We are having an issue with Secure Tokens.JAMF creates an admin account by default, which is created before setup assistant and almost always the fist account we log into. From my understanding, the fist logged in account is the one that gets the secure token. However, in many case (not always) a generic standard account we push through policy is the one that gets the token. This causes issues with running updates and changing passwords. I am able to resolve it through a series of terminal commands but wondering what is causing in the first place. I originally thought it was an issue with Catalina but am still seeing it currently with Ventura.     

Here everyone - please go and vote for this in the feature requests.  It is annoying to have to spend 1/2 the day logging back into Jamf and waiting for the page to load.   https://ideas.jamf.com/ideas/JN-I-27272

 Dear allI have created some guidelines in Jamf.These also work, but unfortunately only when you click on "Install" in the Self Service Portal.Is there a way for such policies to be installed automatically without having to proactively click on Install?Information about a policy:Policy: Disable IPv6- General:Trigger: Enrollment CompleteExecution Frequency: Once per computer- Restart Options:Reboot Method: Standard RestartStartup Disk: Current Startup DiskNo User Logged In Action: Restart if a package or update requires itUser Logged In Action: Restart if a package or update requires it- Files and Processes:Execute Command: networksetup -setv6off "Wi-Fi"- Self Service:Button Name: Install Do you have any ideas?I would be very happy.Best regards

Here is the script I started using from Jamf Nation:  Parameters:  Error:   I found the Waiting Room and I had to give myself permission to view the folder because I don’t have access    The agent file is there.  But it fails to install.   Is there anything I should do?  It is failing on all of our organization's Macs. 

We have 100 MacBooks that we manage with On-Prem Jamf Pro.   We have seven (7) different VPN servers that our users can choose from to connect to the company's network.  Jamf is working normally on all machines EXCEPT for the MacBooks connected to our NY VPN server.  For the 5 people on the NY VPN server, they all have Pending Management Commands stuck for weeks, maybe months.  I clear them out, but they come back and go Pending indefinitely again.  Even the built-in commands (like InstalledApplicationList, SecurityInfo, ContentCachingInformation, ContentCachingInformation, CertificateList) are stuck Pending as well.  I cannot send any Configuration Profile to any of these machines on the NY VPN.  But the same Config Profiles work everywhere else.  I don't think that re-enrolling them in Jamf is an option since they are all working from home and also because the "Allow MDM Profile Removal" was not checked in the PreS

Just updated our jamf cloud to 11.3 and noticed that I have a whole load of config profiles now in 'No category assigned'  Prior to the upgrade all our config profiles where in the correct category.  As we have a pretty robust naming convention this took only a little bit of work to get them back where they should be.. but... better things to do!   Any one else? 

I'm testing management of mobile devices in Jamf Pro and have just user enrolled a mobile phone. Looking to test the remote lock feature if a device is lost/stolen, which worked flawlessly, but now I can't find any way of unlocking the device. Would have expected the Lock Device button to switch to an unlock option, but that hasn't happened, and I'm not finding any documentation on how to unlock a lost/stolen device should it be recovered.How am I suppose to unlock a locked mobile device in Jamf Pro?

Has anyone attempted to perform policy updates or installs to computers that are in cart(s) asleep and lid closed? I notice the computers check-in while in this state, therefore, why not push updated policy at night when no one is around?

Hello,Has anyone successfully been able to connect to an 802.1x wireless network from the Jamf Connect Login screen while being unbound and using the ADCS Connector? If so, please share your Network/Certificate payloads. Edit: After configuring this myself and helping many others with this issue, I've created a simple guide for those of you that need help below:1. Configure one of the following:A. ADCS Connector (expensive)B SCEP PKI Cert (inexpensive)2. Add the PKI Cert to your Jamf Pro Server.3. Learn how your Radius server authenticates. (username, hostname, serial, etc)4. Configure a Wireless configuration profile that contains the chain of trust for your radius server the ADCS/SCEP cert and trust these certs. The profile most also contain your wireless payload.5. Deploy the profile.  How to configure ADCS: https://youtu.be/oRkpkN1Z3aIHow to configure SCEP: Integrating with DigiCert Using Jamf Pro - Integrating with DigiCert Using Jamf Pro | JamfOpen a tick

Hi! I've been asked to create a configuration/policy/etc that allows full access to the Mac, but also deletes all stored files upon logout and becomes a fresh OS install. Guest Mode only allows access to safari, which is insufficient for our needs. I've been looking around online for a while but perhaps I just don't know the correct search terminology. Anyone created a policy like this before that creates an account on the Mac that wipes itself of stored files and cookies etc when you log out of it? 

The last two versions of Cisco Secure have had caused a weird issue in our environment. On random machines, we're getting a popup message (that locks up Finder until acknowledged) with the text "The VPN client agent was unable to create the interprocess communications depot" every 30 seconds. Looking around online, we found this was caused by Internet Connection Sharing (ICS) being enabled. Thing is, we don't enable ICS, and the machines we're seeing it on don't have ICS enabled. My first thought was our installer was bad, but we're just doing the standard choices.xml for the install and applying their provided temp workaround for the macOS 14.2+ launchagent issue. /usr/sbin/installer -pkg ./Cisco\\ Secure\\ Client.pkg -target / -applyChoiceChangesXML ./Cisco-Secure_choices.xml# Temp fix for macOS 14.2 and 5.1.0.136if [[ "$( sw_vers -productVersion | awk -F '.' '{print $1}' )" == "14" ]] && \\[[ $( sw_vers -productVersion | awk -F '.' '{print $2}' ) -ge 2 ]] && \\

We are attempting to implement the Australian Government’s ISM controls and we are required to satisfy these:1171      Attempts to access websites through their IP addresses instead of their domain names are blocked by web content filters.649         Files imported or exported via gateways or CDSs are filtered for allowed file types.Can jamf do either of these?  If so, please point me to a page/link that explains how.

Hi All,I'm still gaining my footing as a person in the security sector while trying to manage Macs in our environment with Jamf Pro. We have protection software such as CrowdStrike and Rapid 7. I tried searching through the community, but I'm not finding clear examples of what I'm looking for, yet. Is there a way to prevent administrators of Macs from tampering with software like CrowdStrike and Rapid 7? Specifically, after the programs are installed I want to prevent them from being able to disable it. I thought something like a configuration profile would do the trick, but I'm not quite seeing what I'm looking for as I go through them. I would appreciate someone pointing me in a potential direction to look. 

Hello does anyone have a terminal command or script that we can use in Jamf to uninstall the canon uniflow app from users mac devices? 

Trying to use Jamf Remote Assist when no user is logged in, but after connecting successfully for a remote support session we can only see a black screen instead of the login screen of the Mac.Moving the cursor and interacting work in our tests with a "remote" computer sitting on our desks so we can see the display. As soon as we log in as a user the remote session window changes from an all-black window to the user's desktop. This limits us from addressing login screen problems for users or starting a Remote Session without the help of an end user, which we may not want to be logged in depending on the tasks we need to accomplish.Is anyone else experiencing this? Jamf Connect 2.29 (Later builds causing unrelated other issues in our environment)Microsoft AD/AAD (Entra)M2 MacBook Air, Sonoma 14.3.1 ("remote" user)Jamf Pro 11.2.1-t1707143529 

Hello, we have multiple Admin accounts on the macs. I would like to know how to rotate admin passwords using LAPS? Is that possible? 

Hi What is the simplest and easy way of getting Office 2016 updates pushed to my environment without the end user having to seek an admin to put in their creds. Ideally we just want it to check the device and if it finds an update, then for it to do it in silent mode. Probably been asked plenty of times but would like to see peoples experiences on this.

from the JAMF Pro web interface I'm uploading the recent version of the Big Sur 11.5.2 install assistant.pkg and when it reaches the end of the 'uploading' progress bar 100% it just sits there.  The cancel and save buttons still showing just like i havent uploaded it yet.Other pkgs I upload reaches the same 'uploading' progress bar 100% and the screen refreshes and you know that the pkg was uploaded and it will be available to use soon. the 11.5.2 pkg is like 12GB   but i had no problems  with the 11.5.0 Big Sur install assistant.pkg uploading successfully.I've had this uploading issue with versions 11.5.1 and now 11.5.2anyone have a clue as to what is happening and why? any other pkgs i upload have no issues completing (but those pkgs are not nearly this size).  

Hi JAMF Nation,Did anybody here find a fix for the Microsoft 365 problem with JAMF? I tried all the possible combinations, but without turning off security defaults, it just does not work well. How did you guys go about it?I also tried using AWS SES but to no avail, practically a wall at this point. 

Any hints on troubleshooting a policy that is configured to run at login but appears not to?The policy is set to run a script that simply populates the User and Location > Full Name field, and works perfectly well when running jamf policy but the value is never populated when a user logs in.The policy is set to trigger on Login and Settings > Computer management > Check-in > Create login events > Check for policies triggered by login has been enabled.

How do you do?We have just started testing the roll-out of BYOD and have discovered that the profile for personal devices has an .html extension.This means that we cannot install it.We have the problem on different iOS devices with different browsers. 

Am I right in believing I have to change the setting for "autoDeployEnabled" to true before I will be able to see the password of a local admin? At the moment if doesn't appear to do anything even though it will pop-up a message saying viewing the password will cause the password to rotate in 1 hour.Currently just looking to see what/how this feature actually does. 

Hi All,Anyone Send the script for Tailsman Installation in Default path /users/user_name/.tailsman/bin

Hello, Jamf Nation! I’m excited to share a project that I believe could bring significant value to our community—App Auto-Patch. Designed for macOS application management, this tool leverages the power of swiftDialog and Installomator to streamline the application patch management process, ensuring your Macs' applications stay up to date effortlessly. Key Features: Local Application Discovery: Automatically identifies applications installed on Mac computers that require updates. SwiftDialog Integration: Enhances user experience by providing clear, friendly prompts for update deferrals and installations. Flexible Application Management: New variables allow for customized handling of applications in the user's home folder, including conversion and ignoring options. Improved Deferral Window: Offers end-users clarity on pending updates with a resizable deferral window and updated messaging. Webhook Reporting: Enables status reporting to Teams and/or Slack, offering insights into patching

Hi Jamf Nation!I have some questions about what happened in a MacBook after it received the WIPE command, rebooted but without the firmware passcode being authenticated? Could the command be cancelled in any way?We have a MacBook Air (Retina, 13-inch, 2019) with Intel chipset running macOS 14.3. WIPE command issued and it is now stuck at the user login -> reboot to firmware lock loops."Clear Activation Lock" option was chosen when attempting the command, but it says activation lock not found, so the WIPE command was issued without. After the command was sent, the MacBook immediately rebooted into the Firmware lock, which then we realized the passcode is unknown. Attempt to boot or reboot the machine will first goes into the user login page, and ended up at firmware lock after user authentication. We did not reach the steps to enter the 6 digits arbitrary passcode.I read this from the previous post:@talkingmoose wrote:If the computer has been protected with a firmware passcode,