Thank you @DFree  & @MikeF - This worked nicely - I did some editing:Use directory: cd /Library/Application\\ Support/tmpDownload anyconnect-macos-4.10.03104-predeploy-k9.dmg from Cisco (or your vendor) and open it via installer (Double Click it in finder).Drag the AnyConnect.pkg file inside the .dmg to your tmp (for simplicity) and then do @MikeF's steps (4-9 below):Open Terminal and cd /Library/Application\\ Support/tmpPkgutil --expand AnyConnect.pkg AnyConnectVPNWent to the tmp folder, opened the AnyConnectVPN folderopened the AnyConnectVPN/Distribution fileLook for <choices-outline> <line choice="choice_vpn"/> lines starting around line. Delete the ones you don't need, and Save. (I Used Xcode to edit the file)pkgutil --flatten AnyConnectVPN AnyConnect_4.10.03104.pkgUpload that pkg file to JSS and go from there in however you want to deploy it.

Hi,We are in the process of setting up Jamf Pro and added our Azure tenant as a cloud IDP. Jamf Connect has been setup so we are able to sign into the device with our AAD credentials and the account is synced with a local account on the device. This is working as expected. I am slightly confused as the User and Location information is missing from the device inventory, should this not be pulling the information from our Azure cloud IDP? Also is it possible to target applications/policies and configuration profiles with AAD groups?Apologies if this is a simple answer however we are new to Jamf coming from a Windows background so slightly confused at the moment!TIA.

Hi All,We presently have behaviour where devices which are registered and marked as compliant in Entra using partner compliance are showing as unregistered and failing.  These failures appear to be sporadic and some devices are showing as successfully bypassing the CAP with the same apps and registration status.  Re-Registering doesn't seem to fix the problem.Has anyone else had this?  We think this may have occurred after turning off partner SSO last week and requesting people re-register for compliance as it hadn't come up in testing prior to this.Is anyone else still having issues with conditional access policies.

For some years now we've been encountering the odd mac where even though newly-enrolled, the local admin password does not work. With no way to login, we were reduced to Recovery Console, wipe and re-enroll.  To mitigate this we created a backup admin account to allow us a way in, but with the advent of Secure Token things have got weirder. Has anyone experienced this?  Here is our setup:1. Our student macs are enrolled with a prestage where a single local admin account "Admin1" is created before setup assistant.2. A Jamf policy then creates a second admin account, "Adminbak". 3. Setup assistant does NOT create a local account, instead we later bind the macs to ADS and network users then logon.  Adminbak was created to be the first account created after setupassistant, so it would get Secure Token. Our onsite techs can then logon to each machine with Adminbak to enable bootstrap.Here are our symptoms:4. We are finding that Admin1 has Secure Token instead. We don't k

Curious how everybody is remediating that new supply chain vulnerability for XZ.   My security team sent me this link - xz-backdoor-attack  I'm guessing an EA to locate non-patched versions, but what about deploying/updating the version?  I'm guessing a lot of them were done using brew.    

With the loss of the Teacher WebApp, 50% of our teachers can't control our student devices. This is a really big problem!We need a device-independent control for teachers! So please bring back the Teacher WebApp.

Does anybody know what field the "Display Name" attribute in JSS MUT maps to in the JSS? Is that the Computer Name? Thanks.

We are new to JAMF. Our JAMF instance is on Cloud and we have Infra Manager. Firewall ports are opened to connect to Inframanager. However we are not able to query any users. If we do a test. Below is the error message. Any suggestions are appreciated. ERROR:Unable to connect to the LDAP Server. SUGGESTION:Ensure that the username and password provided are valid. Infra log is as belowClosing connection because of SSL problem: Remote host closed connection during handshake.

Anyone has a reboot script that Allows deferral and uses Jamf Helper?. Would like to attach it to an apple updates policy. After the policy runs, it should prompt the user to restart the machine. The user should be allowed to postpone that reboot at least once before it reboots on its own. I have seen some that uses CocoaDialog. We cant/wont use Cocoadialog here at our company.

A few users updating from 13.6.4 to 13.6.5 have run into an issue where all the background applications have been removed. There is also trouble running some supplemental apps like the 1Password desktop app and Privileges app. It doesn't seem to matter if the background application was associated with an MDM payload. Even the jamf processes end up not running. Has anyone else had this issue? The users can log in, but since all the background services are wiped out many things like VPN, Jamf and Security software no longer function. I guess it isn't a black screen this time, but still.

Hi all,I'm new to Jamf Connect so I might be doing something wrong, or forgot a step somewhere. Whenever a user is logged out and they want to login again, they see the Windows login screen. How can I disable that so they only see the local user that Connect created? Is that even possible? Now they have to type in their email and password, and knowing the end users, they might see that as too much work or confusing :)Bit of background info; I'm using Jamf Connect in combination with Jamf School. If you need more, let me know!Thanks!

Hi everyone, We just implemented Jamf Connect and are still testing it. We had issues with devices randomly getting kicked off AD, so since we are on AzureAD now, we decided to get Jamf Connect. When we set everything up when a user logs in, we can reboot the machine, and someone else can log in. Now, after a reboot, no one else but the last user can log in. How can I get out of this? What are your best practices for using Jamf Connect in a lab environment?  Thank you

Has anyone figured out a way to push a config yet to File Maker Go 19? We will be using FM Go 19 to connect to a database on a host server on multiple iPads and I'd rather not configure each iPad. I heard of webclips being used but anyone else has a better suggestion on how they pushed out a config, please share your experiences. If you did use webclips, please share.

Hey guys,I actually fixed this issue thanks to Jamf's support, but I wanted to make a post in case anyone else out there Googles the issue I had.I was attempting to install the AD CS Connector on a brand new server (Windows 2022). When running the Deploy script downloaded from the Jamf website, it would go through the script and finish with no errors, but it would not generate the two certs it was supposed to. The last line produced in Powershell was "Adding Windows Firewall rule to allow inbound TCP traffic", then the script endedAfter talking with Jamf support, it seems that the AD CS Connector version 1.1 has some settings turned off that are need to be on if it's your first installation. What I did was right click the deploy.ps1 script -> Edit, which opened it in PS ISE, then changed the Parameters listed in the first bunch of lines to this:param ( [switch]$help = $false, [string]$archivePath = ".\\adcs.zip", [string]$installPath = "C:\\inetpub\\wwwroot\\adcsproxy",

Is there any benefit or drawback to installing config profiles through prestage (where it says "Use this section to add configuration profiles to the PreStage enrollment") vs. after enrollment (a config profile scoped to all computers)?If the former is advised, would I then remove all scopes in the actual config profile(s)? As it stands, right now we don't install via prestage. Rather it enrolls, it does its thing, then installs policies and config profiels.Thanks folks! :)

I am unclear as to how to keep licensed Apps, like FileMaker Pro, up to date with "Apps" in the JSS. I found lots of good stuff like Adobe Reader and I see FMP in that list too but how does it handle licensing? Testing with Reader worked flawlessly. But its a free app. It would be nice to use that Apps - JAMF apps area to keep as many apps up to date as possible to avoid packaging etc. Can anyone point me in the right direction for that, video on TY or something? Cheers.. 

Has anyone been able to force the new manage backups in OneDrive? I can't for the life of me get it to work, using both PLIST and JSON. I can get it to force other settings but not the backups. Here is my configuration. Tenant ID has been removed for obvious reasons.  <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>DisableTutorial</key> <true/> <key>DefaultFolderLocation</key> <array> <dict> <key>TenantID</key> <string>Tentant ID Here</string> <key>DefaultFolderPath</key> <string>~/</string> </dict> </array> <key>HideDockIcon</key> <true/> <key>OpenAtLogin</key> <true/> <key>EnableAddAccounts</key&

We've got a Journalism cart that has about 26 MacBooks in it. Some issues popped up and I wanted to test clearing out the profiles daily because some students just don't listen and keep ~50GB in their profile even though they have external drives for their work.I have a pretty simple script that just makes sure to ignore our admin accounts and runs a..for a in $userListsysadminctl -deleteUser $aThis seems to work and the home folder is gone but the account is still technically there when you go into users and groups. So when we try to login the MacBook just hangs since there's technically an account still there but no home folder.These users are not secure token holders since only students use them so it's not that and they are Jamf Connect created accounts.Is this just not possible on M1s? They had Intel Macs before I got here and said they used this script all the time but now it just falls a little short with fully removing the account from the device.

Is there a way using the API to find the number of devices that has an app installed based on the app ID? I created a script to do it but I went off used VPP license but that takes every device its scoped to into count not the ones with it actually installed which is a much smaller number.Any help would be great and I will also include the script I created to at least find used VPP licences.Its rough I know, I am still learning how to script with API requests.import requests import json from datetime import datetime import xml.etree.ElementTree as ET import os import csv #This is the login for the Bearer Token username = "ussername" password = "password" url = "https://your_jamfcloud_server.jamfcloud.com/" bearer_token = "" token_expiration_epoch = 0 #This gets the Bearer Token and makes it usable def get_bearer_token(): global bearer_token, token_expiration_epoch response = requests.post(f"{url}/api/v1/auth/token", auth=(username, password)) response_json = response.json

We are MacOS 14.x and these started popping up. I feel like i am missing something here as I thought Apple had removed the need for admin elevation to update MacOS

What apps/scripts/product are you using to manage temporary admin permissions in your environment? I'd love to give Jamf Connect a try, but we're still using on-prem AD for authentication. I'm piloting Privileges, and its going well but my management wants a non-open source solution, even though it can be deployed from the Jamf App catalog. I mention Jamf Connect, and the response is that we're not moving to cloud IDP for the foreseeable future, so no go on that.

Now we have been working back and forth a bit to be able to push out a configuration to an iPad to automatically connect to Wi-Fi. We have got the configuration in place but when the device tries to connect to the network it just stands still and spins.   If we click the ⓘ on the right side of the SSID, turn off Private Wi-Fi Address and then click Join This Network.   After that we click Mode to change to EAP-TLS and then click Identity, there we see a certificate that’s not the one we want to se.   When viewing certificates under the MDM Profile on the device we see three certificates, the one we sant to se is the one without a name.   Does anyone have any advice to give and/or does know what could be wrong in this case?Happy Eastern everybody :)

Hi, We have a Configuration Profile pushing out our WiFi settings with certs currently, but recently the first batch started expiring. They get renewed, no problem, but the expired cert is left in the keychain. I'm trying to script the removal of them using the following script, so they can't be selected for the wireless profile. #!/bin/bash # Grabs the expired certificate hashes expired=$(security find-identity | grep EXPIRED | awk '{print $2}') # Check for certs if [ -z "$expired" ] then echo "No expired certificates, we're all good" else # Deletes the expired certs via their hash echo "Deleting expired certs" security delete-certificate -Z $expired fi exit 0 #success If I run these commands locally on the machine, then it works no problem, but via a policy it always fails with: 'Unable to delete certificate matching "XXXXXXXX..." Any thoughts? Is there a better way to manage certificates for WiFi profiles? ThanksChris

I recently took over managing our instance of Jamf Protect and its a mess. I linked it via API to Jamf Pro and pushed out the plan and newest agent. The problem is some of the devices have stale records and don't seem to update even after Jamf Pro installs the new config profile and agent. The device is checking into Jamf Pro regularly but not updating in Jamf Protect.Any advice on how to rectify this? I tried uninstalling and reinstalling the agent but that did not seem to work.

Hi everyone,I'm in the process of setting up our instance of Jamf School and I got stuck on the Exchange setup. I created a separate Profile for iOS devices for this and was able to add most of the information so the users could just type in their password to authenticate. The only thing I was not able to do in Jamf School was to add the "Domain", which is needed for the process. If I set up manually on the device, the "Domain" field says "optional", but it is indeed the only difference, that makes the process successful for me.Does anyone know of a way to implement this in the Jamf Profile?Best,Wadim