Is it possible to create a policy that executes a script when a target machine is removed from a Static Computer Group? For example: I have scoped a policy to install Firefox on any machine placed in a Static Computer Group called "Firefox". However I would like to execute a Script to remove Firefox from that machine in the event that it's ever removed from that group.

Thought I'd share this for anyone who might find it useful. We have users whose FileVault2-encrypted Macs are backed up with Time Machine to un-encrypted external hard drives. This kind of destroys the point of securing the data on the internal drive, so we're changing our policies to require the external drives to be encrypted. As such I've been working on a way to encrypt the drive and add the password to the user's keychain so that they are not prompted to unlock the drive when it is connected. Eventually I'll work this into Self Service and prompt the user to provide a password. Here's what I have for now: #!/bin/bash #Encrypt Time Machine drive mountPath=`tmutil destinationinfo | grep "Mount Point" | awk -F ": " '{print $2}'` if [ "$mountPath" = "" ] then #Drive not mounted exit 1 fi diskutil cs convert "$mountPath" -passphrase "$PASSWORD" #Add password to u

Hi, Running a diskless net boot image 10.9.2 . For some reason when it gets to the block copy of our image (10.9.2) it happens too quickly, just goes through instantly. Anyone seen a similar issue to this?

I can see where to search for it in an Advanced Search, but how do I just display that info? Didn't see a choice in Inventory Display. I'm running 9.3. Thanks!Brian

Annoying not having the ability to cancel uploading or indexing process.I had to force quit Casper Admin last week while uploading a small package that hang casper admin to respond to anything. After I relaunched the casper admin and tried to upload again it says it has the package and need to replace it I click replace, it doesn't even take a second to replace but is it replacing it???? I don't think so the package still on the share even if i try to remove it from the share it says it is being used by other application and can't delete. Deleted from the Casper Admin won't remove it from the share for some reasons.I had to rename the package to be able to upload the package again but the old faulty record still on the share.any suggestion would be appreciated.

I'm not super familiar with how config profiles work. Do they layer on top of each other, or does each config profile need to include the settings from the other? For Instance - if I want a config profile to restrict the app store, I create one. Then on a another config profile I restrict certain preference panes. do they stack, or do I need to replicate the preference panes?

Is it possible to use an App Lock setting in a Configuration Profile for an iOS device to lock it to Safari? What application Bundle ID should we use? We tried "com.apple.Safari" but that did not seem to work.

I'm new to scripting the MAC OS and looking for some help to gather version info from a plist file. My goal is to create an extension attribute that will use a bash script to tell me if clients have MozyEnterprise installed. Mozy doesn't seem to install in the typical app directory but installs itself as a system preference. The location to the plist file is /Library/Preferencepanes/MozyEnterprise.prefPane/Contents/info.plist. Within this plist file there is a key named "Get Info string" which is a string type that has a value of "MozyEnterprise 2.13.0 ©2006-2012 Mozy" the version number I'm trying to extract and setup. Thanks for any help anyone can provide.

Hi everyone, we used to create a logout *.sh script to execute at user logout. This script deletes all user accounts with a number in their profile since our students all have that. Now I'd like to implement the same in Casper and already enabled login/logout hooks. Also I created the script but I can not find where/how to attach the script to execute on a machine. *Deleted unnecessary info*

Hi guys In Mavericks with a cinema display attached there is an options tab in the display preferences there is an option tab. In order to make a change you have to unlock the padlock, but users don't have admin rights. Doesn't anyone know if it is possible to script the option to "Pressing the displays power turn the display on and off"? Thanks Tim

We have a New Mac Pro that will host our JSS and run Netinstall. When we set our current production server up last year we weren't using a DNS name in the JSS URL. I know, what were we thinking? I got all of my Mac devices point ed to the DNS name (https://your.jss.name.com:8443) rather that the server name (https://server1.xxx.xxx:8443. I created a policy for the Computers (/usr/sbin/jamf createConf -server your.jss.xxx.xxx), tested and that piece is good but I'm concerned about the iOS devices. I was told by my support rep that all the iOS devices have to be re-enrolled. Of course, not thrilled about that since I need to get this new Pro in production ASAP. Just wondering if anyone has some tricks up their sleeve on this one?

I've been working on 2 separate Configuration Profiles a User based one and a Computer based one. The first time I login to the freshly imaged machine the User Config. Profile is installed and can be seen in the Profiles Preference Pane. The Computer Config. Profile is not being deployed though. Currently I have to go into the Computer Config. Profile, Save it and "Distribute to All". Is this a bug?

Has anyone else noticed that the 9.31 JDS Linux installer gets stuck at 'creating JDS directory structure'? # ./JDS-Linux-Installer-9.31.run Verifying archive integrity... All good.Uncompressing JDS Installer..........Starting the JDS InstallationChecking installation requirements...Checking for a supported Linux OS...Red Hat Enterprise Linux Server 6.4 foundChecking for a 64-bit OS...OKPassed all requirements checking!Creating JDS directory structure

What's up JAMF Nation?? Okay tell me I'm making this too complicated, and you all have a really easy fix for me here.. Problem: If I'm using Casper Imaging from an external disk and imaging machine, I can't enroll it into our JSS (because the machine is not connected to our network). What I need: Is there a way to run our QuickAdd silently after the machine is booted to our network (When the JSS is available)? I'll be running this from our temporary 'deployment account' which is an admin. At the end of the deployment process I'll run a recon -endUsername $USER, to be sure it's assigned to the correct user. Though I don't want the tech to have to click 'next' 'next' 'next'. Okay.. now gimme your super easy solution that I'm over looking! ThanksBill

Is there a way to disable students from changing the wallpaper on the iPads? I looked in the configuration profile on casper but I don't see a setting anywhere. Thanks

I've see a couple of things related to this with, white list and black list for folders. I work at a school and for next year i would like to make it so that if a kid downloads a .dmg they cant mount it and run the .app from the mounted .dmg. Any thoughts Thanks

Hey all:We are on an 802.1x network and pretty soon our client certificates are expiring and we need to cut over to new ones. I am trying to accomplish the cutover without any interruption to service. GlobalSign is our certificate authority. Our systems have a globalsign Root CA certificate and what I would like to do is set that cert to be explicitly trusted for all users so that when we cut over (now and in the future as these certs expire every year) they don't have to accept client certificates. I have not found a great way to do this: first thing I tried: On one machine, I marked the certificate as explicetly trusted within Keychain access then export the cert into a file. Created a config profile in the JSS and uploaded the cert then scoped the policy to a machine. Still get prompts second thing i tried: Exported the cert like I did above but attempting to import it via the Security command line and telling it to be trusted (but just get an error reading file) Anyone ha

Hi There, New to Casper. As more and more apps are released via the app store, it feels less obvious how best to deploy applications like Keynote 6 and iPhoto 9.5 via Casper. Has anyone been able to successfully package these two apps? Should one just run composer while the App Store installs these on a system?

Searched around a bit but no luck finding my solution yet. I want to reduce my footprint in the JSS for the amount of space my packages are taking up as I prepare to add a distribution point with Amazon AWS. Packages folder is nearly 77 GB. I deleted a bunch of un-needed packages from Casper Admin, save and replicate, all looks good in CA. I go to the Packages folder in the CasperShare and the packages are all there and the size is still 77 GB. What gives?

I'd like to create a smart group/smart search with criteria to find non-SSD systems. I could add computer model of "Air" or "Retina" but this would miss Mac Mini and iMac systems. I see in Computer > Storage > Model "Apple SSD XXX" listed, but I can't figure out how to search on this criteria. Storage model, drive model, disk type, etc. don't show in the All Criteria area. Anyone got an idea?

Is anybody doing this? If not, how are you getting around it (that is, backing up your database on a schedule)? I'm hitting a wall trying to access the db utility on a headless Linux server. I think it boils down to trying to X11 & sudo-ing the java command.

Hi Everyone, We are getting ready to roll out casper here to our new users, but aren't going to re-image existing machines. I'm scoping policies in such a way that software will get installed if it needs to and have pretty much got the hang of that. I'm also going to be using docutil to make a standardized user dock. However, I'd only like that to be pushed out to new users on a machine, leaving existing user docks (that they probably have already customized) untouched. I can think of a hackish way of doing this by pushing out a hidden marker file that goes out to all current user folders right now and then having my dock script die if it finds that file. Is there a better way to do that? It would be really awesome if there was a policy trigger for first user login that I am just missing...

Hello all, We have multiple users with multiple mobile devices. However, we have one user with 2 (iphone/iPad) mobile devices which will only allow us to assign a single mobile device to a department. If we assign their iPhone to a department, it will remove the department from their iPad and vice versa. Like I said before, we have many users with multiple devices and they don't seem to get this issue. I've tried re-enrolling both the devices to jamf but it doesn't help. I'm a bit suck on what may be causing this. Any help will be greatly appreciated.

I'm running 8.73 and didn't notice any export button but is there a way to export a config profile from one created on the JSS? I'd rather not recreate it in apple configurator if at all possible :)

Already asked Rich T about this on twitter, but I thought I'd post here as well . . .I'm working on enabling filevault using the fdesetup command and a plist with a certificate embedded to create an institutional recovery key.Normally when using an institutional recovery key, you start by creating a keychain in keychain access. During that process, you set the password on the FV2 master keychain, which then is supplied at the command line when the recovery key is used to decrypt the disk.When using a plist with fdesetup, fdesetup creates the keychain from the embedded certificate in the plist. Since I didn't create the keychain, I don't know what password to use to unlock it. Anyone know what password is assigned to the FV2 master keychain when it's created by fdesetup?