I work in a large secondary school, with 1200 pupils, as the IT Systems Manager. During the summer holiday this year I undertook a programme to upgrade our 120 iMacs and 400 Macbook Pros from 10.8.5 to 10.9.4 so that I could upgrade iWork to the latest version. This was completed and everything looked good for the start of the new academic year. How wrong was I! Students started using the iWork documents that had been created in the previous 2 years that they have been using OS X and iWork but the Autosave function, which is a permanent feature of the new iWork and can't be disabled as far as I am aware, does not work with documents on NTFS formatted network drives. All of the student's home drives are stored on a Windows Server 2008 R2 SAN. These home drives are mapped, using SMB, to the users desktop at login using a script. This has become a major problem as students have been opening up their work from their network home drive, editing their iWork documents and getting

Hi Everyone, First post to JAMFNation and fairly new to Casper - we only had our JumpStart in late May '15. Loving the way this community works. :) On to business.... Our internal security policies require that when an encrypted laptop (Windows or OS X) have their recovery keys retrieved by an IT analyst, the key must change (generate a replacement) almost straight away. This is so that once the recovery key is used to unlock the laptop it can't be used again so it continues to be secure. This also allows us to track who retrieved the key every time a new one is generated. I've had a look at the way the JSS manages the FileVault 2 keys. It doesn't appear to generate a new one or track who looked at it. Is it therefore possible:1. To have some sort of mechanism that generates a new key after someone looks at the JSS's entry?2. Audit who looks at it? Thanks!Vinny

I have users that have enabled FileVault 2 on their computers already. We are moving forward with mandatory FileVault 2 on all devices with an institutional key. Is there a way to add an institutional key without decrypting and recrypting the computers with FileVault 2 already enabled? I found this kbase article, but it doesn't apply since the applied user is not the management account. Thanks in advanced!

We'd like to automate Software Installs through our ticketing system by having end users assigned to AD OU's once a manager approves a software request. I have the correct dscl command to check to see if an end user is a member of a particular AD group, dscl '/Active Directory/All Domains' -read /Users/end.user/ | grep group.name I just don't know how to script it as an extension attribute that can be used for policy triggers. I'd imagine that I need script which username is being read and echo the end result. Has anyone else already done this?

Adobe must have lost a competent person and hired a newbee to head up the Adobe DC team. This new versioning system is completely insane. But why am I not surprised?. EA to identify Acrobat Reader DC (Continuous) 15.010.20056 thru 17.x, so we can deploy patches without inadvertently rolling anyone back. Ugh. Any suggestions to shorten this is most welcome... ...[snip]... ...[snip]... ...[snip]... EDIT: Removing the long list of "Like" to avoid confusion, after getting pinged about it.

If you use Group access or a lot of sites please be aware of the following issue with 9.93. We use a lot of Group access accounts that we have assigned to our technicians in Schools and we encountered two issues: 1) Group accounts cannot select between sites on the front pull down menu. These accounts see"Full JSS" on the drop down menu (They do not actually access Full JSS) and are stuck on one of the group sites so they cannot change to another. If anyone knows of a workaround to select between sites without needing that menu site list please let me know! 2) Drop down menu cannot scroll down, its now static so you have more than 30 approximate sites you cannot select further down. There is a workaround: Collapse the browser window until you see a list of all your sites and then that can scroll down and select your site. Then you expand the window back. Hopefully this is resolved soon. Message from our TAM: *We are running into another Product Issue. This is known as

I'm trying to create a popup message for users who are running low on boot drive space. I'm getting the free space of the boot volume and adding it to a description variable that I then call in the command to jamfhelper. But it doesn't work in jamfhelper (no description displayed) #!/bin/bash space=`diskutil info / | awk '/Free Space:/ {print $4 $5}'` title="Drive Space Warning" description="DNG has detected that your boot drive may almost be out of space! You only have $space free. Please contact DNG support if you need assistance freeing up space." jamfHelper="/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper" icon="/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/AlertCautionIcon.icns" "$jamfHelper" -windowType utility -title "$title" -description "$MSG" -button1 "OK" -icon "$icon" -alignDescription center

Hi all, I'm searching through Casper JSS for anything that could lock out a Macbook from users. I'm not trying to do anything malicious here (well, that depends on how honest you think I am ;) ). But I'm the Mac admin for about 600 Macbooks. If an employee ever takes the Macbook out of he company, I want to get control of it again. The Macbook is company property. I am thinking chaning the user's password on a Macbook? Or even something severe like deleting the user's folder? (I think that's too much as it means we can't recover the data)

Hello Community, since a few month I to fix this issue... It is simple but nothing works. I want: ScreenSaver after 5 minutes Immediately Password Require I try it with a configuration profile, it works sometimes and sometimes not. It is a bad option. I try a lot of scripts nothing works. I use JSS 9.93. I hope everyone can help me to fix this simple issue. I only want a screenshot after 5 minutes with a password require :-) Many ThanksChristian

I've just upgraded our test environment to 9.93 and I can't see the Patch Reporting option on the left. Do you have to turn it on in settings? What am I missing here?

We are testing Mavericks 10/9 (13A603), JSS 8.73. Occasionally we see the jamfAgent process freeze, is anyone else seeing this? external image link I did a search through the forum, came up dry. I set tag for this thread to jamf binary but this is for jamfAgent process. After a reboot the jamfAgent process was back to normal. Checked again about an hour later, shows not responding again. TIADon

I've been using RemoteUpdateManager for updating our Adobe Creative Cloud apps for a few months and it's worked fine until recently. There were some major updates that RemoteUpdateManager doesn't pull down (on purpose by Adobe), so I manually updated those through the Creative Cloud GUI app. In the weeks since those major updates, RemoteUpdateManager will only list the Camera RAW update and that's it - even though the Creative Cloud GUI app says there are minor updates available for several apps. All the Macs that have Creative Cloud installed are seeing this same behavior. Has anyone else seen this? Is there something I'm missing? Has Adobe deprecated RemoteUpdateManager so it doesn't even get minor updates any more?

When we are trying to push network printer and tried to print this hold authentication is showing.

This is my workflow - I have a CONFIGURATION POLICY running for anyone that does not have Office installed. It's called "Install Office 2016" "Install Office 2016" has a recurring check-in trigger, and assigned to a scope consisting of a SMART COMPUTER GROUP called "Office Not Installed". The Smart Computer Group "Office Not Installed" has one critera, set as "Application Title Does Not Have Microsoft Outlook.app". This group currently shows ZERO members. Regardless of this, the log on end user's devices are showing this over and over and over - Wed Aug 17 10:46:35 COMPUTER-NAME jamf[15302]: Verifying package integrity...Wed Aug 17 10:47:43 COMPUTER-NAME jamf[15302]: Installing Microsoft_Office_2016_Volume_Installer.pkg...Wed Aug 17 10:49:22 COMPUTER-NAME jamf[15302]: Successfully installed Microsoft_Office_2016_Volume_Installer.pkg.Wed Aug 17 11:04:54 COMPUTER-NAME jamf[18648]: Checking for policies triggered by &#034

Hello, I'm new to Casper and I'm running into a few problems after the machine is imaged. I'll layout my process and versions. JSS and Casper Admin are running 9.93 Downloaded El Captian from App store 2.Dragged the download onto AutoDMG to create image 3.Launch AutoCasperNBI and selected the image AutoDMG created and selected Casper Imaging. 4.Launched Casper Admin incorporated the Image created from AutoCasperNBI into an existing Profile, re-compiled and saved. Turn on macBookPro holding Option down and selecting the appropriate Image Boots into Casper Imaging check the box to erase Hard Drive and Boot to Targeted Partition after, and local Admin account as well. All of that goes fine the image process works however when I first login an error appears "A file operation for CoreTelephony tracing has failed, you may be out of disk space. Details 'Error opening file /tmp/ct.shutdown, err = Operation not permitted" I can fix this issue by performing the command sudo chmod 1777

We have 2 VPP accounts at the moment, one of which is assigned to another MDM and I have the option to reclaim the token for that account. I would like to delete that account. What sort of effect would that have? Will it remove any of the apps from the iPads that are allocated to it from the other MDM?

I am trying to use VM's in my test environment but they keep appearing as MDM Capability: NO. I have seen some post that stated all I needed to do was set my VM so that it has a 12 didgit serial number which I have done, but still the VM appeasrs as MDM Capability: No, and I do not get a MDM profile on the VM.Any help would be appreciated in helping me resolve this issue. Thanks,Larry

I'd like to add a restart to the end of a delete keychain script that users can run from Self Service,is there any way to trigger Apple's restart dialog so the users can choose to Cancel or Restart, i knowi could create a notification/script using Cocoa Dialog or jamfHelper but i'd like to keep it simple if possible. I've looked for a keyboard shortcut that simulates restart from the Apple Menu as i thought i could maybe send those key strokes in a script?, and running sudo shutdown -r doesn't give any feedback at the user level. cheers

This came up at JNUC lunch today. During my JumpStart session we did a target mode imaging that took 5 minutes start to stop including login to the account. When I do the TMI it takes 20-25 minutes. Wonder what I was doing differently from when I was taught at JumpStart. It was just the base image that we are doing from a MacBook Air 11-inch with 10.9.2 Questions that came up... Do we use the JAMF server itself to image from?Do we duplicate the image to another machine to image from?Do we not want to download via WiFi? Current setup is a MacBook air 11inch, with thunderbolt cable to another 11 inch to image. Run admin from one device and it pulls from WiFi then images the attached. Any insight is appreciated.#newb

Anyone know how to do this?I am creating Configuration Profiles for 10.7 but need to download them and deploy using Profiles -I -FAnyone else doing this? If so how?Thanks!

All of my deployed OS X devices have the Autofill forms "greyed out". I am pushing restriction profiles to these devices, however, I have the "Allow Safari autofill" option checked. I am unable to resolve this issue, and am looking for help.

Before I submit a feature request.... We're looking at implementing a specific script that we want to run every Monday eve., but giving users the option to defer for up to 48 hours. Rather than tweaking the date/time on the policy deadline every single week, is there any relatively simple way to use the standard deferral notification, but have the deadline simply be based on "x hours from now" instead? Long-story short, we want a scheduled weekly reboot, but want to use the deferral to give users who may want to delay by a day or so an option (if they intend to be rendering video overnight, or compiling something in xCode, etc.) Just looking to avoid the manual process of tweaking the deadline on a weekly basis.

Hello! So Apple School Manager is about ready to send me to the psyche ward... Since our SIS is not supported through ASM, I'm trying to upload CSV files through their SFTP site. I filled in all of the staff and student information, as well as a couple of classes that I know will be using our iPads pretty often. In the rosters CSV file, I just made one entry for one of our classes, and entered in two students into the rosters entry. After about a minute of uploading the files to ASM, I get this message back: **Time: 2016-08-10T19:15:06.084523[OK] unzipped file: classes.csv.[OK] unzipped file: courses.csv.[OK] unzipped file: locations.csv.[OK] unzipped file: rosters.csv.[OK] unzipped file: staff.csv.[OK] unzipped file: students.csv.[OK] headers and first record.[OK] all files provide unique primary keys within each file.[OK] person_id values are unique across students and staff.[ERROR] rosters.csv/class_id references an invalid classes.csv/class_idrosters.csv L1: class_id = dateti

In the past, we used traditional imaging where I would set particular things up including an alias for our shared student account, and then capture those things in the image. For example, our local user account called "student" is used by our youngest students and we like to use an alias of "123" which is easier and faster for them to type in. This year, I am only imaging a base OS and configuring everything else via policies or profiles. I have created my local user account "student" in a policy, but see no options to attach an alias to this. Is it possible in the JSS? If not, has anyone been able to do this in terminal? I have searched around and haven't been able to find much info.

Hi all, I have been looking at this for hours now and I cannot seem to find what is going wrong here. My goal is to have a smart group containing computers which do not have FileMaker Pro of the version 11.0.4. I have taken some snapshots. 1 is of the criteria, 1 is a listing of found computers who qualify the criteria. and 1 of the application list from the found computer (which should not have been found as this computer DOES have the 11.0.4 version. I am at a lost......