When checking Inventory, under 'local user accounts' I see some of the inventoried iMacs/MBPros/MBAirs displaying both the 'LOCAL USER ACCOUNTS' & 'HIDDEN LOCAL USER ACCOUNTS' so under the local user accounts it will have a total around 80. While on other iMacs/MBPros/MBAirs it is just displaying the 'LOCAL USER ACCOUNTS' only for a total of around 4 (whatever the computer has). Has anyone else seen this?computers are all getting enrolled the same way, quick add.pkghow would i get those 'HIDDEN LOCAL USER ACCOUNTS' not to display in the inventory? it doesn't seem to be a big deal, but I don't like the inconsistency. thanks

Hey folks! I'm looking for a way to easily determine if a software update package from Apple requires a restart. Since I always have a battle with my users to get them to restart and run updates, I'd like to start forcing updates of items that don't require a restart. So, any ideas short of writing my own SQL query? Thanks! Steve

Dear all, As title, can jss send a command wipe the device data and then automatically re-enroll?

It appears Apple no longer offers Xcode through their dev site, when you go to download it, it links back to the MAS. Are we back to the old method of putting MAS in Debug mode?

Hey guys, I'm a bit stuck at this place. I need to make the preference pane Date & Time available for everyone without admin privileges. I know that this has to be done with the authorization DB. I found the respective key here: system.preferences.datetime http://www.dssw.co.uk/reference/authorization-rights/index.html Regardless what I changed in the authorization, I didn't get this working. Does anyone have had a similar problem and / or knows how to deal with the permissions in the authorization DB? This isn't very well documented from Apple. These are the links I found but unfortunately didn't help me in any case... https://www.afp548.com/2013/10/22/modifying-the-os-x-mavericks-authorization-database/https://derflounder.wordpress.com/2014/02/16/managing-the-authorization-database-in-os-x-mavericks/ Thanks,Michael

Ok, I've seen a few posts on aspects of this but I'd like to get some feedback from JAMFNation on how they deal with the following requirement. We are working on a 10.8 deployment for a development project. All of the developers will be using Xcode, Ruby on Rails, Java, Python, MySQL and other tools. Our security team has a number of requirements, the primary 2 being "no local admin rights" and "restrict ALL software installs to Self Service". So we have a logon script that adds the console user to the _developer group by default. But we keep running into elevation problems. For example, the first time you launch Xcode and create a new project or install the SDKs, you need admin rights to continue. Other examples are Ability to stop/start MySql, change network settings (toggle proxy and modify proxy bypass mostly) and more. I've spent the last couple of days working on understanding the syntax for the sudoers file but have come to realize th

Hi Guys, Is anyone else experiencing these issues with mounts through Self Service with the Open command. None of our shares are mounting.

The Apple Configurator 1.7.1 is giving error that it couldn't allocate resource while trying to Supervise the iPad.

Hey all, I work in a small school district & I'm working on our new images (10.7 for WhiMacs & 10.10 for all of the aluminum models) for deployment this summer. I was hoping to start using configuration profiles a little more heavily. We tried doing this last year and couldn't get it to work, but I could've sworn I saw something in one of the previous JSS version release notes that said they'd fixed scoping to local users... We've just recently upgraded our JSS to 9.62. So, here's the dealio. Our image has 3 local users (student, teacher & hidden admin). I'm mostly concerned with the student account. Specifically, I want to be able to "lock down" both the student dock & desktop background (and a few other things). The problem is, I also am not allowed to lock down these items for the teacher user, so I need to scope only to the student user. We have (in previous years), set the "system immutable" flag on t

Anyone have an extension attribute or something that can tell if the security patch that was applied yesterday to fix the FREAK vulnerability has been applied or not?

Hi,I'am using JSS 9.31. I'd like to send an VPP invitation. When the user got the email he has to login with an user account and an password. From where do I get the information which user account or which password has to be filled in.The user has the name testuser. The Invitation form of the JSS comes in via email with this username. S.b. told me to fill in the account data of the apple id the user of this ipad usually uses. This doesn't work.Knows anybody help?

I have a mid 2010 Macbook Pro OS X 10.9.5 that is encrypted with FV2 and has a bad video board (no display or external monitor). Can I swap out the encrypted HD with a simialr "Good" MBP and then access that drive from the new computer? Or does it need to be decrypted in the original MBP first? I get the feeling that pre-boot is tied to EFI and some interaction with the recovery drive. If cannot swap the drive then access in good hardware, could I do this in Target Disk Mode? I do not have it in my hands yet. Any advice would be very helpful. Thanks in advance.

Does anyone know of a good place I can download 10.7 - 10.9 so I can use them for testing? Thanks! SHawn

Is there a way if I mount the drive on my NetBoot Xserve, to add a plist file specifying the Dock items seen when Macs are NetBooted? Since I can update the Casper Imaging App version by doing the same thing, I was wondering if it was possible to do it for the Dock itself. Thanks! Mike

Hi folks, Looking for some guidance on this. Here's my script that runs at every check-in, once a day. button=$(/Library/Application Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper -windowType hud -title "fun stuff" -icon /Library/Scripts/Adobe-IT.png -iconSize 225 -heading "Fun stuff" -description "Really cool things inside. Click continue to find out or Opt-out to not receive this anymore." -button1 "Continue" -defaultButton "1" -button2 "Opt-out") if [ "$button" == "2" ]; then open -n /Applications/Safari.app "http://www.google.com" echo "optout" elif [ "$button" == "0" ]; then open -n /Applications/Self Service.app echo "selfservice" fi It's a jamfhelper window with a couple buttons to do the following actions: if Continue clicked --> open Self serviceif Opt-out clicked --> open safari and the URL Wh

I feel like this one is probably super easy. I feel like I'm over thinking this and it's super simple but it's not working the way I would do it normally. Office for Mac Beta came out today, I'm sure you all know. I need to not allow my user base to download and install it, since...for whatever reason, these people like to go rogue and do whatever they want. Anyway, I've used the JSS' restricted software rule for a lot of things, but for whatever reason, I can't stop this one. I tried looking for the specific process name, but it seems to only open with the Installer application process. Am I missing something? Am I on crazy pills?

We are using Configuration Profiles to manage our Mac OS X student systems. We use the restrictions to restrict which applications the students have access to. I've had to add a couple applications to the approved list and I save the profile and say Distribute to All Computers. I had a few teachers say their students don't have access to the new software so I decided to check their machines in the JSS and under the Management tab under the Failed Commands area it says "Profile with the Identifier 'xxxxx-xxxx-xxxxx' not found. <MDMClientError:89>" I recently upgraded to Casper 9.62 from 9.32 and moved from a Xserve to a Mac Pro 2013. I thought maybe after the upgrade something got screwed up with the configuration profiles that were already created so I created a new one that I could test this out on and it came up with the same error after I had made changes to it. I've recreated the certificates because it is a new server. I'm not

We have around 70 1st generation iPads and would like to install the Self Service App onto these devices, tried installing via the App store and it requires iOS 7 or greater. Is there a way we can install the older Self Service app? Thanks in advance David

Hello, thank you for taking the time to read my post. I have a bunch of MacBook Airs running Mavericks and over time the hard drives become so full they are unusable due to the /private/var/folders/ being 65GB+ in size. Currently in Casper we have a pkg that installs a LaunchDaemon and script that should remove the contents of the p/v/f but it's not working as good as I'd like it to work. One thing I've noticed lately is when I remove the p/v/f i'll watch it grow from 0KB to 8GB in a matter of 2 minutes. Once I run a script to remove all accounts on the computer it stops growing. I have attached two photos, one of the LaunchDaemon plist file and script that removes the p/v/f. I was wondering if anyone had this same issue and could provide some insight on how you solved it. I'd really appreciate the help. LaunchDaemonexternal image link Scriptexternal image link Thanks in advance.

I'm trying to work out a way to script / configuration profile the login to our corporate WiFi. Normally we'd just use the details from the login window. However, we authenticate with the domainuser.name which throws me off a bit. Anyone had any luck getting this working?

HI all, We need to disable the pop-up blocker in Safaris for a new financial system to work.. any ideas how to do this? I can't see any options for managing the pop-up blocker in the safari plists & composer has captured nothing. Grey Communications Group LimitedRegistered No. 1795794, Registered in EnglandRegistered Office The Johnson Building, 77 Hatton Garden, London, EC1N 8JS VAT Number GB 404 6245 78 For Corporate Privacy policy please go to http://www.grey.co.uk/privacypolicy/

Since the beginning of the year, we have implemented a Global (formerly called system-wide) proxy via a Casper config profile to our 1 to 1 iPads to provide the necessary government-mandated content filtering for students in K-12. The proxy works well in terms of app and content filtering, but now that we are rolling it out more widely, I am noticing something that is making my job a bit more troublesome. All the devices are reporting the address of our proxy server as their IP address in inventory. When I think about it, that likely makes sense, but I need to see the real device IP addresses and not the proxy IP. Is there any kind of config I can do on the JSS (or Tomcat or MySQL) to help me get the actual IP address of the device? We are using Casper 9.65 running on Windows Server 2008R2. We use LightSpeed as our content filter. Thank anyone for advice in advance,blackholemac

We going to be deploying iPads and will be creating a unique apple ID for each iPad. (used for VPP)Since these iPads are used by more than one person we would also like to create a Unique user account in JAMF that is not tied to LDAP for each iPad.Im not sure if I am missing something but I do not see an option in JAMF to add a User account, only JSS User Accounts.

Hi Jamf peeps, Has anyone got the SEP extension attribute working with the new version of SEP (12.1.4013) and JSS 9.63 or above? When I load the extension attribute into the inventory display no machines load, it just sits on a loading beachball. I have tried one or 2 other scripts but none seem to be reliable, some machines report correct and the majority do not although the beach balling stops. Anyone have a script or something I could try or maybe a few pointers?

With the current lack of categories for smart/static groups, I just wanted to see how others were organizing their groups in the JSS? Our list of smart/static groups has been rapidly increasing and we are finding that we have a lot of duplicate groups created by multiple admins. I would really love to clean this up and thought I would see what everyone else is doing to combat this. If you haven't already please vote for this feature submitted almost 2 years ago by @leadtrombone https://jamfnation.jamfsoftware.com/featureRequest.html?id=1144