Hello communityI just started to testing prestage enrollment with jamf connect configuration for standard useraccounts (non admin).Enrollment working fine, like our enrollment for the admin user. But we have the behaviour on the macbooks, that the keyboard layout changes to default (ABC) after each restart of the macbook. All keyboard layouts that are not necessary were deleted in the user setup steps (before connecting to wlan). After the MacBook has restarted after on of our policy the keyboard is set to default ABC.Someone has an idea how this can be solved. My problem is, that we have differen offices in different countries with different keyboards, so pushing a configuration will be not as much easy :)THX in advanceBRJ

Hi all. We're testing out Jamf Connect here for an eventual rollout to all our Macs a little later this year. One of the things I'm looking at is the recently added privilege escalation process Jamf added to Connect. It seems to work pretty well, and makes it easy for an end user to ask for temp admin. I have it set to only allow a set number of escalations per month per the documentation. But one question I had was, what happens if a user uses up their monthly allotment, and I decide I'd like to reset the counter for that month for that user or device, or extend an additional privilege escalation to them? It doesn't seem like there's a way to do this. I've been looking for something that tells Jamf Connect that they've used their allotted privilege escalations, either in Jamf Pro or on the device. I suspect since Jamf Connect can be MDM agnostic this is held somewhere within the device itself or within the Jamf Connect application. But I've yet to find any information on how this work

We're currently testing out the Microsoft Enterprise SSO plug-in (without Platform SSO) for macOS and have run into an odd problem.  Everything works perfectly, but if the user opens the Company Portal application it tries to get them to enroll the device into Intune.  This makes for an awkward scenario where the user is guided to download the Intune management config, see it fail to install, and then back out until they can say "Postpone."  Not a great experience, and telling people to just not open the app doesn't really work at scale.  Is there any way to suppress this Intune enrollment prompt from the Company Portal app when we deploy it for the Microsoft Enterprise SSO?   NOTE: We're not currently using Intune for device management outside some testing, and we do not have Device Compliance integration set up just yet. It's on our roadmap, but hasn't been a high priority.  We can probably move it up if it is an assumed prereq for the Microsoft Ent

ok so I have very little knowledge about Jamf Pro.  I am more of a Windows engineer. However we have to support Mac users at work..even though I don't have any access to JAMF PRo.The scenario is that the user is insisting that they didn't change there password but can't logon.They are at home my understanding is that he 100% is tying his password wrong.He thinks the system has somehow changed his password.Is this impossible? 

Anyone else get a very google vibe that Jamfs "Software Updates" workflow is still in beta never mind it's been the "production" solution for OS updates for over 6 months now?      

Haven't posted in a while... glad to be back, at least to ask this question:When do normal Jamf Pro customers get this?https://datajar.co.uk/products/jamf-auto-update/This seems like something that Jamf App Catalog was meant to be.  This company is now owned by Jamf.  Hoping this product expands from being just for MSP's to Jamf Pro customers soon.  Having automatically updating Mac packaged app catalog for over 800+ apps seems like something all Jamf customers deserve.  The App Catalog in Jamf Pro has not expanded as quickly as hoped, and also continues to be unreliable at times with it using the Apple Enterprise Application install API's.Thoughts?

Background While we're waiting for @NightFlight's Extention Attribute Execution Frequency feature request to be implimented, here's my two cents, which was inspired by @brad's approach for only occasionally capturing the status of a computer's Recovery HD. Approach As one of the first steps of an Extension Attribute script, you pass the name of the Extension Attribute and the desired execution frequency (in days) to a client-side function. A client-side plist stores the epoch and the result. During subsequent inventory updates, if the current epoch is less than the given frequency, it just reads the previous result from the plist instead of executing the entire Extension Attribute script. For example, I have an EA for “Model Name”; how many times do you need to run that Extension Attribute? (Once per quarter? Once per year? Certainly not every time.) Results Early tests show an overall inventory collection that is 1.6x faster, using the following as a gauge before and after:

hi,We use SPARK email software.With APPLE volume purchasing we have deployed the app with JAMF and the APP STORE.When SPARK makes an update and it appears in the App Store, JAMF downloads the update but cannot deploy it on the client workstations because it systematically asks for the workstation's admin code.How can I automate these updates?cordially

What are the ways to manage software updates for non-supervised mobile devices? We have several hundred mobile devices enrolled using the UI method and would like to keep their iOS versions up-to-date. I understand that the "Update iOS Version" remote command only works on ADE/Supervised devices. Is there a way to manage software updates for non-supervised mobile devices?

I am testing a reset local user password Policy in case a user forgets his macbook login password. I see this as a trigger option: "Startup - When a computer starts up. A startup script that checks for policies must be configured in Jamf Pro for this to work"What kind of Startup Script would I need for this policy to take effect? This may come up in the future and would like to have this available for a real situation. OTW, the trigger is Recurring Check-in but it doesn't seem to check-in after I reboot ans wait 15 minutes. I don't believe Recurring Check-In will happen until after the user logs in. This won't help if I can't reset the password through Policy. Any help/advice is always greatly appreciated. 

We have an odd behavior in our environment for some of our machines.  If you try to shutdown/restart using the GUI method - it hangs.  What happens in you see the background and the mouse cursor...and it just stays there.  Screen never goes black and doesn't shutdown/restart.  So because it's stuck you can still SSH into the machine and run commands.  So I wrote a script to kill processes to try to figure out which process might be hung.  While I didn't figure out which process is causing this I did learn that if you kill the following processes(AppleUserHIDDrivers, IOUserBluetoothSerialDriver, IOUserDockChannelSerial) four times it will kernel panic your machine.  Tweaked the script to avoid processes that will kill the remote session...but it doesn't seem any process I kill causes it to move forward and shutdown/reboot. Anyone experience anything like this?        

 We have a user who's time zone is set wrong..if we try to change it we can't as it is greyed out."This setting has been configured by a profile"I assume this is a JAMF Profile?

Hi, just trialing Jamf Protect alongside our subscription of Jamf Pro and have linked the two together via API Client and imported the Default Plan and added my laptop to the scope, but it doesn't appear to have actually installed Jamf Protect. What am I missing/doing wrong?I also note that I cannot select the option Automatically deploy the Jamf Protect PKG with plans option under Jamf Pro > Settings > Jamf Apps > Jamf Protect.

I would like to know if JAMF Pro supports "Privileged identity management (PIM)".   After logging into the Jamf Admin website, we would like to require our IT users to PIM before doing certain actions.  For example, before viewing a FileVault Recover Key. I know that in Microsoft Azure console/webpage, our company requests us to PIM before doing "admin" task.

Is it possible to use a pre-downloaded version of Sonoma and install it for standard users by using Nudge?My workflow at the moment is I am using Nudge without the erase and install script, because I am using a policy I run beforehand with only a single command line to fetch full installer in the processes and files tab. Nudge then opens system settings -> softwareupdate, but it looks like it is re-downloading even though there is a 'install macOS Sonoma' in the applications folder. Maybe I am missing something. I have watched several videos and read thru the wikis for Nudge and the erase and install script, but I can't find anything saying for sure there is way to do this for standard users.

We are going all online for the ACT this year and we have to use Pearson's TestNav app in order for the students to test on their school-issued Macbook Airs. They are running MacOS Ventura (or Sonoma for those who upgraded before we had the chance to block updates).The TestNav documentation says that we need to disable all of the notifications for the students while they're taking tests. I haven't been able to find a reliable way to do this. I found some scripts but they may be outdated because they keep throwing errors. Does anyone have a solution to this? I need to send a command through Jamf Pro to all of the student Macbooks to turn off notifications before the test then send another command to re-enable them after the test. Would forcing them into Focus mode do the trick?Here's the script I found. I modified it slightly by replacing "unload" with "bootout" using the syntax I found here:https://joelsenders.wordpress.com/2019/03/14/dear-launchctl-were-all-using-you-wrong/Both old an

I recently had to configure Zscaler for my environment and I figured I would share incase it helps anyone.Prior to 3.9 Zscaler was configured with a script, the JAMF documentation is eh and the got the script they provide from someones GitHub repo.[Guide] Zscaler Client Connector Deployment with JAMF Pro for MacOS - Connectors / Client Connector - ZenithWith 3.9 Zscaler is now configured with a configuration profile, which at the time of writing is documented for intune and not JAMF. Zscaler has advised they will update their JAMF Documentation, but as of 6 weeks and they still have not updated their documentation. The intune docuemtantation is simple enough to use with JAMF. Deploying Zscaler Client Connector with Microsoft Intune for macOS | ZscalerThe Zscaler app can be provided in 2 ways. The non-managed app which will not respect any configuration profiles, and a deployable .pkg which is what you want to use. Build the policy to deploy the package as usual, nothing screw

How to stop all adobe products when installing a new version of adobe 2019

Hello. I am fairly new to Jamf Pro and in the process of learning while cleaning up some of the work that was created before me. I have a question regarding pre-stage enrollments and the best practice for moving forward. Currently, our iPads are not automatically assigned to a pre-stage enrollment as we have 4 different pre-stage enrollments. This leads to devices never being enrolled in Jamf as they are shipped out to the end user. I would like to automatically assign all iPads to our generic DEP pre-stage enrollment and then manually move the ones we need in a different pre-stage enrollment. We will not need to do this often and this will at least allow us to have all iPads enrolled in management. Am I correct in thinking that devices already assigned to a different pre-stage enrollment will stay there after this change is made, even if wiped? It is my understanding you can only have devices in one pre-stage enrollment at a time and you have to unselect the one it is currently assign

Currently we have 2 phone numbers saved in our Apple IDs for Apple Business Manager and iCloud that are tied to individuals. When we receive SMS verification codes, one of those 2 individuals needs to be able to answer to give the code.We were looking for a web-based SMS service that can receive SMS MFA codes. We found one called TextFree that does allow this with a paid subscription. However it does warn that not all vendors support sending MFA codes to their provided phone numbers.Does anyone use a solution for this currently or does anyone use TextFree for this?Thanks.

Hello all, I'm new to JAMF and I was wonder if there a way to change the names under Browse in Self-Service?  By default, It group all the software and policy group under "All" , Can I change it to something else like "Software " ?Thanks for the help.

Fellow Jamfnation citizens, While macOS High Sierra is not anymore supported by Apple, does Jamf still allow to install jamf binary on Macbooks with  unsupported macOS and allow to manage or supervise them ? Does the same apply to other unsupported macOS like Big Sur and Catalina?

Hello , Im using this Make Me admin Script https://github.com/jamf/MakeMeAnAdmin , it works perfectly to give the user admin acces , but where i can find the logs ( to see what the user did with the admin acces ? Thank you 

Hey all I'm new to Jamf School. I'm trying to do a pilot program this year for Jamf Teacher and Jamf Student for our ipads.  I currently have Jamf teacher and student working well. However, I can't get Apple Classroom "View screen" to work. I went through the Jamf Restriction settings and allowed for Apple Classrooms to view the screen.  Anything I'm missing, any settings that are hidden on the jamf school side?

Is there anyway to manage Opera browser? I searched in Opera not able to find mcx/configuration profile.