Home > Casper, Mac administration, Mac OS X, macOS > Setting up Casper smart groups to include specified operating system and later

Setting up Casper smart groups to include specified operating system and later

As part of setting up Casper policies, you need to set which Macs will be receiving these policies by setting the scope. The scope defines which Macs or users will be receiving these policies.

Screen Shot 2016 08 04 at 10 39 47 AM

When preparing to set the scope for a policy, I will often build and use smart groups. These are a special kind of group, where the members are defined based on one or more attributes (like the Mac’s operating system version, IP address, Mac model, etc.) and therefore the group’s membership is dynamically growing and shrinking based on the numbers of Macs with the specified attributes.

Once the smart group has been set up with the desired attributes, I then set the smart group and its membership to be specified as the scope’s Target Computers.

For many software deployment policies, the software in question often has system requirements that cover a range of operating systems instead of just one version of Apple’s OS. For example, Google Chrome 52.0.2743.116 has the following system requirements:

OS X Mavericks 10.9 or later

Screen Shot 2016 08 04 at 1 19 38 PM

Update 8-5-2016: Casper 9.93 and later includes new smart group functionality which can entirely replace the technique described in this post. For more details, please see the post linked below:





To deploy Chrome via Casper, the smart group should be set up with attributes that include Macs running 10.9.x. and later. To accomplish this, I had previously set up a smart group that looked like this:

Screen Shot 2016 08 04 at 1 24 03 PM

Note: The trailing period after the last number is used by Casper to include all relevant matches. So “10.10.” will also pull in Macs running the following versions of OS X:

  • 10.10.0
  • 10.10.1
  • 10.10.2
  • 10.10.3
  • 10.10.4
  • 10.10.5

However, I was finding that I later needed to go back on an annual basis to those smart groups and add new entries. For macOS Sierra, the smart group would need to be edited to look like this:

Screen Shot 2016 08 04 at 1 28 47 PM

An discussion with my colleague Jeremy Reichman provided me with a solution to this issue. I had been setting up my smart groups to include those machines which has the OSs I wanted by setting the smart group attributes to say “I want these OS versions.”

A better answer is to say “I don’t want these OS versions,” and then specify the OS versions that are NOT wanted in your smart group. The result is that your smart group is then populated with whatever is left after excluding the unwanted versions. For example, to get all Macs running 10.9.x or later, you can set up a smart group that looks like this:

Screen Shot 2016 08 04 at 1 46 20 PM

Note: It’s unlikely to have 10.1.x through 10.4.x in a modern Mac environment but they’ve been included for completeness’ sake.

The resulting smart group membership should include all the machines that aren’t running the specified OS versions, which may include Macs running 10.9.0 through 10.999.999.

This makes the job of scoping a Chrome software deployment policy easier because the smart group membership will now automatically match the specifications of Google Chrome’s system requirements of OS X 10.9 or later.

Screen Shot 2016 08 04 at 1 51 55 PM

  1. August 4, 2016 at 9:02 pm

    This response is coming from experience. First “10.x.” will not match “10.x.0” as the OS will often report the .0 release as “10.x”. Second, ther is a known issue with Tomcat (part of the web services the JSS requires to run on) that causes Tomcat and the JSS to crash with smart groups that are too complicated, your “not like” smart group would be borderline (also for completeness, you forgot about 10.0.).

    I solved my OS version smart group issues with a smart group for each major version like:

    Macs using 10.9 or later

    Operating System is 10.9
    Operating System like 10.9.
    Computer Group member of Macs using 10.10 or later

    There reason for OS “is” 10.9 was because in 10.10, we found that groups for 10.5 started matching 10.10.5, and solves the mis-match of “10.9.0” since the OS would return just “10.9”.

  2. December 22, 2016 at 1:47 am

    We’ve been avoiding “Is Like” a much as possible, using whatever method you like to use to give major.minor value:

    $ sw_vers -productVersion | sed ‘s/\.[^.]*$//’


    $ sw_vers -productVersion | cut -f1-2 -d”.”

    So instead of “Is Like” “10.11.” which requires calculation, use “Is” “10.11” using either of the above. So no calculation required by JSS…er…by Jamf.

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: