JAMF deployment user missing default dock

If you manage a fleet of Macs using Jamf Pro, you’ve likely run into this baffling enrollment glitch: A user completes Automated Device Enrollment (ADE), logs in for the first time, and looks down to find a completely barren Dock. No Safari, no Launchpad, no System Settings—just the Finder and the Trash icons.

Why Does This Happen?

This "stripped-down" Dock state happens because of a race condition during enrollment. When Jamf pushes a Dock payload before the macOS user template has fully initialized the desktop environment, the macOS Dock agent (com.apple.dock) panics. Unable to find application paths that are still installing in the background, macOS defaults to the absolute bare minimum configuration required to operate: Finder and Trash.

The Quick Fix: Reset the Dock Domain

You don't need to wipe or re-enroll the machine. If you are sitting at the affected Mac, you can bypass complex file paths by targeting the preference domain directly via the Terminal:

1. On the target Mac, open the Terminal application.
2. Type or paste the following exact command line:

defaults delete com.apple.dock; killall Dock

What this command does:

• defaults delete com.apple.dock: Targets the current user's cached preference domain and obliterates the broken layout data without throwing "file not found" errors.
• killall Dock: Forcefully restarts the Dock process. When it respawns, it pulls the fresh deployment layout dynamically assigned by your Jamf framework.

Preventing This Globally:

To stop this from happening to future enrollments, avoid using Jamf Policies triggered on "Enrollment Complete" to manage Dock items. Instead, deploy your Dock setup using an MDM Configuration Profile. Configuration profiles hook natively into Apple's management framework at a deeper level and are significantly less prone to timing bugs during first login.

Fix Core Isolation Turned off on Windows 11

 For instance old driver for WD (wdcsam64_prewin8.sys):

1. windows start type CMD and right-click on it to run as an administrator
2. type dism /online /get-drivers /format:table
3. Find wdcsam64_prewin8.sys and note the Publisher name.
4. enter this command with the publisher name:
   pnputil /delete-driver PUBLISHER.inf /uninstall /force.

More info:

How to Fix Wdcsam64_prewin8.sys Core Isolation Turned off – MiniTool

 

ADSelfService GINA Mac Uninstall

Posted on February 28, 2024 by vrpc

Uninstallation Steps:

Open Terminal

Open /Library/PrivilegedHelperTools/

Del ADSSPLoginAgent

Go to login screen and confirm the changes.

 

Mac OS X Login Agent Installation (manageengine.com)

For some reason Microsoft SQL express 2017 and 2019 requires TLS 1.0 during installation.

Here is the registry settings [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0]:

The same is for Server and Client

Make sure to revert it back to DisableByDefault =1 and Enabled =0

MX-100 1:many NAT not working as expected

1:many NAT on MX-100 not usable for zoom connector or barracuda spam firewall

I have discovered that the 1:many meraki NAT implementation will always send outgoing traffic on the primary public IP instead of the IP assigned to the 1:many NAT rule.
 
I have spend hours on trying to find out why I am not able to use these two NAT services:
 

1. zoom meeting connector which should  be  possible to configured using 1:many NAT unfortunately not on meraki MX-100 device:
   https://support.zoom.us/hc/en-us/articles/204898919-Configure-Meeting-Connector-Controller-Port-Forwarding
   The solution to this is not to use 1:many NAT rule and use 1:1 NAT unfortunately this will require two public IPs or more if you add other zoom on-premise services.
    
2. barracuda spam firewall and exchange server.
   I decided to offload some traffic from the barracuda firewall for traffic which is not related to SPAM checking and use the build in 1:many NAT instead of 1:1 on the MX-100.
   This resulted in outbound email be send using the primary IP instead of the assigned 1:many NAT
   This will result in SPF verification to fail and outgoing email be rejected from outside servers.
   Had to revert back to 1:1 NAT and deal with occasional overload on barracuda firewall due to web traffic.
    
   cheers

Add mac computer to MDM server after initial setup

 This solution works currently on mac OSx Catalina 10.15.x.

If you need to add mac which didn't get added during first run to MDM server or was added to MDM server after the initial configuration and you want to add it without having to re-install operating system:

Open terminal and run this command:
sudo profiles renew -type enrollment

 

Splashtop on Windows computer name update

There are three options:

• 1. Rename it manually on the managed computer using splashtop client:

• 2. Rename it remotely using Splashtop Business:

• 3. Rename it using registry key delete:
  you can delete the key using remote management or by editing the registry on the remote machine directly using regedit by
  deleting this key and restarting the computer:
  HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Splashtop Inc.\Splashtop Remote Server\CloudComputerName

G-Suite add a native printer

Simple solution to add printer to managed Chromebooks:

go to google and follow the instructions : https://support.google.com/chrome/a/answer/7276100?hl=en
Below is a picture of the configuration which worked for me.
I was missing the Path information for Air-print capable printer: /ipp/print

To add LDP capable printer:

Meraki system manager Third Party System Preference Panes

When restricting macOS system preferences using meraki system manager settings it is necessary to white list third party plugins.

Here is the location with the information needed:
Macintosh HD> Library> PreferencePane
You will find the list of plugins here.
Right click on the plugin and select “Show Package Contens”
Open Contents folder
Find info.plist file and open it in text editor
You are looking for a line which contains com.pluginname…
something like this: “com.logitech.Logi-Options-Launcher”
And that is what is meraki looking for to be entered in the Third Party System Preference Panes. 

Trigger DEP enrolement on mac OS Mojave

mac OS 10.14.6
sudo profiles renew -type enrollment
older mac OS version:
sudo /usr/libexec/mdmclient dep na

Mac OS Sierra:
sudo rm /var/db/.AppleSetupDone
sudo rm -rf /var/db/ConfigurationProfiles/
sudo rm /Library/Keychains/apsd.keychain

Reference:

https://www.jamf.com/jamf-nation/discussions/24292/trigger-dep-enrollment-pop-up-notification

Exchagne 2016 update address books using EMS

 Open EMS:

Get-AddressList | Update-AddressList
Get-GlobalAddressList | Update-GlobalAddressList
Get-OfflineAddressBook | Update-OfflineAddressBook

Restart outlook or update outlook offline address book under Send/ Receive Groups: