Just got a new machine, think it will be on El Capitan, and trying to netboot and get the no entry sign - So guess I need to update the netboot server? Is this a case of upgrading the whole server OS to El Capitan and everything should be OK? Or do I need to create a new netboot image? How do I do this? Whats the best way to snapshot the server in case anything fails? Just want to make sure I have everything right - Backup ServerUpdate OS to El CapitanCreate New NBI Any help would be hugely appreciated! First time doing this so keen to learn!

Hello JAMF! I'm currently using this to set my Energy Saver options. I can't seem to figure out how to UNCHECK the 'Put hard disk to sleep when possible' and CHECK Start up automatically after power failure'. I'm trying to avoid using Config Profiles for this because of some issues. Any help would be appreciated! if [[ $shortModel == "MacBook" ]]; then pmset -b sleep 15 disksleep 10 displaysleep 5 halfdim 1 pmset -c sleep 0 disksleep 0 displaysleep 30 halfdim 1 else pmset sleep 0 disksleep 0 displaysleep 30 halfdim 1 fi

Hey there, all! I'm trying to install AirMedia to client machines in my organization via a push policy and also extend availability in Self Service. The problem that I am running into is that at the end of the AirMedia installation wizard, a window titled "VersionChecker_Crestron_HD_Presenter" appears asking the user to install Soundflower as it's needed for audio functionality. I thought that this was strange and just added the Soundflower installer into the policy and set the priority such that the Soundflower installer runs before AirMedia. No such luck here either as the the same window prompts. I grabbed the PKG for AudioMedia directly from Crestron (link below). I guess I could run Composer and extract the "VersionChecker_Crestron_HD_Presenter" window but would prefer to leave the installer intact and add a script to suppress the window. How does this sound? Is there another approach that I should consider? http://www.crestron.com/downloads/software/AirMedia_OS_X_installer_1

Hello, I have been working on customizing the quickadd.pkg because our JSS is cloud hosted, our AD in on prem and we are not allowed to bind them because the methods used are not deemed secure enough for our security team. I have read Getting the Most out of your QuickAdd.pkg and have used it to create some scripts and enrollment work flows. I have extracted the postinstall.sh file, using tar through the CLI. Now that my script is ready, I don't know how to rebuild the quickadd. I know I could tar it back up but I am worried it will extract and not execute the contents. Is there a way to do this from the command line or is there an application which would make the whole thing a lot easier? Thank you in advance for your help.

OK, I've probably missed this somewhere, but I need to create a smart group based on the Macs that have run a script. There are 3 parts to this, 1 and 2 are complete. 1st policy deploy a folder and its contents to the Documents folder of an Admin account at start up. The folder and its contents cannot be altered in any way. -Created a Smart group of Macs with the folder and contents in place 2nd policy run a shell script against all devices that have the target folder in the correct location. The results from the script are save to the ~/Documents/Target/Output. 3rd policy should copy the contents of 'Output' from the local to a server location. I want to create a smart group based on whether the 2nd policy the shell script has run. So my 3rd policy is kicked off by membership of 'The Script has run' I think I'm missing something obvious any help appreciated. CheersPhil

Hi all,We are beginning our implementation of supervision on IOS and DEP. We are currently supervising using Configurator 2 but when I try to use configurator 2 to configure a device supervised through DEP I get an error saying the device is not supervised by an existing organization. It also says (suggests) to import an organization with the identity for the device. You can export the organization certificate from Configurator 2 or the whole Organization as well as being able to choose an existing identity (certificate) when creating a new Organization. The Configurator 2 doco indicates it is compatible with DEP. My question is how can I use the same identity across DEP, JSS and Configureator 2? many thanksRegardsGraeme

Trying to open Self Service.app from a policy. Essentially have SS open in the background and have a window displayed telling people they should really update their system. Half the systems it works on, the other half it doesn't. Using the "run command" in advanced policy field... open /Applications/Self Service.app Does anybody open an application from a policy, and if so, how are you doing it?

I'm trying to show a popup whenever a USB device is connected. There are a few suggestions to use a launchdaemon with StartOnMount, but this gets triggered every time a computer is unlocked from screensaver. Do you have any suggestions on how to approach this problem? Sample code below: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC -//Apple Computer//DTD PLIST 1.0//EN http://www.apple.com/DTDs/PropertyList-1.0.dtd > <plist version="1.0"> <dict> <key>Label</key> <string>com.company.popup</string> <key>ProgramArguments</key> <array> <string>sh</string> <string>-c</string> <string>/path/to/script.sh</string> </array> <key>StartOnMount</key> <true/> </dict> </plist> #!/bin/bash date >> /tmp/test.txt

Anyone got an EA that reports back the management account used? Or a way to smart group machines based on management account?

Greetings all! I am running JSS v9.81 in my environment with all client machines running v9.81 as well. I have about 20 machines that are in need of having a generic, local admin user created on them. For ease of discussion, let's call this user "test_admin." All 20 or so machines can be scoped in JSS using a Smart Group or Static Group so deploying this policy or script should be relatively easy. Any suggestions on getting this accomplished thru JSS?

Hello! I work for a school district with about 2500 iPad clients in our JSS. Currently, we let clients pull apps down from self service. All of the apps are nested under one category called "All apps". I want to start breaking down the apps into "Categories" by the building they are used in because our main category has 200-300 apps in it now and is cumbersome to use. We're having a hard time with apps that are available in multiple buildings. What if I distribute an app in 2 buildings out of 5 available? I can only assign one category to it, so I'm not sure whether to scope the app two different times or just have a category for multi-building apps. If you wouldn't mind - please share any insight into how you organize your self service store. Any guidance would be appreciated! Thank you.

is there a way for me to have auto lock instead of auto logout configuration profile ? some users come back and they have been logged out, thus closing there browsers, documents etc... I told them to avoid this from happening, to click there name at the top right of the screen and choose 'login window' when they return from meeting or whatever, they can log back in and there browser, documents etc.. will still be there.

I've been trying to get auto-logout to work on 10.11 machines. Officially, this should be really easy as it can be set locally and through a configuration profile. Neither of those work. Does anyone have a graceful way to force the logout since the official and obviously labeled ways do not function as expected? All of my searching brings me to forums of people wanting to do the exact opposite(disable auto-logout) of what I'm trying to get set up(auto-logout after 15 minutes idle). For what it's worth, the machines are running 10.11.2, on domain, and are set(locally and by configuration profile) to auto-logout after 1 minute idle. I'll extend that 1 minute idle time to 15 once I get it actually logging out like it's supposed to. I've also tested it with 3, 5, and 15 minutes idle time with no luck whatsoever. There is a screensaver that starts up after 20 minutes if someone is logged in and 5 minutes if at the login screen.

Hello, I am building an integration to Casper with our IT Asset Management database. I am connecting directly to the MySql database and will need to run queries to retrieve asset data. Where can I find a schema map of the Casper database? I would like to see a map of the tables and attributes that are in the jamfsoftware database. Has anyone used Casper in this manner or have written any MySQL queries to pull asset data? Thanks,

Hi - we generate policies for various software titles predominately aimed at our non-admin users. An example of this is Google Chrome which doesn't self update for these users. While we're pretty good at packaging, testing and making available version updates, sometimes we might be a week or two behind. As a result, some of our admin users are complaining that they see and install an "update" made available through Self Service, which actually rolls them back to a previous version, when they have manually updated these. Is there a method to use greater than or less than to drive the enrollment of a machine into a smart group? I'd like to only make a Google Chrome policy available if the user has a version below xxx. If not, how are other people handling this use case? Thanks, JJ

Good Day All, So we already have Parallels Desktop Business Edition deployed to a number of our clients but when it was deployed none of the settings were locked down. Our users are not admins but currently they can still create virtual machines as they please. I want to change the settings in Parallels to only allow administrators to have the ability to create new VMs and add existing VMs. Basically, I want to check all of these "Require Password" boxes on: I found this older script on the Parallels website and I am able to modify it to do what I want, sort of. Here's the script I'm working on: #!/bin/bash vmdirectoryfile="/Library/Preferences/Parallels/vmdirectorylist.desktop.xml" #Locking Snapshots stringA='<CommonLockedOperations dyn_lists="LockedOperation"/>' stringB='<CommonLockedOperations dyn_lists="LockedOperation"> <LockedOperation>24</LockedOperation> <LockedOperation>8</LockedOperation> <LockedOperation>7</LockedO

I have a policy set for custom trigger, which installs a large package - It can take an hour to install.The logs within the policy show nothing whilst the install is running - just "pending". I assume it will only return the success/fail and all steps in-between once it has finished processing. Are there client side logs that show the progress so I can check that something is happening?Self service show all steps (i.e. mounting share, copying package, installing, etc), but I can't see this within the jamf.log when a custom trigger sets off the installation.

So we are seeing an issue where every now and then certain computers are asking for an admin name and password to allow it to continue printing. It almost seems it happens when the printer pauses or has an error and then requires the admin credentials to resume but I'm not positive about that yet. Im trying to figure out if its related to me pushing printers to the computers using casper remote, or if its related to printers being on a configuration profile for that group of computers. We currently only seem to see this on 10.9.5 student use computers. I also lock them down so students cannot add other printers as this tended to cause unwanted printouts in various classrooms. The weird part is this only seems to affect random machines, not the entire classroom. In the meantime I set a policy to remove all printers and then re-add them each day. Thanks for any suggestions! Gabe ShackneyPrinceton Public Schools

We have an iPad stuck on a focused app (notability.) This iPad has since lost WiFi connection and now we can't remove the focus. How do we fix this please? I believe this happened before the break. Thanks

I am running in to a roadblock with a script which I have written to automate some of the steps in our Entourage to GMail conversion process. This script is being run via a policy in Self Service, which is when I started having issues killing off a process (BigHonkingText) which I am running to notify the user of the script's status. When I ran the script locally as root with "killall BigHonkingText" to kill off an instance of BigHonkingText set to "-p 0" (as I want it to run for the entirety of the run of an AppleScript via osascript) it worked just fine. Once I put the script up in a policy and ran it via Self Service, the instance of BigHonkingText would not longer die when the "killall BigHonkingText" command was run. I tried working around it by gathering the PID of BigHonkingText, and then "kill -9 "$THEPROC"", however, it still won't die. Here is the snippet of the code which I am having trouble with (please note

All - using the following script we are giving the user local admin rights. It is set for Login, once per user per computer. #!/bin/bash loggedInUser=$(stat -f '%Su' /dev/console) evaluate=$( /usr/sbin/dseditgroup -o checkmember -m $loggedInUser admin ) echo $evaluate case $evaluate in *yes* ) echo User is already an admin on this mac;; *no* ) /usr/sbin/dseditgroup -o edit -a $loggedInUser -t user admin;; * ) echo Something went wrong;; esac We're seeing an issue, intermittently, where the user isnt getting the rights. In the logs, it looks like its triggered when _mbsetupuser is logged in, and not the actual user we are using... What is _mbsetupuser, and does anyone know why this might be happening? Thanks!Ben

We are using Open Directory for our network users, and we are planning to change them to syncing mobile accounts rather than pure network accounts. We would like this change to be as seamless to our users as possible, so we would like to see if there is a way to automatically set the settings for home sync conflicts. We would like to select the option to "Keep the most recent modification date" and also check the checkboxes that say to resolve all future conflicts this way as well. Our goal is to set this setting without the user seeing this popup. We are using a Casper configuration profile to set the Mobility settings that create the mobile account. Thank you for any assistance you can provide.

does anyone know how i can stop this account used when someone is upgrading to El Capitan from taking over the Users and Location section? I've now manually deleted the account from the JSS 5 times and it keeps coming back anytime someone upgrades.

I have a policy for iMacs and Mac Minis that does Software Update @ re-curring checkin NOT between the hours of 7am - 9:30pm.I have 2 questions; 1 - Should this install updates on a computer whether a person is logged in or not ? I also have the policy set for both when no one is logged in and if a user is logged in to 'reboot the computer if the package or software update require reboot' 2 - How do i know if a computer was rebooted ? all i see is after the policy runs, it does its recon, but i do not see anything telling me that computer rebooted.

Hello all, I will be taking the CCA course next week. I've been doing preparations for the learning and especially more so making sure I pass the exam. Any suggestions, guidance, materials (besides the Admin guide) that would further help with this endeavor. Thank you & much appreciate it.