I have been using a computer-level configuration profile to only allow students to access certain preference panes in System Preferences. I have always been able to log in as root to access the hidden ones if I need to. But now, it is also managed for the root account. I don't know what has changed other than upgrading the JSS to 9.64 which does make many needed configuration profile improvements for logging. Is there any key combination to bypass the profiles from being applied when logging in? For some reason, I thought there was once. Let me know your thoughts on how I can do this again. Thanks!

Is is possible to collect from AD the users status, such as Active=Y (we have an attribute that matches this), or Active/Inactive, etc?We don't have a well defined off-boarding protocol at the moment (or any off boarding protocol for that matter). Users are deactivated from LDAP when they leave, but we usually don't find out about it until we find a device that has stopped reporting for extended period of time. If I could pull user status from an AD attribute, I could potentially generate a report that might be helpful.

I'm in the process of creating a script that will notify users when their Active Directory password is 10 days away from expiring, and then remind them to change it every day until it expires. Right now I'm struggling with finding a programmatic method to determine the user's password age, or when it will expire. Before I spent a lot more time on this, I figured I would come to this community and see what other people are using, and ask if you would be willing to share some code/ideas with me. Thanks in advance,Bill

Does anyone know if the JSS SCCM Plug-in 3.41 supports the newest SCCM 2012 R2 SP1?

Hi All,Suddenly today when enrolling new computers (running 10.11.4 and 10.11.5) we're seeing this about half way through our process in the jamf.log: Fri Jun 03 11:15:26 asdf’s MacBook Pro jamf[6092]: Error executing command: ( "/usr/local/jamf/bin/jamfAgent", version)Fri Jun 03 11:15:26 asdf’s MacBook Pro jamf[6092]: Upgrading jamf agent...Fri Jun 03 11:18:57 asdf’s MacBook Pro jamf[6092]: Error executing command: ( "/usr/bin/gunzip", "-t", "/Library/Application Support/JAMF/tmp/jamfAgent.gz")Fri Jun 03 11:18:57 asdf’s MacBook Pro jamf[6092]: * -[NSConcreteTask terminationStatus]: task not launched So why is this happening? We download a quick add.pkg for each machine we image - so the binary should be the latest and greatest right? After this error it continues on but nothing every happens - i assume the binary is hosed so no further tasks are actually able to complete. I've got a ticket opened with support,

Hey Everybody! I need help. I am wanting to start using JAMF to encrypt my laptops. We have decided that we want individual keys and also enable my "Tech" local account as a FV2 user. I have created a Policy to kick off encryption for the current user, and am happy with the results. However, I am having a bear of a time figuring out a script to enable my Tech account as a secondary FV2 user. There are a few articles that have helped, but I think I may need a full walkthrough on the scripting part. This seems like a simple task, but I just can't find anything beyond where I am now. Here is what I got so far: echo "<plist><dict><key>Username</key><string>Drake Technician</string><key>Password</key><string>myTechnician'spasswordincleartext</string></dict></plist>" | fdesetup add -inputplist I know very little about scripting, so please withhold judgment.

Hi guys, Having a silly issue while imaging. Issue: The dock will have 2 downloads folders. One of them is the correct one where it fans out, the other doesn't show as having an icon, displays a "?", and does not fan out. I'm editing the plist located at /users/username/Library/Preferences/com.apple.dock.plist Dockutil does not work for us. I don't know why I'm getting two downloads folders...I'm testing by running a policy and using FUT.

I have a PKG that I created that simply places a file on the root of the drive. It looks fine in Casper Admin, looks good in the web interface when I go to management and packages. When I go to create a Smart Group for machines that have installed that PKG it does not show up under the "Installed by Casper" criteria. Using Casper 9.31. Had a similar issue with a similar file and for the life of me I cannot remember what I did to fix it. Thanks in advance for any help.

Hi -- We have a problem where our technicians enroll macs for users. They use their personal domain credentials to sign into the enrollment page, and use the "Assign To:" field to assign the end-user. In the JSS the technician shows as the user, instead of the end-user, even though we filled out the "Assign To:" field. Any one ever experience this?

are policies (if any) being performed, check-in etc... for macs (iMacs,mbpros,mbairs) while the compute is sleeping? and also if the macs are just at the login window?

We have a standard management account that we use which is deployed during imaging and at enrollment. A request has been brought forth to add a second management account. The Local Accounts and Management Accounts payloads do not seem to have this feature built-in. It is worth noting that the second account that is needed to have SSH functionality enabled is being added via a Self Service policy that is initiated by the user performing the imaging/deployment of the client machine. This policy adds that user as an administrator and as a FileVault 2-enabled user. Has anyone else implemented a similar workflow? If so, do you mind sharing what steps you took?

Hello everyone, We have a couple computers that are enrolled in JAMF, but we want to make sure they never get any packages or certificates pushed to them. We like the reporting that JSS gives us, especially with the inventory / IP for remote services; but we don't want to risk pushing out a policy to the computer. Is this possible? I know for each policy we can exclude it. Not only is this a lot of work to do, but we also run the risk of an accidental deployment if someone isn't paying attention.

We are on 9.91 with windows servers and we have played with DEP before, but are now looking at using it more heavily. When I boot up a DEP Enrolled client and go through the enrollment process it installs the MDM profile just fine but does not install the framework. This only occurs when I am using our internet facing JSS, on campus works fine. Obviously I have something misconfigured on the internet facing server, though I swear this used to work when we looked at it before. Does anyone have any bright ideas on where to start digging in to this? We have no internet facing DP, but I am under the impression that the framework is sent to the client over https for prestage enrollments, so no DP should be necessary.

When we copy a QuickAdd Package that was created and used to successfully join one Mac to another un-joined Mac, and try to enroll the un-joined Mac, the QuickAdd Package fails on the second Mac. Is there a way to configure a QuickAdd Package so that it can be used for multiple Mac adds? Also, if a QuickAdd Package is created under say JSS 9.90 will that QuickAdd Package still function under JSS 9.91, or is it best to recreate a new one under JSS 9.91? Thank you!

Content backfill required

I've been testing the use of FileVault 2 & Mavericks clients in the JSS. I also have some Mountain Lion clients but I'll probably just upgrade them to Mavericks. So most likely I'll be dealing only with Mavericks. Anyhow, I have several systems that are already FileVault 2 encrypted. Would it be best form and easiest to just decrypt the drives before trying to work with these systems and FileVault 2 and the JSS?

Sounds dumb, but I am looking for for the java 1.6 download for a fresh install of JSS. Thanks

I'll keep it simple...the title says it all. I've been asked to get Firefox out to our Mac fleet. What is the easiest way to deploy the app, our pac file address, the cert for our proxy (and have it be usable in Firefox) and make the proxy settings immutable in Firefox by non admin users? Give my lack of experience with Firefox, the more details about the process the better. If someone knows how to make Firefox use the settings defined in the system keychain and System Preferences that works too. Thank you in advance,Blackholemac

Can't get List Of Users to work. Is grayed out.

Hello! I'm capturing text then echoing it to ALL CAPS like this, which proves the command works. read diskName echo $diskName | tr [a-z] [A-Z] The goal is to pass this capitalized text to: sudo diskutil partitionDisk /dev/diskn MBR fat32 "$diskName" 0b However! My trouble is passing the ALL CAPS text to the diskutil command. So I tried: $diskName=`"$diskName" | tr [a-z] [A-Z]` Here's the whole piece: read diskName $diskName=`"$diskName" | tr [a-z] [A-Z]` sudo diskutil partitionDisk /dev/diskn MBR fat32 "$diskName" 0b Any thoughts?

So we are setting up a new domain and migrating from 2 previous domains and I'm trying my best to script this correctly so the migration is smooth. I set this up as a policy on logout. So first I do a force unbind: dsconfigad -force -remove Then I have it rebind with the casper directory binding we created for the new domain. Then I have it fix the user permissions for the new domain: chown -R $3:"domain users" /Users/$3 Then I set the 14day timeout in OS X to 0: dsconfigad -passInterval 0 My problem is that when all is said and done, everything appears to have correctly run, however at the login screen, when you login as that user again, it just pinwheels and never logs in. When you do a hard reboot though, it works fine. So I added a reboot to the script at the end, but it still just hangs. Any ideas? Gabe ShackneyPrinceton Public Schools

Hi everyone, We are having an issue where the OSX Setup assistant is being bypassed once done imaging with Casper. We have tried with blank OSX images made from capturing a computer via Composer, Disk Utility and AutoDMG. None of those are working properly. We had this set up and working up until we updated to 9.9. If I remove the .AppleSetupDone file I can go back to the setup and force the PreStage, but if I include it in the imaging process, it still bypasses it and goes to the Login Window. Any thoughts would be great!

Hello Community, I want to create a self service feature to change the language and keyboard layout in english. What is best way to do this? Many Thanks for helpChristian

I'm running a shell script via Self Service. I'd like to identify the user currently logged into Self Service, not the user logged into the computer. Is that possible?

All,Trying to figure out why 10.11 updates are not showing in my branches. Did an upgrade on NetSUS 3.0.1 to 4.0.0 runing the .run on an Ubuntu 14.04.3 LTS VM. Do we need to manually add the Apple software update catalogs to the NetSUS, and if so, how can we do that?