admin - it took a while but when it was done, all was good - until I relaunched Casper Admin and found the file in red. I checked my JDS via CLI and sure enough, no file to be found. I decided to re-upload the file using the JSS interface. It took some time as well and sure enough, it still did not appear in the CasperShare folder in CLI. After some research, I found that the JDS needs a /tmp folder larger than what we typically allocate - fine, issue resolved using a symlink to the /data partition. Now however I've noticed my Database is unresponsive - can't stop MySQL or login to MySQL. Each JSS server is stuck at 'Initializing Database' after a quick restart. Browsing the mysql/data/jamfsoftware in CLI, i've found some large files - about the size of my DMG.... (Picture attached.)

my configuration profile is set to use /System/Library/Screen Savers/FloatingMessage.saver but the computer name is not being displayed, instead it just says YOUR MESSAGE HERE I logged into one of the macs , system preferences --> Desktop & Screen Saver --> Screen Saver Options --> and the message is set to the computers name so why is it not displaying the computers name in the floating message?

Hi, everyone. I've recently joined an ad agency where we finally are upgrading about 40 Mac Yosemite users and a few Windows users (but using SCCM; not Casper) from Adobe CS6 to Creative Cloud, using CCP for packaging and Casper for deployment. This is my first time deploying software with Casper, and I'll be trained in a few weeks. I'm reading up in advance. All your insights have been very helpful in schooling me on future potential pitfalls and their workarounds, and I'm grateful for this strong community. In the meantime, I'm wondering what your experiences have been with the logistics: how much time you allow (or are limited to in busy, rushed environments) for image builds, installation, user testing with pilot groups, revising builds based on user feedback, and redeploying. Any loose schedule time ranges are helpful because I'm under pressure to plan the rollout. The installs are enterprise versions, including most applications except for video-editing software. Acrobat