I want to create 4 separate Smart groups, each based on the OS X.? version (lion, mountain lion, mavericks, yosemite) that could be installed on the mac. Each OS version will get a certain driver installed. I came up with the following simple one line CRITERIA -- Operating System LIKE 10.7. Operating System LIKE 10.7view of this group populated correctly, tested both ways of having the trailing DOT or not Just want some opinions, is this CRITERIA a good one, and just use it, or should I use maybe the 'OS Build' in the 'value' of the criteria, or do a multi line criteria -- Operating System is 10.7.2 or 10.7.4 or 10.7.5 ?

when Filevault2 is turned ON via configuration profile (logout enables user to enter password to enable them) does the Casper system prevent users from 'turning OFF file vault' from the 'security and privacy' section even if the person is an administrator ? I can turn it off via 'disk utility' but from the 'security and privacy' section, turning off file vault stays greyed out no matter that I unlock the padlock. Is this being done by Casper ?

Is it just me or does the Flash 18.0.0.232 installer (for System Administrators) downloaded from the Flash Distribution site crash immediately upon launch? I've downloaded it 5 times and rebooted 4 just to make sure, but I'm willing to admit i'm having one of those days when I can't do something as simple as double click on a .pkg file.

We are a 1:1 school in grades 7-12 that has all of our students in Open Directory. We bind their computers to the directory due to the mobile Internet filter and user agent which are both installed on the machine. We also have our JSS tied to Open Directory. Does anyone here have a way to assign a computer to an LDAP user on first login? I'm sure this is possible with a script combined with an attribute, but if someone already has this, that would be a time saver for us.

Anyone seen this. We've had some issues with imaging Yosemite, some apps wouldn't install, Dock would not install, some scripted configs would not execute and of course they would not bind to AD. By process of elimination I have:Stopped using 'Automatic Proxy Configuration'. The PAC file location has not changed through Lion to Yosemite - this improved some issues but did not resolve the AD bind.Stopped using the absolute proxy paths and switched to 'Auto Proxy Discovery' So now the imaging process completes without error, apps install, Dock installs and scripted configs execute, and finally they bind to AD. What I'm thinking of doing configuring the proxy after the first user login, this may get round the issues and deliver a configured Mac to the users - but I'd still like to know why? Any ideas?CheersPhil

It appears that TextExpander 5.0 has a new licensing format which does not work with the method mentioned here: https://jamfnation.jamfsoftware.com/discussion.html?id=8069. There's now an additional .license file installed in these two locations:- /Users/Shared/TextExpander/.license- /Library/Application Support/TextExpander/.license I tried replacing these along with the plist mentioned in the other discussion but the software doesn't recognize the new data. It simply erases the information and reverts the files back to the unregistered state. I also tried running defaults read on the whole plist after I copied it just in case it was a caching issue but that doesn't help. Anyone have any luck getting the new version deployed?

I know hiding a preference pane has been discussed in other threads. Generally the method used is: Create a Custom Settings Payload using com.apple.systempreferences.plist where HiddenPreferencePanes references the pane you'd like to hide. This is effectively the same as opening System Preferences as a user and clicking View > Customize, then unchecking an item. But using the Configuration Profile does not prevent a user from simply re-checking it from what i'm seeing. Is there a method that hides a pane in System Preferences, and also prevents a user from going to View > Customize and selecting it again? I have also deployed a Restrictions payload which effectively greys out the pane if it is visible, but i'd also like to enforce that it cannot be visible. Today this is all scoped to the user level, since we want certain support users to see these items, but prevent others from seeing or having access to them.

Hi all,I've been having problems getting the recovery partition just right with a compiled image using 10.10.4 and Casper Imaging 9.73. It seems when you build an image that has both the main partition and the recovery partition included using composer and then you compile it, it will only write the main image back during the compilation. I cannot seem to get the recovery partition to add using the old method of putting it in the configuration as an extra partition. If I do this then it names the recovery partition incorrectly and then Casper Imaging tries to set that as the boot drive and it boots to a folder with a question mark. Anyone else doing this successfully? I played with AutoDMG however this would dramatically change my workflow and I'm trying to avoid it for now. Gabe ShackneyPrinceton Public Schools

Hey everyone, I've seen this issue reported on various search results, namely this one at Apple Discussions. After doing a quick search on JAMF Nation, I don't see it discussed - so either I missed it or not many people are facing the issue. Here goes: When we mount a volume (either a .dmg or USB drive), the item shows up in Finder and is seen properly doing diskutil list and can be accessed without issue. Things that don't work:- Clicking the "eject" icon next to the volume name.- Dragging the volume to the trash Things that do work:- Ejecting the disk via command line hdiutil eject -force disk2s2 - Selecting the volume in Disk Utility and choosing "eject" It's not a show-stopper (we've been dealing with it since at least January - on all versions of Yosemite, including 10.10.4) but it's sure annoying. I can definitely script something and put it in Self Service, but it seems that you should be able to eject a mounted vol

hello, I have written a script which executes a policy and uses terminal notifier to notify the user of an installation. because terminal notifier cannot run during the login window, i check the currently logged in user, if the user is root (assume we are at the login window) , execute the policy and create a text file on the local machine, otherwise we are logged in and run the policy with terminal notifier. i then have a while loop which checks the existence of such a file and verifies the user is not root and then displays a terminal notifier window. Executing the script from terminal on the machine works perfectly fine…. however, as soon as I run the script through terminal it runs the script and nothing happens, its almost like it doesn't execute anything. I may be missing something simple here but I have tried to emulate the conditions locally by executing as root in the terminal. Has anyone seen anything like this before? I am receiving no error logs when the policy ru

Hi all, I've recently got back into the Support game having been away for a few years (CCA in 2008 - things look a little different now!). I've been tasked with creating a report of the Macs on the network (checked in last 90 days) that are pre-10.8, to work out if they can be upgraded or need to be replaced. Initially, I just want to identify how many there are and the names of said Macs - though a complete report of the hardware would be a bonus. I have to admit to feeling a bit rusty on this... I've been trying to create a Smart Group, using the OS version criteria, but it seems a bit long-winded to do and needs a lot of digging to find the relevant information. Any suggestions? ThanksJim

We have been needing to find a script that works to delete all the home folders in the Users directory except for four that we need to keep (map, tech, student, and admn). We have a setup of mobile home directories that are cached on each laptop when network users first use them. Here is the script that support helped build. I am getting a syntax error when running it at the first "for". #!/bin/sh ######################################################################################################## # # Copyright (c) 2013, JAMF Software, LLC. All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # * Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disclaimer. # * Redistributions in binary form must reproduce the above copyright #

So the command I used to use to turn off the Active Directory password timeout is giving an error on the new MacBook Air's running 10.10.4. sudo dsconfigad -passinterval 0 The error I get is "Result of command:dsconfigad: No operation specified nor update requested"Just wondering if the command has changed?I should add that I'm looking back in the logs and this has been going on since February on various machines running 10.9.5 as well. I'm trying removing the extra sudo in the command to see if that resolves it.Gabe ShackneyPrinceton Public Schools

How would you setups FileVault 2 policy for AD joined computers so it enables all users that have currently already have logged in and for any future new users that login? Also for computers that are not AD joined but have multiple user accounts currently configured?

Background: I downloaded an application from the Mac App Store. (Skitch v1.0.7) I installed it on a recently imaged computer. I then created an installation package of the application with Composer 8.34. I uploaded the package via Casper Admin. Problem: When deploying to client computers, the first time the application is launched the user is prompted to authorize the install on this new computer using the credientials I used on my original download. Not what I want. I believe an "app store" application now stores data matching the app to the account/computer that originates the download in the application contents folder. Will we be forced to move to an iOS model for installing applications now that Apple wants us to exclusively use the app store? Has anyone seen this problem and developed a solution? Thanks in advance for posting possible solutions. -Mark

Not strictly Casper-related but posting here in the hope someone has seen this issue before…. We use the native AD plugin (bound via custom scripts) and have mapping to two AD attributes (uidNumber and gidNumber). After an initial image of Mavericks using Casper Imaging, I am able to log in to a test Mac just fine. However, since reimaging that test Mac, I’ve not been able to log in - entering my AD password has no effect. I get a spinny circle for a few seconds and am then prompted to re-enter it. If those attributes are not set, I can log in fine and a random 9-digit uid is generated. Our AD runs on Windows Server 2008 R2, and I know those attributes are populated correctly in the AD user accounts. A computer account was generated in the correct OU for our test Mac, and we've tried removing and recreating it. We have a green orb alongside our Network Account Server in the Users & Groups pane of System Preferences. I’m trying this over wired ethernet as we haven’t yet conf

I know that this question isn't directly related to Casper, but does anyone know of a way to disable the internal speakers on a system via a script or managed setting in Casper? I've been getting complaints from students that the noise levels in the computer labs are getting out of hand, so I'm trying to find a solution that forces the use of headphones without causing me a lot of grief in the process.

Hi all I'm trying to create an Extension Attribute to report back the status of a Global LaunchAgent which is in /Library/LaunchAgents When run from the user context it reports back correctly but when run as root it does not, i've gone through most of the dicussions and tried adding in ls -l /dev/console | cut -d " " -f4 then sudo -u to the logged in user but my script fu is weak. Can any one advise how to make the script below run the launchctl list command as the logged in user as an extension attribute ? Cheers,Andy #!/bin/sh agentloaded=`launchctl list | grep local.keepAlive.ADPassMon | awk '{print $NF}'` if [ "${agentloaded}" == "local.keepAlive.ADPassMon" ]; then echo "<result>Loaded</result>" else echo "<result>not loaded or installed</result>" fi

I have infront of me an iMac that has 256 Apple flash storage, but I cannot for the life of me get Casper Imaging to partition the drive and install the dual boot image we have. Is there a problem with SSD's?

Is it possible to enroll a new laptop using DEP, and then (somehow) have that laptop become managed, without me touching the device? I was told to avoid imaging, so all of the packages I need to install will be done after the laptop becomes managed. Thanks

Hello all, I am looking to remove the to startup screens Chrome shows when a user first launches the application. The "set google chrome as your default browser" and "set auto updates to run". I just want the users to get a default web page when they start the app for the first time and not these two questions. I want to set the default to "no" and auto updates "yes". Thanks

I have been reading through the various threads on managing Lync settings and gotten a lot of great information. I have gotten the automation piece in place using the script from @talkingmoose and that has worked out great. However, some of the settings we are trying to enforce simply aren't working. Most likely because I am doing something insanely wrong. ;) Some of the settings we are specifically looking to enforce/disable are the Audio Call’s, Video Calls, Idle timer, and the Lync plugin setting. The goal is that once we set these, the end user will not be able to change these settings. I don't necessarily agree with some of these settings being enforced but it isn't my call. I have opened a case with MS so hopefully I will get some guidance on that front but thought I would check in here as well. I have some screenshots below on what we want to do.

Hi everyone, Do anyone of you know a quick method to replicate your JSS DB on to a Test JSS? Thanks, Henry

Hey guys,Looking to see if anyone has any idea on how to grab a particular item from the Spotlight plist file. We are able to set the Spotlight settings via configuration profile, but now i need to use a script to check to see if the value is being managed or not. Since they seem to be in a dict, this is the part i am having trouble with. if i check defaults read /Users/$loggeduser/Library/Preferences/com.apple.Spotlight, it spits out everything. I would like to grab only the values we are looking for, { enabled = 0; name = "MENU_WEBSEARCH"; } { enabled = 0; name = "MENU_SPOTLIGHT_SUGGESTIONS"; },Here is what i have so far: #!/bin/sh loggeduser=`ls -l /dev/console | cut -d " " -f4` SPOT=defaults read /Users/$loggeduser/Library/Preferences/com.apple.Spotlight | "grab X" if [ $SPOT == "0" ] then : else jamf policy -trigger spotlight_config fi Thanks for looking.

This is happening randomly with no pattern on our AD accounts after imaging. Issues: Keychain access shows that the login keychain isn't created for anyone until the second login. The tech has to log in twice for everyone to receive a login keychain afterwards. Basically, I log in the first time and have no login keychain. I log in a second time and then everything is fine. Base image has no issues whatsoever. It's when I start installing Adobe CC 2014/2015 (no FEU/FUT) during imaging via a policy that this issues arises. I've tested ten machines and four of them did not have a login keychain. I even created a Keychains folder in the user template using Composer and that didn't work. What would be causing this issue? Only our base image has FEU/FUT, the additional packages do not. Other people having the same issue: https://jamfnation.jamfsoftware.com/discussion.html?id=7662 https://jamfnation.jamfsoftware.com/discussion.html?id=7462