Hello JAMF, Testing out OS X Yosemite and wanted to set Safari Managed Preferences. It worked on 10.9.5 but not on 10.10.2 or 10.10.3. Local admin accounts:New windows open with: HomepageNew tabs open with: HomepageHomepage: doman.edu Network users:New windows open with: FavoritesNew tabs open with: FavoritesHomepage: domain.edu In the managed profile I have: com.apple.Safari NewWindowBehavior = 0com.apple.Safari NewTabBehavior = 0 0 = show home page Is this an issue with Yosemite? Edit: as an added bonus, this doesn't work in 10.10.3. Disable Saved State: Level at which to apply the preference. User-level-every-login com.apple.loginwindow TALLogoutSavesState = 0

some local users have home folders based on their netid. So now the computer will get AD BOUND, what is the best way to get these local accounts from local to managed mobile ? I deleted the account, leaving the home folderrenamed it mv /Users/bob (deleted) /Users/bobsudo chown -R bob:"domainDomain Users" /Users/bob now the user is managed mobile, BUT then also admin !! why is it getting set as admin? on one computer this worked fine, user was just managed mobile, then on another computer it also set the user as Admin

We've just upgraded to 9.65 (JSS on Linux) and now our AD binding no longer works, through script or policy. Anyone else seeing this?

Hi all Can anyone advise me how to create an extension attribute that will record the result of the command curl ifconfig.me Many thanksAndy

Okay, this is the first time creating a custom configuration profile so I want to be sure this is correct. I am trying to push a setting to disable the preview column in columns view. Here is what I have for a plist to upload. <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>StandardViewOptions</key> <dict> <key>ColumnViewOptions</key> <dict> <key>ColumnShowIcons</key> <false/> </dict> </dict> </dict> </plist> Can anyone confirm or deny if this is correct? I only want to push out the "ColumnShowIcons" key. Thanks,Josh

Just updated to Yosemite and the latest Office update, Office2011-1446Update_EN-US.dmg. After the update, Word crashes constantly. Anyone else seeing this behaviour? I'm not sure if this is only on Yosemite. At the time of the crash, I was logged on as an Active Directory non-privileged user. Exception: EXC_BAD_ACCESSApp: Microsoft WordVersion: 14.4.6.141106Crashed Module Name: CoreFoundationCrashed Module Version: 1151.16Crashed Module Offset: 0x0000779bBlame Module Name: MicrosoftMenuLibraryBlame Module Version: 14.4.6.141106 ...and so on. Cheers...

When a iMac is bound to AD should user accounts be 'Managed Mobile', like the user accounts on a AD bound MacBook pro or MacBook air?I know for the laptops it's so users can login when taking the laptop off the network to take home, not sure if iMacs accounts should just say 'Managed'.

Anyone else seeing the same? Using 8.73 & this is a Mac that has been upgraded.

I'm hoping to create a smart group of computers that need the recent Office 2011 for Mac update (v14.4.5). Requirements for the update are Office 2011 SP1 (v14.1.x) or higher. I've tried a few different approaches, including criteria of app title is "Microsoft Word.app", and app version not 14.4.5, and app version like 14%, and app version not like 14.0% but these four pieces together don't return any results. When I try a smart group on app title is "Microsoft Word.app" and app version like 14.0% I get all of the Office installs, even 14.1.x or higher. I must be doing something wrong in how I identify app versions. Thanks in advance!

I know this topic has been brought up many times, but I still have not found an ideal solution to our particular situation, so I wanted to get some input from you folks. I know it's not exactly a jamf issue but... We do not allow our users to set their own passwords. The reason for this is that we have multiple services our teachers and students use and we manage, and some of these use LDAP while others require us to set the password for the user. To keep things consistent and avoid daily "I forgot my password" situations, we control the passwords for all users. I realize this is not ideal from a security standpoint, but it is necessary for our situation. We change passwords for teachers once a year. As you all know, OS X displays a cryptic (to most users) dialog prompting them to update their keychain password after an AD password change. We do not want to panic our teachers, so right now we are thinking that we will try to communicate the steps they need to tak

I am trying to use a mobileconfig on my macs that have 10.0.2. The issue is that when I set the password policy allow simple or not allow simple and set a 15 character password along with expire times and repeatability. I apply the profile at the computer level and any local user I have prior to the install I can set the password according to the password restrictions. Any new local users I cannot set a correct password thusly no creation. If I remove the password restriction from the computer level config and implement the password restriction with a user level config for just the password. I get the message that the password was not changed as it did not meet complexity requirements. This is being done for testing by creating the Profile in JAMF and downloading it then applying the profile to a new OS build that has no other policies applied.

Maybe this is actually a feature request, but maybe there is a way to do this and I just don't know about it. When you run a policy it is real easy to look at the logs and see if it was unsuccessful on certain machines. If you have a configuration profile that you have scoped out to a number of machines it will show you in the dashboard exactly where it is at. It will say how many have completed, how many to go, and there often might be a red slice in that pie that says there were errors on 8 machines. On a policy you can easily find out what 8 machines the errors were on. For a configuration profile is there a way to figure out what machines the errors occurred on so you can go and correct the issue. Maybe there is an easy way and I'm just not seeing it.

Hello Nation! I'm very new to LaunchAgents and wanted to set one up. Currently I'm using a login script that works fine, but I want to move away from login scripts. What I want to happen: Launch a non-Apple app at login. I tried a configuration profile but as soon as I typed in .app, it would disappear. Here's my plist, I'm more than likely doing something wrong and would love if something guided me in the right direction!~~~~ <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key> <string>com.ntware.teststation5</string> <key>RunAtLoad</key> <true/> <key>ProgramArguments</key> <array> <string>/Applications/UniFLOW/MacClient.app</string> </a

I'm utterly stumped on this one. Push notifications work on enrolled devices INSIDE our firewall but not outside. So i'm in the middle of a replan and reimplement our JSS architecture. I've got a master JSS sitting inside the firewall. I've another restricted JSS sitting in the DMZ. There's a split DNS address that feeds both servers. You get the DMZ JSS if you're external to our network and vise versa. I've already made sure ports 2195, 2196 and 5223 are open on both servers to the *.push.apple.com DNS names. So i've got a test laptop with a valid current MDM profile. If it's inside our network on either ethernet or wifi and I push a lock command to it, within five minutes it's locking itself. Try the same thing outside our network and nothing. I even exposed the test laptop on my home router (and put it in it's own DMZ) and still nothing. What else should I be doing?

JAMF has an excellent article that covers how to deploy AAMEE generated PKG installers by wrapping them in DMGs and using a script to mount/install...JAMF deserves a ROCK-STAR awared for that!!! https://jamfnation.jamfsoftware.com/article.html?id=161 This works flawlessly when pushing via policy (not sure if HTTP is still an issue when using DMG?), and also Self Service works like a charm. So what about deploying these DMGs at imaging time? When I pull up the DMG in Casper Admin, I don't see a "run this script" option... So is it possible to deploy these AAMEE PKG installers that are wrapped in DMG during imaging time? Happy 4th of July! Applogies to the UK list members...LOL. Don

Has anyone been successful in implementing a configuration profile (or anything else that works) that fills in the Proxy settings information for ethernet connections, like Thunderbolt and USB? So far, I am having to manually enter this information into the image before I pull it with Casper.

I do a policy that will run script for user to shutdown/restart their laptop if the uptime is more than 7days.The script is like this: set question to display dialog "The machine has not been shut down or restarted for more than a week. Please shut down or restart the machine by clicking on Shut Down or Restart." with title "System Event by Andres Cheah, MCM" with icon stop buttons {"Shut Down", "Restart", "Cancel"}set answer to button returned of questionif answer is equal to "Shut Down" then tell application "System Events" shut down end tellend ifif answer is equal to "Restart" then tell application "System Events" restart end tellend ifif answer is equal to "Cancel" then returnend if I test in the machine it is working fine, but when i put into the policy; there an error below: Script exit code: 1Script result: 2013-09-23 10:15:47.576 osascript[

when i upload a .pkg .dmg .sh file to Casper Admin, who should be the owner of that file prior to uploading it? and what should be the permissions? so if i am logged in as a standard or administrator and create the file under this user, does it matter if this user uploads the file? do i have to chown root:wheel ./file ?do i have to chmod 744 ./file ?

Does anybody have any suggestions on how I can create a smart computer group based on enrollment date/time? What i am trying to do is have a smart group to look at newly imaged machines (within the last 24 hours) so our JSS can run a policy to add icons to the dock like Microsoft Outlook, Microsoft Lync. etc....

Does anyone have the most recent JAMF CCA course book or know how I can obtain a copy prior to attending the course?

Hello JAMF Nation! We created an SMB share hosted on Windows Server 2012 last week and temporally made it our master distribution point. I replicated our AFP share to SMB and it worked great for two days before Casper admin/Imaging (Netboot for imaging) started refusing to mount it. In Casper Admin, I have to log off my account and log back in for it to mount even though I'm not connected to any shares. We have four accounts plus a security group in AD that has access to smb://servername/CasperShare:1) casperadmin with RW2) casperinstall with RO.3) My Windows admin account with RW (only person in the security group)4) Our Windows Sysadmin's domain admin account I can easily mount/access smb://servername/CasperShare in OS X and Windows without a problem, Casper is the only thing having an issue with it. Does it matter that we have two other folders inside smb://servername? Example: smb://servername1/Folder1 | smb://servername1/Folder2 | smb://servername1/CasperShare T

I feel like I'm going crazy, so someone please correct me if I'm wrong, but these are the steps we've used since 10.9 came out for making Casper Imaging images:1. Obtain OS X installer from Apple2. Drag OS X installer to Casper Admin3. Let Admin do it's thing, then save the package as an OS X installer4. Create a new configuration with that ESD file, configure for admin account, etc on those tabs & add our hide recovery HD script and our custom preconfig script5. Compile For 10.9.2, 10.9.3, and 10.9.5 this worked perfectly. 10.10 comes out and I follow the exact same steps - seems fine. Go to enable FileVault and there's no Recovery HD. So I ran it over and over and over - one out of five times, it created a Recovery HD. I know I can use another program to create my own image with Recovery HD, but I'm just curios if I'm going crazy or if other people are seeing this same result?

So I have 105 new macbook pro's I am setting up. I pulled one out of the box. Set it up with apps,binding,printers,settings etc. I then target booted it to my imac and launched composer. I then created a new base image and captured the macbook hard drive. I then loaded it to casper admin. Categorized it as a Base Image with a priority of 1. At this point all should be ready. I opened a second machine never booted and did a netboot to Casper. Chose the base image I made and chose to erase the current HD. The process goes through but after reboot I get a circle with a line through it. I was able to 'fix' this by going to internet recovery and running disk utility. I then ran a permission repair and a disk repair and reboot. It then restarted to my working image. Where did I mess up?

As a new institution to the JAMF Casper Suite I would like to enable machine log on through wireless to Macs that are bound to the domain. The goal is to try to mirror the wireless log on that is achieved on the Windows side by specifying through Group Policy the secure hidden wireless network (WPA2 Enterprise PEAP (MSCHAPv2)).So far I have configured a payload that specifies the Network settings that includes:• SSID• Hidden Network• Automatically Connect• No Proxy• Security Type• Use as a Login Window Configuration• Protocols o Accepted EAP Type is set to PEAP o Use Directory Authentication• Under Trust Allow Trust Exceptions is checked but nothing else is specified here Just this configuration alone displays an option on the log on screen to select the WiFi SSID specified or “None”. I can see that the wireless icon lights up for a moment then the log on fails. I have attempted to configure the AD Certificate without any luck the configuration profile fail

Hey all, so we recently moved away from a pair of Reposado servers to point our clients back out to Apple for their Software Update needs. I have a client that is stuck with the old setting and I can't get it to check Apple SUS. So the preferences for the SUS settings were being set by Managed Preferences. I removed the MCX, then ran a script that deleted the /Library/Managed Preferences/ directory and called jamf -mcx to rebuild another others that might be needed (none are being used now) I've run the jamf removeSWUSettings command and the softwareupdate --clear-catalog commands and still when I check for Software Updates it tries to connect to the local reposado server (which doesn't exist anymore.) From what I can tell this is working just fine on most computers, but a few are being stubborn. Any help or fresh ideas are welcome.