I have a policy that will reissue the FileVault 2 key and then record it in our JSS, using a script from another jamfnation post. It works perfectly well except for one point. Part of the script requires the user to input their password in order to unlock the FileVault to reissue the key, the problem though is that when the check-in trigger is "triggered" no password prompt comes up and then it "fails" Manually calling the policy with a custom trigger, or running it from Self Service works. It also works when I go to a machine and manually run "sudo jamf policy". It just won't properly execute when using the check-in trigger when it auto checks in every 15 minutes, and I cannot figure out why. This is what i see in the logs, post trigger. Script result: Prompting <username> for their login password. 36:193: execution error: An error of type -10810 has occurred. (-10810) Issuing new recovery key Error: Unable to unlock FileVault. Funny enough, it says the policy completed suc

JSS 9.82 on MSFT Server 2008 R2. We have some Early 2015 12" Retina MacBooks in the environment, Casper reports the model correctly running 10.10.5 or 10.11.6. MacBook (12-inch Retina Early 2015) We brought in a new 12" device (Early 2016) and there appear to be issues in the Casper info. The device images without issue and is running 10.11.6 at this time. However, the model in the JSS shows as MacBook9,1. Has anyone else experienced this? Know how to correct it (server upgrade perhaps)? Thank you.

Is anyone else getting this same problem? - I find a machine in Casper Remote and tell it to reboot and change the startup disk to Netboot, it reboots the machine but it just comes back to a login screen. Log shows Blessing NetBoot server (x86)... Creating Reboot Script... Submitting log to https://jss.coventry.ac.uk:8443/ Finished. I've tried this now on quite a few machine in different sites with different OS version just in case but the same results.I want to start slowly rolling out a new image but I can't get any machine to the NetBoot servers to image.

All,I'm trying to create a script that is used as a logout/login hook to force the user to reset their password. I've been using the "newPasswordRequired=1" command and it seems to work ok locally, but when I try to use it via the JSS I get the following error: Script exit code: 139Script result: /private/tmp/current.sh: line 5: 90168 Segmentation fault: 11 pwpolicy -u "$current" -setpolicy "newPasswordRequired=1" Anyone have any ideas or recommendations for forcing local user password resets? Below is the script I'm trying to get to work. #!/bin/bash current=$( whoami ) pwpolicy -u "$current" -setpolicy "newPasswordRequired=1"

I am attempting to use the commands below to suppress the Mac Office 2016 first run dialog box when any Office application gets run for the first time on the Mac. I works perfectly when run manually but when I try to run it through a script and profile, it just sits at pending and never completes. I am sure I am using all the right setting in the profile. Any help? defaults write /Library/Preferences/com.microsoft.Word kSubUIAppCompletedFirstRunSetup1507 -bool truedefaults write /Library/Preferences/com.microsoft.Excel kSubUIAppCompletedFirstRunSetup1507 -bool truedefaults write /Library/Preferences/com.microsoft.PowerPoint kSubUIAppCompletedFirstRunSetup1507 -bool truedefaults write /Library/Preferences/com.microsoft.Outlook kSubUIAppCompletedFirstRunSetup1507 -bool truedefaults write /Library/Preferences/com.microsoft.onenote.mac kSubUIAppCompletedFirstRunSetup1507 -bool truedefaults write /Library/Preferences/com.microsoft.Outlook FirstRunExperienceCompletedO15 -bool truedefaults

In the top right corner of the screen there has been a notification stating that Check out Photos for OS X notification. Does anyone have a method to stop this notification? I have blocked it in notification center by set the alert style to none and uncheck all the uncheck boxes, and I also have unchecked Automatically check for updates. But seems all not work. OSX Yosemite. Version 10.10.5

Hi guys, We usually chuck a customised com.apple.dock.plist into the user template (/System/Library/User Template) so that when users (students in this case) log in with their AD credentials they all get a standard Dock setup. With El Capitan we're seeing an issue with the Downloads folder in the Dock though, where the icon in the Dock is just a plain folder with a No Access symbol; the actual link works fine though (i.e. if you click it then it actually opens the user's downloads folder correctly and they have the correct access etc.), it's just the icon in the dock which is messed up. Switching the view to 'display as stack' and then back to 'display as folder' will fix the icon in the dock so that it shows the correct Downloads folder icon, but that's not a solution (since it needs to be done by every user on every machine). Looking at the com.apple.dock.plist in El Capitan I'm having a hard time figuring out how the dock data is actu

I'm also working with support on this issue, but I thought I would try out the community as well... We just did our Jump Start training in early December. When the trainer was here we created a Base Image using the 10.11.1 installer and AutoDMG. The configuration called "Base System" only has 4 things. It has the clean AutoDMG created system DMG and 3 scripts. One script joins the WiFi, one sets the timeserver, and the last sets the timezone. It is also setup to create a Management Account (hidden) called Casper. All of this works perfectly with the 10.11.1 system. After the JumpStart training (I think literally the day after he left) 10.11.2 came out. I thought I would go ahead and update the Base Image before I went any further. I downloaded the new "Install OS X El Capitan.app" from the App store, updated AutoDMG and created a new DMG for 10.11.2. I updated the Base System configuration to use this new image instead of the old one. When I use thi

I'm working on implementing Patchoo for our company as we are in great need for a good software updating method. So far thanks to all of the work that @loceee has done it seems to be working. I'd love to be able to add our logo to the cocoa dialog boxes and to change the coloring of the bubbles, but I can't find where in the code I can do this. I think the bubble comes from this function: secho() { # superecho - writes to log and will display a dialog to gui with timeout message="$1" timeout="$2" title="$3" icon="$4" if [ "$timeout" != "" ] then echo "$name: USERNOTIFY: $title, $message" echo "$(date "+%a %b %d %H:%M:%S") $computername $name-$version $mode: USERNOTIFY: $title, $message" >> "$logto/$log" if [ "$(checkConsoleStatus)" == "userloggedin" ] then [ "$title&

So I am installing a JDS and JSS for the first time in a test environment before production deployment and I hit a snag in the installation. I downloaded the JDS installer.pkg and in the JDS enrollment it asks for a JDS hostname JSS URL, JSS username and password. My question is what to put as my JSS URL? I tried the local machines address and it said it couldn't resolve. What am I missing?

Has anyone been able to write a script using tmutil to set more than one destination? For example I would like to set either two network destinations or a single network destination and a local HD. I've got this script running for a single destination, but when I try and modify it to set multiple destinations things don't work. If I try two scripts one will simply overwrite the other. Is setting multiple destinations even possible with the current tmutil? #!/bin/sh TimeMachineDestination="afp://username:password@server.pretendco.com/Backups" echo "Setting Time Machine Destination" /usr/bin/tmutil setdestination $TimeMachineDestination echo "Enabling Time Machine" /usr/bin/tmutil enable exit 0

I know that, as recent as JSS 9.91, that the JSS had plenty of "computer extended attribute templates" that could be downloaded (JSS > Computers tab > Management Settings > Extension Attributes > New From Template) that related to FileVault 2. For example, "FileVault 2 User", "FileVault 2 Individual Key Validation", among others. I do NOT see these EA's as options in version 9.92, and I have complete access to everything in the JSS). Are they missing? I would appreciate the sanity check.

Hello All, I have an odd issue with deploying printers and colors not matching on the print. When i deploy an HP Printer via self service (HP Color Laserjet 2025dn), the ColorSync Profile appears to be missing which is causing the colors to be off. When i install via IP (HP Socket) manually....the ColorSync Profile auto populates just fine. If i install via the policy and use the drop down menu to search for the profile...it is not found. Anyone encountered this before...or know of a remedy? JSS: 9.92OSX: 10.11.6Printer: HP Laserjet CP 2025dnPrinter was packaged using Casper Admin then deployed via policy and self service I've poked around CUPS but nothing promising so far. Attaching a picture of what it is "supposed" to look like. My deployed printer is just missing the "HP Color Laserjet CMYK v402"

Has anyone experienced computers just dropping out of static groups but remaining in a smart group? I am working to encourage our site admins to use static groups for organizing labs who's population does not change. One argument they have for not using static groups is that computers will just drop out of a static group while remaining in a smart group. I have never seen this happen and have always used static groups for my labs and mobile carts.

Hi all, We are getting ready to rollout 4500 iPads (1/2 the district). I have everything ready to go except the following. I have searched through the discussion threads and couldn't find any info...I apologize if this has been addressed: 1) The PreStage enrollment setting for teachers is not correctly associating the department. I set the PreStage enrollment to set the iPad department as Teachers....that should keep the restrictions profile from applying because of the limitation I set. However, it didn't assign that department...I had to manually assign the department....then the restrictions profile was removed. 2) The lock screen payload I configured is not applying. I wanted it to say the "if lost return to..." and have our district name. However, it just has "this iPad is managed by.." and doesn't put that message on. 3) Notifications are not going out correctly. I send the command to send a notification to a given set of iPads....to both the notification center and th

Currently we are using a USB key to provision Macbooks. If I'm not mistaken the image used in this USB key is from a MacBook (http://www.apple.com/macbook/). My question is, can I use this USB key to provision MacBook Pro? I'm having a concern regarding the drivers of the two different models might not match. Thank you.

We just installed the release version of JSS 9.93 on our test server and it installed successfully but after clicking login, it takes us to the homepage for 1 second and then kicks us back to the login screen. This happens in multiple browsers on multiple machines and we have tried restarting MySQL and TomCat with no luck. Is anyone else seeing this issue? EDIT: Our JSS is running on Windows Server 2008 R2.

We have a .Net C# application that runs on a Windows 2012 server and is attempting to add members to a static group via a PUT command and is throwing a 401 Unautorized error for each operation. The error is as follows: 2016-08-01 18:17:12,302 [ERROR] (PROGRAM.Helpers.JssHttpHelper) WebException at 'https://testdomain.com:8443/JSSResource/computergroups/id/18'. Exception: System.Net.WebException: The remote server returned an error: (401) Unauthorized. The code is question is: using System; using System.Text; using System.Net; using System.Net.Security; using System.IO; using log4net; using System.Reflection; namespace Program.Helpers { public static class JssHttpHelper { private static readonly ILog _log = LogManager.GetLogger(MethodBase.GetCurrentMethod().DeclaringType); public static void PutXml(string jssUrl, string username, string password, string url, string xml) { var credentialCache = new CredentialCache(); credenti

Hi all, Mac office 2016 update 15.23 just came out a week or two ago. Eagerly I downloaded this and uploaded to Casper and distribute it out. I did this before noticing the bottom right corner of Outlook was showing "Not connected to: <our email server>" From our Casper logs, around 80 people have taken this update. A) Is there anyway to fix the connection?B) If there's no way to fix the connection, I have to roll everyone back to 15.21 version. How do I do this via Casper?

I began having an issue with my jamf enrollment for Windows around 07/07/16. Possibly around the time I upgraded from 9.91 to 9.92. I knew something was wrong but realized this morning that no Windows Computers were even checking in. I ran the jamf.exe manually with parameters and here is the error: PS S:> C:WindowsTempjamf.exe recon -overrideJSS https://jss.psd401.net:8443 -username imaging -password imaging -allowInvalidCertificate -ssl true Running system Recon... Overriding JSS Url. Url to be used -> https://jss.psd401.net:8443 Overriding AllowInvalidCertificate -> True Retrieving Inventory Preferences from https://jss.psd401.net:8443/... There was an unexpected error executing the command 'jamf.Commands.CommandRecon'! System.Net.WebException: The underlying connection was closed: An unexpected error occurred on a send. ---> System.IO.IO Exception: Received an unexpected EOF or 0 bytes from the transport stream. at System.Net.FixedSizeReader.ReadPacket(Byte[] buff

Hi All, I'm in the process of setting up a new JSS instance in our environment to migrate to (from Server 2012 R2 to CentOS 6.8). We only have 150 clients and after reading many of the threads here, moving to a new instance doesn't appear to be a big deal. Especially as it lets me tidy up policies, groups, clients, etc that have become stale. However, as we use individual FileVault 2 keys per Mac, its now occurred to me that we have stored all the keys in the old server's DB. What is the best way to migrate these out (if possible)? Or would we have to generate new keys for every encrypted Mac? We are running about 35 percent El Cap and and rest are Yosemite. ThanksV

Has anyone figured out a way to disable this feature which is on by default?

Finding extension attributes... Locating accounts... Locating applications... Locating package receipts... Locating software updates... Locating plugins... Searching path: /Applications Searching path: /Library/Internet Plug-Ins Locating printers... Locating hard drive information... Locating hardware information (Mac OS X 10.11.4)... Submitting data to https://in-mdep-casper.ads.iu.edu:8443/... There was an error. Invalid Message - The message could not be parsed. I tried this on another system (OS 10.11.3). It got the 9.9 binary and now same error with recon. Any suggestions on fixing this? Thank you,AJ.

Hi All, How can I create an extension attribute where returns if a SEP client is being managed by a SEPM server or not? Any ideas? Anything have something similar? Thanks!

There is an unmanaged computer,i can't delete it.I click delete,seems successful,but the unmanaged computer is still there,I can't delete.And,I have tried to re-enroll the unmanaged computer from URL (Quickadd),quickadd PKG installed sussessfully,but the computer still unmanaged.what can I do?