Hi All, When re-imaging a machine with a new OS (Mac OS 10.10.3), does it matter if the netboot image is a version lower (Mac OS 10.9.5) than the image being pushed out? I've re-imaged a machine using the method above and it was successful, the issue I'm having is that it only installed 2 applications that is included in the image configuration. Why would that be? Also, I was able to resolve this issue in the past by having the same version of Mac OS of the netboot image and the image being pushed out (as to why question #1) Thanks,

Hello JAMF! I've tired using this manifest as Managed Preferences (https://jamfnation.jamfsoftware.com/viewProductFile.html?id=73&fid=774), scoped it to my testing computers and Google Chrome will not recognize any of the changes. I've also tried the Master Preferences file so I could apply the settings during imaging and Chrome didn't recognize it as well. if [ ! -d "/Library/Google" ] then mkdir "/Library/Google" fi ( sudo cat <<'EOD' { "homepage" : "http://domain.com”, "homepage_is_newtabpage" : false, "browser" : { "show_home_button" : true, "check_default_browser" : true }, "bookmark_bar" : { "show_on_all_tabs" : false }, "distribution" : { "suppress_first_run_bubble": true, "show_welcome_page" : false, "skip_first_run_ui" : true, "import_history" : false

Hello All, We just completed our JumpStart and already running into an issue. The first phase of our implementation is to provide the Self Service to the users. I have different packages setup to installing using policies. Individually, the installation runs fine but when I run install policies back to back on the same machine the second policy fails with "Could not mount distribution point". When I restart the computer, the second policy runs fine. We are running Windows 2012 R2 servers and using AD service account as Read-only. The weird part is, when I setup my AD account to have the same permission as the read-only account to the CasperShare, I do not see the problem. Older discussion suggested to remove special characters from password because it conflict with MySQL storing the password but it's not the case. Any suggestions will be very helpful because I definitely do not want to use my AD account as the read-only account.

We currently use ESET Antivirus 6 for OS X, we have created the package via DMG and PKG everything installs apart from the login item for ESET. We have tried so many ways to get the ESET login but just can't to get it to work. Has anybody has experienced the same issue, or know of a fix? Many thanks David

Hi, I'd like to pre-populate the 'Favorite Servers' list found when doing - Finder > Go > Connect to server... with a few of our regularly accessed servers for each new user that logs on to a machine. I found a thread on here from back in 2008 about doing this, but I guess things have changed since then as I can't make it work for me. What's the best way of going about this? Many thanks!

Is anyone else having this issue? I have been testing using Casper Imaging to install OS X Yosemite in our test environment. It works without much issue if the host is already OS X 10.10, but seems to fail if it's 10.9? Not sure if it's something in our environment (we have LOTS of security tools in place) or if it's the actual Casper Imaging app not working.

Hi everyone! I hope you're well. I'm trying to write an AppleScript for migrating our users from one domain to another. I'm running into a problem though. I think it has to do with the space in our domain user group. Here's the part of my script that's failing: display dialog "Enter the username(Short Name) you want to migrate" default answer "" set shortName to text returned of result do shell script "dscl . delete /Users/" & shortName & "" with administrator privileges do shell script "chown -R " & shortName & ":DOMAIN\\Domain Users /Users/" & shortName & "" with administrator privileges display dialog "Don't forget to move the computer to the right OU" It's the part with DOMAINDomain Users. I've tried doing DOMAINDomain Users but I keep getting errors on that.

We are looking to blow away all printers via a Self Service policy so folks may re-download the proper printers that have been installed. Our students are not admins and i believe we do not allow them to delete printers via system preferences. Teachers are full admins but have rarely if ever have logged into a student computer to help elevate a permission. Anyone have ideas on how to accomplish this for a Self Service policy? We wish to get our clients helped out with cleaning up the old removed printers by deleting via a policy anyone may execute from Self Service. I have tried several scripts and unix commands at root from JSS but lpadmin almost always gives a "unauthorized" error in the JSS logs. I may run any of the scripts and unix commands locally and it just works! Stuck on the JSS deployment getting lpadmin "Unauthorized" errors!

im not new to anything here but i can't seem to get hand on that tool anywhere... i have all the installers but looks like all the path i am reading doesn't seems to be the good one.... anyone an easy solution to get the setregproptool Thanks

Office 2011 released 14.4.9 update a few days ago, my standalone office 2011 installer is 14.3.0, do I have to install all the updates released after 14.3 one by one? 14.4.114.4.214.4.3 Etc..... Up to 14.4.9 ? The requirements for 14.4.9 says. Office 14.1 If I directly install 14.4.9 from 14.3.0 what happens with the updates in between 14.3.0 thru 14.4.8 ? Are those updates applied?

So what I've been tasked with is preventing everybody but one specific department in our company from printing to a Splash RIP that belongs to the department in question. I already have the dept. set up in Casper as a department, I already have the printer in question set up as a printer in Casper. Installing it via casper works great, and as long as it was installed by casper, then removing it by casper via the unmap printer function works great too. The issue is that all these people from other departments added the splash rip to their Macs on their own. And this has been going on since before we had casper in house, so yes it's an organizational nightmare but the main problem is that since the casper unmap function uses the CUPS name, it can't unmap the printer unless the name is exactly what I specify when I set up the printer. For example, I set it up in casper as Studio Splash, but if somebody in some other dept added it to their own machine and called it Splash,

Hello all, My org is currently using PEAP rather than TLS for Macs to access our network. We've set it up so that JAMF is only accessible on our internal network. Because network access doesn't occur until AFTER login (since PEAP uses the user credentials), the login trigger in a policy never gets applied (since it doesn't connect to the network, and thus JAMF, until after login). A solution to this is to push out a configuration profile that has "Use as a Login Window configuration" network setting applied. This actually works really well. The user logs in, authenticates against the local network, and policy triggers get applied. The problem: after enabling FileVault 2, this bypasses the typical login window, and in turn bypasses the "Login Window configuration" setting. So the login trigger for policies again doesn't work. Aside from using TLS or some kind of machine based authentication, does anyone have suggestions for a way t

I just recently changed to using the NetSUS instead of Apple Servers for net booting. I have built a new image using AutoCasperNBI and I can successfully boot to it by holding ALT at startup and manually selecting from the available startup disks. What I can't do is see it in "System Preferences > Startup Disk" which is weird and if anyone has an idea what could be up, I would appreciate it as it breaks zero touch imaging.

I am using that 'unbindAD.sh' script provided on JAMFnation script sections. The policy trigger is set at 'STARTUP' and script priority 'AFTER' script is simply: echo "Unbinding the computer from Active Directory..."/usr/sbin/dsconfigad -r -u "$username" -p "$password" echo "Restarting Directory Services..."/usr/bin/killall DirectoryService is there a script somewhere to delete the 'domain account' after the unbind so users that are cached cannot login ?

At the start of our deployment we used Recon and scanned for machines on our numerous subnets and collected about 3/5th of the machines. They were all added using one of a number of possible local admin accounts, which became their management accounts. Now we're trying to get them all to use the same management account. My first thought was to push a new QuickAdd.pkg, with the management account we want on all the machines, to all the machines that don't have the account already. Easy enough, you'd think. Instead of the management account being hidden though, it's plainly visible with a UID in the 500's (whatever the next number was). Sigh. Any suggestions? Is this possibly a bug? Doing this is a bit unusual I'll agree.

my link text]([my link text)Hi AllWhich drive me crazyI using below script success to set the screensaver plist as i wantThe first time is success. BUT when i want to change the time of "start after" problem cameWhen i edit the script and apply, which is success to effect in plist but not in the screen saverWhen i open the screensaver the plist will reset to previousI am carzy. I try many way to kill the preferences cache but doesn't work!!!!!I am using OSX 10.10 curuser=ls -l /dev/console | cut -d " " -f 4 if [[ ioreg -rd1 -c IOPlatformExpertDevice | grep -i "UUID" | cut -c27-50 != "00000000-0000-1000-8000-" ]]; then macUUID=ioreg -rd1 -c IOPlatformExpertDevice | grep -i "UUID" | cut -c27-62 fi rm /Users/$curuser/Library/Preferences/com.apple.screensaver.$macUUID.plist rm /Users/$curuser/Library/Preferences/com.apple.ScreenSaverPhotoChooser.$macUUID.plist rm /Users/$curuser/Library/Preferences/com.apple.ScreenSaver.iLifeSlideShow

I am sure you saw that https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/Any ideas if updating to 10.10.3 is not an option?

I'm trying to figure out how I can call a script as one exits. I do not want to run the script inside of the other script. I want it to call the next one as it exits. I'm not sure if this can be done. Here is a better representation of it. First Script runsExits - Calls Second ScriptSecond Script runsexits - Calls Thirdetcetcetc

Anyone else seeing this after entering credentials to log into JAMF Nation? If I hit back and then refresh the discussion that I wanted to post in, I am logged in. Seeing this on 2 different computers on 2 different networks and 2 different browsers, so I don't think it's computer-specific. May be something wrong with my JAMF Nation account (cc @jake )

Since the upgrade from our 8.x environment to the 9.x JSS, we lost our MCX configurations for Chrome. Any attempt to re-import the .manifest has resulted in an error indicating "No settings were found." I've tried it from 3 different mac workstations, all running different OS flavors, and some managed some not. Different releases of Chrome, also. Any thoughts? external image link I am using the manifest located at: /Applications/Google Chrome.app/Contents/Resources/com.google.Chrome.manifest/Contents/Resources/com.google.Chrome.manifest

Having a little trouble populating the proxy fields under 10.9. When I check the script, everything looks ok but I'm not sure: networksetup -setautomaticproxyconfiguration http://xxxx-pac.company.com:81/company-proxy.pac I'd like for this to auto-populate, I've also created a policy for it. Thoughts?

We have installed basICColor color management software on all our Macs, and now there is a specific configuration file (.dcj) that we need to place into a User Settings folder. The folder path is ~/Documents/basICColor display 5/UserSettings . What I want is to make a package that simply drops that file into that folder for all user folders on a given Mac. I tried making the package in Composer by dragging the configuration file into the left sidebar under Sources, and building the package. I then placed the Package in Casper Admin, and made sure to turn on Fill Existing User directories. I then tested installing the pakage with Remote on my Mac and my coworkers Mac. It worked on mine but not his. What am I doing wrong here? I'm thinking that its something to do with how I am building the package, in that it worked for me since it knew the exact path to install to as it was built on my machine. Is there a simpler way to tell Casper "Take this file and put it here for ever

So I disabled root by changing the shell they log into. Works well, they can enable it all they want, but they can't login. The downside is that some of their developer apps that they use install and update via script that calls root. This is as designed by the vendor of the apps. Anybody have any suggestions how to keep them happy while addressing our security dept concerns of having it enabled?

I tried beacons with the example of JAMF's video (deploy Web Clip).I tried limitation/exclusion option, nothing works :- limitation : no Web Clip appears- exclusion : no Web Clip disappear Other question : why is it not possible to use Beacons to scope App deployment ?

Hello! I've looked at https://jamfnation.jamfsoftware.com/article.html?id=177 for information on how to scope Self-Service plugins but I haven't had any luck with getting Self Service to pick up a custom URL plug-in. It seems to completely ignore them and I'm not sure if I should even expect to be able to scope the URLs this way. Is this even a possibility? I've created a unique .plist file that has a unique ID and everything, but it doesn't show up in the Self Service sidebar. Thanks!