Just curious on schools that are 1:1 - do you set your users as local admins so they have full control of their machines? Or do you restrict all software installation to items in Self Service? If you restrict admin, do you ever run into issues with users not able to add printers or anything? Thanks!

We have 1573 ipads in our school district. Over the last 4 years we have been using the totally unsupported, "Shared-Apple ID across many ipads" deployment method. After briefing most of my schools on the DEP, Managed VPP and Under-13 Apple ID programs; they all told me the same thing:"Unless someone tells me we have to move to these new programs, I'm not going to spend the time. What we are doing works for us."Or "I don't see any benefits to these programs considering the time we would have to put in to move us into them." I'm fine with it. But I'm wondering if others have come to similar conclusions or if I'm missing a good, persuasive point in favor of the 3 new programs?

Hey all, I am working on an after hours project in which I am trying to pull a password from Keychain. The command I am using is: security find-generic-password -wl "com.squirrels.Reflector-2" While this command does give back the correct data when run as a user and via Policy, it displays a message to the end user asking them to allow the lookup. The exact message is: While this is not the worst thing in the world (doesn't require admin authentication for the end user), I would like to remove it if possible from showing up. Anyone know of a way to suppress, accept, or add Terminal temporarily to the Access Control so that end users don't see this? Thanks!Kyle

I've been toying around with AutoPkgr lately to see if it would be a good fit. What I'm working on now is overrides to make it fit our needs. One of our needs is the ability to assign policies and groups to an existing site. Our organization is potentially large enough that we'll end up with multiple sites each with their own testing set up and builds, so to keep things nicely organized it'd be best to auto-assign things to the appropriate site. AutoPkgr works fine if no site is specified, but fails immediately if it's assigning to a pre-existing group that has a site or if you attempt to specify a site in an override file. Does anyone know of a way to add sites into the override files that works?

I was wondering if anyone has had any experience deploying the Pharos Popup client and Pharos Mapped printers through Casper Policies? I remember a gentleman in my CCA class stating that they did this at the university he works at, but he didn't go in to any detail as to how they accomplished it. Any assistance would be greatly appreciated.

I wrote a script and uploaded it onto casper admin. I want to make some changes to it, but I can't seem to find it on my local machine that I created it on. For packages in Casper Admin, I can reveal in finder. How do I find out the location of the script I saved?

I have a configuration (standard with smart) , I would like to have the computers that run this Smart config to also be put into a static group automatically. Is there a way or a script that can do this automatically ? to avoid having me to manually go into the JSS after each computer has been enrolled and add them to this static group.

We have usernames populated using "jamf recon -endUsername $user" on many machines. Is there a way to use the -endUsername option to clear the username record?

My company is increasing travel back and forth to China. I've read a lot about the PRC deploying spyware to machines. How are you mitigating this when the laptop returns to your office? I know we're not the only company dealing with this and any advice is welcome! Up to this point, we've been wiping the machine when it returns to our office (before putting it on our network). Thanks!

When is it best to activate FileVault2? And has anyone run into the issue of your primary admin account repeatedly surfacing first as a single login window before the system displays the username and password field? We do have a script in place that "disables automatic login," so that's not the problem. It's only after we reboot the machine that the username and password field appears, but if we reboot again the "list of users" icon re-appears with just the password field. Bizarre! Thanks in advance for any thoughts and/or tips to resolve this.

I'm looking to change the "require password" from Yosemite's default of 5 minutes, to immediately. Currently, some configuration profile or MDM profile is causing the option to be greyed out and I can't figure out what it is. Also, what is the difference between configuration profile and MDM profile? I understand that a MDM profile gets pushed when I enroll a machine into Casper -- is the MDM profile and configuration profile the same? We have one configuration profile set, which locks down some settings in system preferences. I've tried checking the require password immediately with no luck, and also tried to manually edit my own plist to set it to 5 seconds and uploaded the plist file in custom settings with no luck.

i've created an EA script that reports the size of /private/var/folders. I'm seeing, on some lab stations, this directory is getting up to as much as 67GB. Most of the office Macs are under 2GB, which still seems high to me. As i understand it, /private/var/folders/ is like some kind of icon cache. And the more users that login, the bigger it gets. How are others dealing with this? I'm thinking of scripting the removal of this folder on a regular basis.

Has anyone encounter the issue with 10.9 reporting/showing incorrect disk space remaining? Background--Early 2014 Macbook Air 11" 128GB HD. Shared student device. Students were logging in and chewing up the storage space. Found a script that runs at login to delete any non local accounts older then 7 days. Issue that I'm having is, storage space is being reported incorrect. I have checked on the laptop (hidden and non hidden folders) and there is no way that it would add up to around 100GB of data.

Can I pre-enroll iMacs, add these per-enrolled iMacs to a static group? if so how ? I have a policy that I want to run that is 'triggered' by 'enrollment', the 'scope' for this policy will be this static group? (the policy installs a network printer)

I have recently started looking at Recon and I just wanted to make sure I understood what I was looking at. It looks like Recon is just used for remote enrollment. In order to use Recon for this the target computer needs to have SSH enabled and you need to know a local admin username and password. Am I missing something?

In casper admin I have a lab configuration, how can I get the 10 lab iMacs to have the configuration run on them at the same time?I have no NetBoot available.I have a usb stick with OS X and casper imaging on it, for configuration to be run on one computer at a time, but want to speed this up and do multiple at a time.

Hello, I made a new JSS and made my URL https://jss.company.com:8443 when prompted. That doesn't work, the only way I can access my JSS is through https://127.0.0.1:8443. How can I properly create my URL?

will i be able to use the xerox print driver 3.50.0.pkg pulled from the downloaded .dmg? I just put the .pkg in the base configuration. Here is what happens when I run the .pkg straight up from a mac. I want to see how the .pkg runs/acts/behaves prior to using it in my configuration, so I run the driver .pkg (just like any normal at home mac user would) on a test mac, it goes through the installation steps and then stops at 'SELECT A PRINTER' waiting for me to either choose any discovered printers, type in ip/dns of printer or just click 'continue'. At this point the printer installation stops until i choose, so I choose 'continue'. After I choose 'continue' a popup informing me that 'print queue not created' appears, I click 'continue' again and the installation was successful. I am concerned that due to this step 'select a printer' I will not be able to use this xerox 3.50 driver, is this correct?

I'm in the process of completing Casper installs on Windows Distribution Point VM servers. The present issue I'm facing is when attempting to import the Casper mysql databases on the Hong Kong and Bangalore Vms. I was able to open the JSSDatabaseUtility.jar file on the Berlin server and import the databases. On Hong Kong and Bangalore VMs I receive the following the error:"The JSS Database Utility needs to be executed with SuperUser Privileges. On Window run the JSS Database Utility as Administrator or with UAC disabled." Any hints on how to get around this problem ? Thank you.

I need to update the building names for all of my remote Macs and if I go in and edit them via the "Action" button in the search, they stay, but then at next checkin, they're reverted back to what they were before. My LDAP servers are configured and work correctly, the machines were recon'd using the username that I'm performing the lookup on now. Inventory collection does perform an LDAP lookup. I can't seem to find out why this is happening and would love a second brain to help me out!

Hi Folks, I'm still new to Casper Suite after using Mike Bombich's netrestore for years and more recently, Deploy Studio. I've been testing image with Casper on a fairly basic image that consists of OS X 10.9.5 as created by AutoDMG with a few scripts and so forth.Looking at the screen shot (above), it appears the scripts are being executed before the hard drive is erased. I can't see how that would work at all. Do I have to do something clever to get the scripts to execute on reboot? I am using Casper 9.72. I see another choice is 'after'. Does that mean after all other tasks during imaging? Thanks.

So I'm working on a development/test server with the following conditions in place: Casper 9.72 Enrollment by URL is enabled. My university is enrolled in DEP program with Apple (deploy.apple.com). An account has been created with access. Devices are enrolled in DEP for testing (4 iPads). The JSS has been linked to DEP, with the proper token and public key. And the test iPads that are enrolled in DEP are showing up at both Apple's site and in the JSS The issue I'm coming across is I'm not seeing any enrollment request when I turn on the devices and try to configure them from scratch. The devices were previously supervised in Apple Configurator, but they were removed from supervision in Configurator so they are no longer supervised by that system - this was done before adding their serial numbers with Apple DEP. OTA enrollment by direct URL is working. I've read both Apple's and Casper's DEP documentation and I feel like I'm missing something, but not sure what. The only thing

I'm looking to create a policy to update old version's of Casper to 14.4.9. I've downloaded the .dmg from Microsoft's site and set a policy to push the update to anyone that does not have 14.4.9. Logs say the installation fails, but it appears that it is literally copying the DMG onto the root of their hard drive, and not installing the .dmg. Any ideas?

I just got our first iBeacon and was trying to deploy a simple webclip using the limitations scope as was described in the What's new video. But every time the mobile configuration policy is deployed, it is again immediately removed. Anyone else able to use iBeacons in their environment yet? Any ideas for troubleshooting steps?

On Saturday we upgraded our JSS & JDS instances from 9.65 to 9.72. All went well until we realized today that our SUS webadmin page was not accessible. Our JDS instances also have NetSUS installed - purely for the SUS component. This issue appears to be limited to the webadmin portal itself. Computers are still able to check and retrieve updates. In other words - /srv/SUS is being served correctly but /var/www/html/webadmin is not. httpd/error_log says [Tue Apr 28 14:44:09.526819 2015] [autoindex:error] [pid 3258] [client xxxx] AH01276: Cannot serve directory /srv/SUS/html/: No matching DirectoryIndex (index.html,index.php) found, and server-generated directory index forbidden by Options directive My initial theory was httpd.conf had been modified during the JDS upgrade and the appropriate configuration is missing. I've rerun the NetSUS installer but the issue persists. Anyone know what could be missing? Did something change with JDS 9.72 which would prevent webadmin fr