I've created a DMG from Composer and tested this as an upgrade from 15.12.3 to 15.13.1 but getting the following errors (see below). This problem also surfaces if the Office Suite is installed using the unaltered PKG directly from Office 365. Microsoft Error Reporting log version: 2.0 Error Signature:Exception: EXC_BAD_INSTRUCTIONDate/Time: 2015-08-13 15:51:54 +0000Application Name: Microsoft ExcelApplication Bundle ID: com.microsoft.ExcelApplication Signature: XCELApplication TimeStamp: 0x55c4b13aApplication Version: 15.13.1.150807Crashed Module Name: MicrosoftSetupUICrashed Module Version: 15.13.1.150807Crashed Module Offset: 0x0000b1a8Blame Module Name: MicrosoftSetupUIBlame Module Version: 15.13.1.150807Blame Module TimeStamp: 0x55c4b12dBlame Module Offset: 0x000000000000b1a8StachHash: ffffd3feApplication LCID: 1033Extra app info: Reg=en Loc=0x0409Crashed thread: 25 Operating System InformationOperating System: Mac OS X 10.10.4 (Build 14E46)CPU: Intel x86, Logical CPU Coun

Hey All, Trying to setup a Public Folder Calendar on some of our Macs with Outlook 2016 installed. However when selecting Tools->Public Folders(see screenshot) Nothing is displayed under the Root. Any ideas why this would be happening? I have confirmed i have access via windows Outlook 2010. Link to KB: https://support.office.com/en-us/article/Access-a-public-folder-in-Outlook-2016-for-Mac-8b16a7e6-ec52-4a41-b79e-38e0ccb21fea

Hi Everyone. I could use some help here. I have looked all around JN (other sites as well) and I have not come across the answer. I am currently using this EA to report Admin Accounts on a computer. !/bin/sh ################################################################ # Extension Attribute checks to display Admin Accounts on the computer. ################################################################ AdminAccount=dscl /Local/Default -list /Users UniqueID | awk '$2 >= 500 { print $1 }' | grep -v "^_" echo "<result> $AdminAccount </result>" exit 0 It will report all accounts that have the local admin rights checked in the GUI. This includes mobile accounts that gain their admin rights via and AD Security group when the computer in connected to the corporate network. Can anyone assist me in modifying the script above to report "truly" local admins? In other words, only those accounts that gain their rights by manu

I had a request to change the setting for requiring a password after sleep or screensaver from the default 5 minutes to immediately. I checked my enrolled MacBook, and that setting was greyed out and I couldn't change it even as an admin. I figured it must've been pushed down by Casper, so I checked in the JSS and that was not one of the settings I'd already defined. I went ahead and added it to an existing config profile that had already been applied with a few other basic settings. I selected the option to deploy it to all existing computers, and when I check the status, they show that they have completed successfully. However, when I check the computers themselves, the setting is still set to Require password 5 minutes after sleep or screen saver begins. I rebooted the machines after apply the profile, as well. I saw the thread about config profiles not working on 10.11.4, and one of my test machines was upgraded yesterday. So, I checked a 10.11.3 machine and that o

Recently I've been running into a problem with Casper binding to AD.If I try to bind a Mac to AD, and it already has a computer record in AD, it will fail.This scenario comes up if you are rebuilding a Mac that was bound to AD. I have "rebound" other Macs in the past. I know it was working back in June using 10.7.x and Casper 8.5.x.If I manually join using Directory Utility I get the "Join Existing Account?" message. Click OK then it joins it properly. Here is the policy log. /usr/sbin/jamf is version 8.63Executing Policy my.domain.com AD...Binding eric-ml15 to dockside.benfer.com...An error occurred binding to Active Directory: dsconfigad: This computer is already 'bound' to Active Directory. You must 'unbind' with '-remove' first. (Attempt 1)An error occurred binding to Active Directory: dsconfigad: This computer is already 'bound' to Active Directory. You must 'unbind' with '-remove' first. (Atte

This is what I am experiencing right now.I created a configuration in Casper Admin to image a machine using 10.8.2 and set it so that configuration also enrolls the machine as they are imaged under the Management tab of Casper Admin via browser, as well as to bind it to our Active Directory domain.Image process completes, I boot up the machine and after a couple of minutes it is up and has checked into Casper and now shows up in Inventory with the Computer Name I gave it while in Casper Imaging, let's say Mac01. The built-in Bind by default is set to run as a FirstRun script which it does and works but requires a restart to allow AD users to login. I restart, login with an AD account. After its inventory interval Inventory now shows that machine as having the Computer Name of localhost instead of Mac01. I go to Sharing in System Preferences and the Computer Name field is now blank and no policies seem to hit that machine/user.What I have done to get around this is re-create my

Our animation students are seeing a problem in our Yosemite labs where they begin a render in Maya and the computer tries to auto-logout, killing the render. The machine doesn't actually logout because the unsaved changes in Maya prevents that. I didn't specify auto-logout so I'm not sure where the machine is getting this as a default behaviour. The behaviour I would like to see is auto-logout permanently disabled and students should be able to enable screen lock so they can protect their renders while they go home for sleep. The lab systems automatically do a hard reboot at 6 AM every morning (reboot now in a script kicked off by cron). This all worked fine under Mavericks. Under Yosemite, it seems the auto-logout can be turned off if the student disables screen lock in the GUI: System Preferences, Security & Privacy, uncheck "Require password [x seconds or minutes] after sleep or screen saver begins, then "Are you sure you want to turn off screen lock,

Running into an issue that honestly has me ready to pull out some of what little hair remains. ;) Have an upgrade policy for a specific app which fails on MOST, but not all of our systems. I can't determine why. Have a very simple package which simply places a large installer script into /private/var/tmp Next, I'm running the install command via "Execute Command" under "Files and Processes". Essentially, the package places a script in the location, which is then executed. The script itself is too large to deploy via Casper's normal script process (approx 7-8mb), thus this particular approach. Now - in all of my initial testing, we had success. When deployed to production, on approximately 2/3 of the systems, I get the following in the logs when it attempts to execute the script: Result of command: /bin/sh: ./private/var/tmp/install.sh: No such file or directory On the remainder, it executes perfectly. I've tried both .dmg and .pkgs for

Hi. We have an SSL cert installed on our NetSUS appliance, which protects the management interface. However, we would like to deliver software updates over SSL, using the NetSUS appliance. Is this possible - I notice that when the URLs to the catalogs no longer display when you prefix them with https:// Has anyone managed to achieve this? Thanks, Ian

Hi all, We're running into an unusual problem that I can't seem to find anywhere else. We, by default, rename "Macintosh HD" to "System" (it's a callback to the way things were done before I came along). We also encrypt all of our machines with FileVault 2, obviously requiring a Recovery HD partition. Starting with our 10.10.3 image, we've found that, after imaging, option-booting the machine shows two "System" partitions - ostensibly one for the encrypted partition and the second for the recovery partition. Clicking on the left HD sends the user to the login screen to unlock the encrypted drive, the right gives us the prohibitory symbol. We have verified that booting while holding Command-R (or pressing Command-R at the option-boot screen) does indeed load the recovery partition, but we would like to either not see the recovery partition on option-boot at all, or see it properly named (a diskutil list on the booted partition sees Recovery HD named correctly). N.B. I used a 10.10.4

I have been to MacIT twice and I am considering going to MacAdmins instead this year. How many of you have been to both and which do you think has more value? Things I consider are the session relevancy and networking opportunities.

Hey all; I'm attempting to build a NetBoot image for Casper, for use with OS X Server. I got OS X Server set up, and I'm attempting to build a clean NetBoot image that will allow me to boot Mac clients and run Casper Imaging. I ran through the instructions here, I built a minimal base OS, I used Composer to create a .dmg, and I used Casper NetInstall Image Creator to create the .nbi and load it into the correct folder and make it the default boot image, etc. The issue is that when I do it that way Mac clients will not boot from the network. If I use System Image Utility to create a NetBoot .nbi folder based on the El Captain installer, it works to boot Macs from the network. Then the issue is that it's a full OS and isn't customized for Casper at all, doesn't have Casper Imaging on it, etc. Is the issue possibly that Casper NetInstall Image Creator is out of date or incompatible? Looks like it hasn't been updated in a while. I'm setting this up fo

Having a challenge configuring X-forwarding for multiple IP interface elastic load balancing. The service generates multiple load balancer IP addresses/interfaces and registers a DNS A record with all. I'm attempting to configure the RemoteIPValve x-forwarding on the JSS' and I've configured the "Enable Remote IP Valve" setting under Apache Tomcat Settings and edited the "server.xml" file on each JSS to include the RemoteIPValve element for internal and trusted proxies fields. However, the internal and trusted proxy addresses in the "server.xml" seem to only honor one IP address for a load balancer. Example in server.xml:<ValveclassName="org.apache.catalina.valves.RemoteIpValve"internalProxies="172.1.2.3"trustedProxies="172.1.2.3"remoteIpHeader="x-forwarded-for"remoteIpProxiesHeader="x-forwarded-by"protocolHeader="x-forwarded-proto"/> DNS A record:JSS.hawks.com has address 1

I am using the script provided by at this locationhttps://github.com/rtrouton/rtrouton_scripts/tree/master/rtrouton_scripts/disable_apple_icloud_and_diagnostic_pop_ups(I changed the upper part to include Non_localized/)it is part of a policy that installs a cached OS X.9 installedesd.dmg. The script in the policy is set to run AFTER everything else, but when logging in (after the upgrade is complete) the iCloud popup is present. I assume the script is not installing at the correct time, here is the log of a computer that completed the upgrade. It should be installing sometime after the OS is upgraded and when it reboots, is this not happening? Executing Policy Install Cached Upgrade to OS X Mavericks...[STEP 1 of 3]Mounting MAC Software to /Volumes/CasperShare...[STEP 2 of 3]Installing SNHS-Install OS X Mavericks InstallESD.dmg...Preparing for in-place OS upgrade...Closing package...[STEP 3 of 3]Running script SNHS-DisableiCloudPopUp.sh...Script exit code: 0Script result:Blessing

Hi all, I'm having difficulty seeing my NetBoot server in the Startup Disk pane, even though I've completely disabled SIP. It boots fine holding down Option. Systems are running 10.11.3. Am I missing something obvious? Thanks!

I'm having an incredibly annoying issue crop up with an increasing number of my users based around logging in after the screensaver locks their computer. The computer logs in but when they hit the main GUI all of the applications appear to be in the background (the application menu will usually just stay on whatever the last foreground app was or on Finder.) You can click on any elements you would normally be able to click in a background app (window modifiers, dialog buttons, etc) but you cannot type anything or get any meaningful use out of the machine. I'm running 9.82 and have a profile out for lock instantly after screensaver which I know is buggy right now. I rolled out the fix @kitzy blogged about with a manually uploaded plist in conjunction with the profile. I don't know the buggy profiles from 9.82 play into this or if something different is going on. Has anyone else seen this?

Hi all, In our school district we are seeing an issue with Java unable to be successfully detected in Firefox per the PARCC testing technical requirements. JSS is up to date. Firefox is up to date. Java is running the recommended version from Oracle. Is there a possibility that JSS is somehow obstructing the running of the Java Applet in Firefox in this particular instance? The last discussion I saw on PARCC was January of 2015, so I was hoping to reopen the conversation with our issue(s).

I am very new to using JSS and am trying to run a policy by using a script in another policy. The idea is to have a policy run a script every day that checks for certain parameters. If it finds what it is looking for, it triggers another policy, via custom event, and that policy runs a script that does what I need. Both script's logic is working with one exception: when trying to trigger the second policy with the script, I get an error. I have trouble shot it down to a single line of code and am unsure how to proceed. #!/bin/sh sudo jam policy -event nameOfCustomEvent If I comment out that line, I have zero issues. Obviously I am unable to run the second policy when doing so. I am using self service to run the policies manually for testing. "The error I get in self service reads: There was a problem installing nameOfPolicy. Contact your administrator." No other information is given. Any thoughts

Yes I know, the opposite of what most people are looking to do. My environment uses edirectory (not my choice before anyone comments on this), and the plug-in for replicating AD bound machines for it is buggy at best. I'd like to move all users off mobile accounts on to local accounts, but I'm not sure what the best method for this is. This is mostly directed at anyone who has done this in the past, and your experience with it, and how you handled user data.And at anyone else who might have ideas I would love input, I'm quite unsure of what path to take, as I would like to be able to have users re-using their username of their mobile account, and having access to their data.. Tricky for sure.

Recently I grabbed a script someone in the Mac Admin community created to check the configured remote management accounts on machines. We only have one account that we setup specifically to have remote management access. That script is our EA for which the output is set to string. I have a smart group which is set to add computers to this group if 1) there are no remote management accounts configured and 2) if the reported remote management account is not our configured account. All this is working fine except that our language lab computers have special software which add an additional remote management account to do what the software needs to do. Because of this, I need to add additional criteria so these machines don't unnecessarily populate my smart group. If I add an additional criteria such that the output is not like this additional account, this removes the lab computers from the smart group. But if I'm thinking about this right, even if I add an additional rem

I added the Firefox script made by Joe into my JSS. It worked great in my environment until a few days ago. Nothing has been changed in my JSS; it now pops up an error when running from self-service. There was a problem installing Mozilla Firefox. Contact your administrator. Stupid error message calls me out on my mooching. I created a new standalone pkg and replaced Joe's script for the time being. Anybody else seeing the same error with the script?

Hi All i've setup a SUS and push a configuration profile with branch URL to client mac. Is it possible for client to update 3rd party app from Apple Store? so far whenever client wants to update, it will go check the branch url, which containing apple patches, but what about the other 3rd party app update such as evernote on apple store? can SUS cover those updates as well or client can only update Apple patches with SUS thanks

is anyone having issues with VBA in Excel when running macros ? Method 'ADD' of Object 'CommandBarControls' failed run-time error '-2147467259 (80004005)' I have installed 15.17 and when check for updates, it says I am all up to date.

I’m trying to get a post-install script to run from a custom trigger. This seems like it should be fairly straight forward so I assume I’m overlooking something quite basic? And yes, I am a noob in terms of scripting so please go easy on me. Or not! I just can't figure out what I'm doing wrong... Following a suggested imaging Workflow on Macmule I’ve created postflight.sh like this: #!/bin/bash jamf policy -event postflightconfig Which has then been set to run at reboot as part of this imaging config: With the policy itself set to trigger at a custom event defined as postflightconfig, like this: Except nothing happens? If I make postflight.sh executable I can run it manually and the policy is successfully triggered so I know the trigger and policy are OK. I just can’t get it to run at reboot after imaging? JSS is 9.81 Thanks in advance...

We have to remove an old cert from all the Macs. We have the hash, so can identify computers that have the old cert. The cert might exist in /Library/Keychains/System.keychain or /Users/username/Library/Keychains/login.keychain or etc. In order to list the current logged in user's keychain(s), a script would have to capture the current logged in username, and then run with admin rights, to blast the old cert from either or both keychains. #!/bin/sh # Find current logged in username USER=`/usr/bin/stat -f "%Su" /dev/console` # Pull list of keychains /usr/bin/security list-keychains > /private/tmp/"$USER"_keychains.txt # Prune the list down to just paths /bin/cat /private/tmp/"$USER"_keychains.txt | tr -d """ | tr -d "  " > /private/tmp/"$USER"_keychains1.txt # Loop through each keychain and remove Cross Root Cert if it exists and send errors to /dev/null for keychain in $(/bin/cat /private/tmp/"$USER&