If any of you are tired of your users receiving jamfAAD pop-ups, I would highly recommend transitioning to device identification using certificates. This method of conditional access allows you to control conditional access directly from your Jamf Pro server. Access is simply determined by the presence of your certificate. (This does require your users to have E5 licenses)The certificate is deployed via configuration profile...so no more manual registration either. Perfect for zero-touch deployments. To stop the pop-ups unload or delete any launchAgents related to the jamfAAD Agent. You can read more about this process here.  

When a user restarts their machine and clicks the Wifi Icon in the corner of the screen it does nothing. If connected to wired ethernet it joins fine. Users, after restarting, need to be on a network to use Okta Desktop MFA at login and if their laptops are not connected to a network, it will fail. In the office no problem just plug them in, but when they are working from home it is a problem because most don't have a wired connection easily available. I am wondering if I have somehow disabled this in a Configuration Profile setting. Any ideas where that might be, so I can allow my user to be able to select and connect to a WiFi network at the login screen. Sometimes after restart it will remember the network and remain connected but not always.

Hello Community, for iPad and Mac, we need to know if there are any limitations or special requirements for using a WPA2-PSK wireless network. These passphrase are typically 8 to 63 characters. We need to know if some of these platforms only accept fewer characters or have specific characters that they won't accept. We appreciate any help we can get.Jorge 

Has anyone had any success in connecting the Jamf API via the Zapier Developer platform.I've tried my hand at doing it while following both sets of documentation, but I seem to be failing somewhere. I would love to hear if anyone has found success. Thanks! 

I found this script for deleting accounts below which works a treat.However I work expect after a inventory update for Local User Accounts section in device record to be cleard also. But it still showing the delete accounts. Is there something I can add to the script or do to ensure this part of the device record get reset.# Get a list of all user accountsuser_list=$(dscl . -list /Users | grep -v '^_')# Specify the admin account(s) that you want to excludeexcluded_users=("admin1" "admin2" "root" "management account")# Loop through the user list and delete user profiles except admin accountsfor user in $user_list; doif [[ ! " ${excluded_users[@]} " =~ " ${user} " ]]; thenif [[ "$user" != "Shared" ]]; then # Exclude 'Shared' userecho "Deleting user profile for: $user"sudo sysadminctl -deleteUser "/Users/$user"sudo rm -rf "/Users/$user"fifidone

I'm working in a K-12 environment and we restrict certain apps on student laptops, such as Music, News, Stocks, Messages, Home, TV, etc.This is being managed through a Configuration Profile, rather than in Restricted Software.While this works for blocking those apps from launching, we're experiencing pop-ups informing the users that they don't have permissions to run app extensions within these apps when those extensions run on their own.Examples include: NewsToday2, MailCacheDelete, MusicCacheExtension, TVCacheExtension,MessagesCacheExtension, HomeExtensionAny idea on how to disable these intermittent pop-ups? Devices are 2020 M1 MacBook Airs, running on 13.4. 

I am not having problems finding the JAMF Tools, but I am having an issue with providing administrative access to someone on my team.  They can login to the account.jamf.com but it doesn't show them as part of our organization. It shows they need to join an organization.

Does anyone have a way to restore defaults for keyboard and screenshot shortcuts? I perform a method that can be placed in self-service, but I am open to all possible solutions. We have testing software that changes the defaults to both of these areas, and upon exiting the testing software, the defaults are not restored. macOS version 13.6.1 and higher. 

Hi,Our fleet has just jumped from Catalina to Monterey and our users are struggling to locate the screen mirroring "Show in menu Bar" tickbox.  Ideally I would just like a script to enable this or our users. I have trieddefaults write ~/Library/Preferences/ByHost/com.apple.controlcenter.plist ScreenMirroring -int 18but it doesn't seem to work.weirdly sound and bluetooth work though which are controlled inside the same plist. e.g: defaults write ~/Library/Preferences/ByHost/com.apple.controlcenter.plist Sound -int 18anyone got any ideas how the ScreenMirroring preference can be set via terminal script? Cheers, ES

Hi folks, I just wanted to share a restart method I've written that can be easily embedded into any bash script. It leverages CocoaDialog (you'll need to change the path variable for your installation location) to create a countdown progress bar and forks a restart script via a launchdaemon, so you can include it at the end of a JSS policy and the policy will be able to complete and upload policy logs to the JSS. I prefer this over other methods of initiating restarts because the timing can be precisely controlled and it provides a better UI for the user. Hopefully some of you find this useful or it sparks some ideas. This method of echoing a script and launchdaemon to the /tmp folder has many other uses, allowing you to fork scripts/launchdaemons for one-time use which will disappear on reboot without needing to package anything. #!/bin/bash cocoaDialogPath="/etc/CocoaDialog/CocoaDialog.app/Contents/MacOS/CocoaDialog" rebootSeconds=300 restartTitle="Software Update Completed"

DO we have any option to enable the SSO using the kerberos jamf auto login with mindmanager application ? we have user based licence and just want to automate to login with there email ID SSo to be enabled when user open the application it should authenticate and login auto or atlease ask the password for the user account ?looking for the document and steps

There's been a bit of chatter in the Jamf community regarding the deprecation notice that would remove the ability to set a static password for the PreStage local admin account and how it relates to LAPS.  We hear your feedback and this deprecation is on hold.   Admins will continue to have the ability to set a static password for the PreStage account Workflows that require a static password for the PreStage account will remain unaffected LAPS will not be on by default for the PreStage account More information to follow in an upcoming blog post.  

Dear Team, Our organization have 80+ bounded devices, those devices need to be migrated to jamf without losing user data.if any have steps to perform, pls share the steps follow.

I am completely new to Jamf pro and I need to set up 30 iMacs for a music suite. I did get help in setting up the prestage enrollment settings and successfully set up a Mac with auto-enrollment. The issue is that I can't remember what I set the local administrator account password as, under 'Account Settings; in the prestage enrollments section. So I have now changed this but it isn't reflecting through on the Mac.  Would I need to wipe the Mac or remove it from MDM and add it again for the local administrator account to be added?  Thanks

I had some questions about the JC login page. It seems inconsistent in when it is shown. This is causing some issues when we are doing onboarding as some people see the JC login screen and some people see the local login page. I see it consistently immediately after logging out, but if i logout then shutdown and go to login again I am only presented with the local login screen

We’ve started seeing messages on students iPads in the classroom settings pane that „teacher and student certificates have expired“ and that classes cannot be joined. No idea where those certificates come from though. Any suggestions? TIA

Ok, I resisted posting this for a while, but I've finally given up and am throwing in the towel, in the hopes that someone who is/has experienced what I'm facing found a solution.As part of our hardening process, we follow many of the recommendations provided in the CIS Benchmark guides. One of them is the subject of this title - enabling the "Require an administrator password to access system-wide preferences" checkbox under the Advanced section of Security & Privacy. The CIS guide, even the current ones, recommend using a scripted method, something like/usr/bin/security authorizationdb read system.preferences > /tmp/system.preferences.plist /usr/bin/defaults write /tmp/system.preferences.plist shared -bool false /usr/bin/security authorizationdb write system.preferences < /tmp/system.preferences.plistI was using this all throughout macOS Catalina and Big Sur, and even, I think for earlier versions of Monterey. But somewhere along the line, this just stopped working. I can

I've been working on creation of a .mobileconfig to sign and upload as Configuration Profile in order to manage a few settings that I typically manage with a script.One in particular is the <key>com.apple.keyboard.fnState</key> that is in .GlobalPreferences. This is a boolean key that either toggles the Keyboard > Keyboard Shortcuts > Function Keys setting on or off:(this makes it easier to send a particular few Apple Scripts via Remote Desktop in the classroom). This is a setting that I easily can set with a defaults write script, which works well. Still, I'm using this as a gateway to try to figure out how to better manage some other settings that may be useful in configuring classrooms.There are many settings that I've been able to configure by uploading custom XML, and many others that I haven't had success with. Now, I'm attempting to use the older mcxtoprofile python script by timsutton. In the README, I started to learn more about use of "always" vs "

I’m having a strange issue that started within the last week or so. Some laptops are not receiving some configuration profiles. Two profiles in particular (maybe more but this is the first I have noticed), and not every laptop is affected. One is for Jamf Connect. It’s an uploaded profile straight from the Jamf Connect Configuration app. The other is for the Root3 support app.I have tried different versions of each profile, one using the built-in Jamf Connect schemas and one with the upload. I have tried the same with the Root3 app, one using their JSON schema and one with the plist.Neither will push down to some devices. Hardware doesn’t make a difference, and neither does os. It’s happening on Monterey and Big Sur, and intel or Apple processors.I am at a loss. Logs for both say failed on the device inventory page and pending on the profile pages.We’re on Jamf Pro Cloud.Is anyone else having issues?

I have no doubt that this has been discussed before but I can't seem to find any discussions relevant to my scenario. In the event that a user locks themselves out from their machine, how can I push a policy to reset the local account password or even create a new account when the user is unable to login and the administrator is unable to get hands on the machine?

In the past we've had something way back that I could use to set the screen resolution of a Mac Mini that was connected to a VGA splitter so I could run it to the local monitor and the projector. The Mac couldn't really tell what was attached to it and set the resolution higher than the projector could handle. A login policy with the script worked great. I haven't used it in a while, but the issue I have now is a bit different. I have an iMac at the teaching station now, and it connects to the projector with the dongle out the back. By default the displays don't mirror, and again may not set the correct resolution for the projectors display. Is there something new I'm missing that I can use to set both mirroring and then both display resolutions properly with a login policy? The settings stick for a user once they set it, but it's per user so it has to happen at each login. There has never been a command line option just built into the OS for this (to my

Hello guys, we have users where the Network AD password gets out of sync with the mac when the user changes the password every 3 months or so. We have a Self Service action that updates their network password with their mac log-in password however users do not use that very often. The macs are file vaulted, how do you guys sync the network passwords with the mac log-in passwords? Is there an easier way to do that? 

ok so I am trying to make our device enrollment as seemless as possible for our workstations guys but I am not certain what the best possible options are. Does anyone have experience with pre-stage enrollment? Trying to make this as white glove as possible and its frustrating because I know there is a better way than what we have going I just dont know enough about the configuration options for the platform to be able to maker the changes we need. Any tips or pointers would be greatly appreciated.

Hi there,I'm working on a script to wipe out student mobile accounts from our lab machines.These machines are AD-bound, provisioning options are set to create mobile account at login with no confirmation.Here's the script I'm running. As you can see, very simple because all our student accounts contain the "." character (e.g. john.doe) -- # list all users with the "." character in their namesUSERS=$( dscl . ls /Users | grep -e "\." )# echo usersecho Deleting the following users: $USERS# delete users/usr/bin/dscl . delete /Users/"$USERS"echo User accounts deleted# delete home folders/bin/rm -rf /Users/"$USERS"echo User home folders deleted The script successfully removes my test student account, but then I'm unable to re-add the student to the device from the login screen after a reboot, which will prevent students from being able to use the computers.Any ideas where I could get more information on what is broken?Alternatively, if there's a smarter way I should be doing this, I'm also o

With the software updates that JAMF has implemented does this help install the latest iOS updates for all devices and bypass the users lockscreen code?