We are using Ivanti Secure Access for VPN on our iPhones, and we configure it with a config profile. I have noticed that if the config profile is pushed before the app has installed, the app wont see the settings, even after a restart. The settings config profile must be pushed AFTER the app.But when deploying a new iPhone out of the box, all the "apps and profiles install in a big dump and you dont really have control over them. We even tried scoping the profile to a smart group "Ivanti app installed" but it still sometimes gets overeager... it sees the app before it has finished installing, and pushed the profile too soon.How do we ensure the profile installs after the app? or are we solving the wrong problem and theres a way to make Ivanti see the profile regardless of when it was installed?

I'm in the process of building the latest Cisco Secure client for deployment.  I am building it using Stephane Sudre's Packages app (1.2.10).  I have the Cisco Secure pkg (pulled from Cisco directly) and the Choices.xml added in Scripts > Additional Resources.  The post-install script is very straight forward and just runs /usr/sbin/installer -pkg ./Cisco\\ Secure\\ Client.pkg -applyChoiceChangesXML ./Cisco-Secure_choices.xml -target / This works every time I run it on a clean install or if I run it locally on a machine with an older version of Cisco Secure.  If I try to deploy this package via Jamf policy to a machine with an older version of Cisco Secure installed, it fails 100% of the time and uninstalls the existing install. The Jamf policy log just gives the standard unhelpful "The Installer encountered an error that caused the installation to fail." message.  The install.log tells me that the error was with the post-install script, but that is so strai

Has anyone recently updated their JSS to Jamf Pro and find that loading policies and management tabs takes forever???

Looking for a way to script turning off Low Power Mode on our laptop fleet once a week. Students have been not charging and then come complaining to tech support to disable low power mode since its locked behind admin credentials (faculty can temporarily elevate to admin, students can't).Looked through here, but didn't see anything applicable.  Any suggestions? I didn't see it in config profiles either.

K so i have an issue with wireless icons in osx. The laptops are all OSX 12.1.   Issue is as follows. On a cold boot or reboot, the initial logon screen, there is no wireless icon up by the time. The machine is connected to wireless though, as it allows domain logins. When you get into the system, the wireless icon is there. When you log out and attempt to log in as another user, the wireless icon is there at the login screen as well. Its only the one initial time, from a full reboot, that the wireless icon does not show... God why? like why do macs have so many stupid problems like this....   Does anyone know how i can make the wireless icon show from a cold boot/reboot? Is it just a bug? Do they do this on purpose? Can it be configured? I see some other threads about hiding the icon, but i dont see any about making sure its there at all times. Any help appreciated.    Because for me, I have to log into every single one to see if it has wireless or not. I would lov

I want to shout out this awesome project.https://github.com/Macjutsu/superI've been beating a dead horse trying to figure out a way to keep the new M1s updated with little to no user interaction, not let them be able to access the Software Update portion of the settings panel since, let's admit it, end users are going to click on the shiny new OS Upgrade and not the tiny blue button all the way down at the bottom.I was able to set this up in a day and configure all settings and testing has been amazing. It only downloads the updates and not any upgrades, unless specified in the configuration, BEFORE prompting the user for a restart so it's 99% transparent to the end user, let's me setup deferment time and amount, custom branding to make sure it looks authentic to users, auto updates things like Safari that don't need a restart to update, and most importantly can authenticate as an admin account with a secure token instead of needing the user to be a volume owner!If you're looking

Good Morning,Is anyone deploying/using Maxon. They provide a command file and a .plist file to automatically run the command file, but I am having a problem getting the command file to launch properly. I was thinking I could generate a login script, but I am not great at scripting, would anyone out there be willing to take a look for me?The command is:/Library/Application\\ Support/Maxon/Tools/mx1 user login -u software@quinnipiac.edu -p PASSWORD Maxon instructions  

Very new to Mac management and JAMF.  I've been using a test Mac to test my enrollment and policies and noticed that if I reinstall OSX to test the OOBE, the policies I have set to "once per computer" don't seem to re-run.Looking here, I see that there is a command to flush the policy history and effectively "reset" the computer.  So, I ended up creating a script to run that command, set it to trigger upon enrollment and set the execution frequency to "ongoing".  I also set the script priority to run before other actions.I assume this should mean that when the test Mac has OSX reinstalled, when it completes enrollment, that script should be the first thing to run and the policy history should be cleared and all of the other policies set to trigger at enrollment and run once per computer should run, but they're not.If I pull up the computer in question in JAMF Pro inventory and look at the policy history tab, I can see that the policy flush did run, but for whatever reaso

I always download the monthly mid-month updates of MS Office from macadmins.software and there is sometimes a day or two delay. However the January updates are still missing from the site. Is Microsoft no longer maintaining that site?

Hello,what happens if you copy a jamf-enrolled device to a new device via QuickStart?Is that even possible? And will the new device still be enrolled and the business data also copied?And what happens to private data?

If I create a hidden account with the JAMF binary below, how can I delete the account or how can I unhide it? This is how I create it: sudo jamf createAccount -username localadmin -realname Local Admin -password P@ssw0rd -admin -hiddenUser This creates an account in /private/var/localadmin I have then tried to change the ID and or deleting it with DSCL, but I keep getting an error. sudo /usr/bin/dscl . -delete /private/var/localadmin delete: Invalid Path <dscl_cmd> DS Error: -14009 (eDSUnknownNodeName)

Three of my remote MacOS users with AD accounts are unable to sync their filevault and AD creds. Typically we have users log into the VPN and then change passwords locally in syst prefs. In a couple of cases I have users who can’t seem to authenticate to the domain from their login screens. We have another local account on all our machines that is just a non-admin VPN access account. The current work around is to log in there, get on the VPN and switch user (which only then takes their AD creds). This is a temporary fix and reboots prompt the issue to return. I’ve checked and they both have Secure Token enabled. Is there a good fix for this? I had someone suggest FDESetup commands in Terminal but sounds messy. Does anyone have a Jamf solution? Or any solution?

Over the last 2 weeks several of our managed iPad have received the following message:  "Some icloud data isn't syncing."  When it is selected the message reads: "Your end to end encryption data stored in iCloud can't be accessed...."  There is an option to "Resume Syncing."   When it is selected the wheel spins and nothing happens.  The same message is still there. I tried removing the device from the static group so that I could verify their account information, but that didn't take care of it either.  Any suggestions would be greatly appreciated.

Hey all,Thanks in advance for taking the time to read this post.We are using Jamf Pro and trying to start the process of getting MacOS 14 rolled out--we're currently on MacOS 12 in our district. We'd like to restrict access to some things in System Settings (seemingly still called System Preferences in Jamf Pro). For example, we would block access to Software Update and Sign In with AppleID, among other things. However, the options available in Jamf Pro under Computers > Configuration Profiles > Restrictions > Preferences > Restrict Items in System Preferences don't seem to match what's available under System Settings in MacOS 14. I am wondering if this just hasn't been updated on the Jamf Pro side, especially considering that the names don't match?I also think I saw somewhere online that we won't be able to block access to AppleID sign-in with MacOS 14. Can anyone verify?Thanks again and best regards. 

I have an existing site (call it site1) and created 2 new sites ( site2 & site3). I don't want to create duplicate policies, smart groups, etc...  for site2 & site3 since all 3 sites will basically use all the same.  Is this possible? Basically macs from Site1 will be moved/assigned to Site2 and Site3   Example: Site1 currently has Self Service policy1. Can I use that same policy1 in site2 & site3 without having to create the same policy for both new sites?   Site1 currently has Smart Group 'has zoom version 17'  Can I use that same smart group in site2 & site3 without having to create the same smart group for both new sites?

We are pushing out Google Hangouts Meet to our managed iPads (VPP licenses), wondering if we can push out variables or anything else to pull the user account into the app as well?

I have set up Google Chrome as an app from Jamf App Catalog as a Self Service option.As a user, I have installed this app, and within Self Service, it then says "Open".I have now deleted the app locally and run a recon, but Self Service still says "Open". It seems there is no way for me to re-install this app. And also "Deployment status" in Jamf Pro thinks that I still have this installed.Is this expected behaviour? 

Hi All,We have implemented JAMF compliance Entra integration and have now come to implementing personal enrolment of BYOD macOS devices in Intune.  It seems that once the compliance policies have been setup this disables users from being able to the personally enrol a Mac in Intune.  Has anyone overcome this problem?  Do we have to have the users temporarily added to the Entra exclusion group temporarily to allow the enrolment of a personal device?  Whichever way I look at this it seems cumbersome and service desk impacting.

After our cloud instance was updated to version 11 this past week, our team that uploads app packages gets an "Upload fail: undefined" error. It turns out there was an update to permissions that I can't seem to find any documentation on, so I figured I'd put it here in case anyone else runs in to this. If you have accounts that don't have full admin rights and need to upload packages, they also need CREATE on the "Jamf Content Distribution Server Files" permission.

Hi,Just wanted to know why the index page of JAMF will refresh when you have it open in Google Chrome but doesn't do this when using Safari (or Firefox).Also, it would be even better if the page did ajax refreshing, rather than having to refresh the entire page. 

I have an Intel-based Mac that will not enable FileVault.  A user left the company so I wiped the machine back to defaults and upon startup, re-enrolled in Jamf.  Everything enrolled properly but enabling FileVault fails on every level. The Config profile is installed.  When I restart it attempts to turn on FileVault, asks for password, I enter and then it says there was an error.  It restarts, I login and try to manually enable through System Settings.  It prompts for password, I enter and then nothing happens.  It accepts the password but nothing happens.I ran the command fdesetup enable in terminal and it prompts for credentials, I enter and it stalls for a moment and then says "Error:  A problem occurred while trying to enable FileVault. (-69550).I have wiped this machine twice now and same result.  Ran disk utility and it found no issues.I'm at a loss.  Any ideas?

I didn't see this one in the resource kit, and it took me some tinkering toget it just right. I hope some of you get some use out of this script (I'mattaching a zipped file just in case your mail reader, or any mail serversbetween you and I, mangle the text below).This script can be part of a configuration (make sure it's run "at reboot"),a policy for already-deployed systems, or run ad-hoc out of Casper Remote. #!/bin/bash ##### HEADER BEGINS ###### scr_sys_turnOffIPv6.bash## Created 20081222 by Miles A. Leacy IV# miles.leacy at themacadmin.com# Modified 20081222 by Miles A. Leacy IV# Copyright 2008 Miles A. Leacy IV## This script may be copied and distributed freely as long as this headerremains intact.## This script is provided "as is". The author offers no warranty orguarantee of any kind.# Use of this script is at your own risk. The author takes noresponsibility for loss of use,# loss of data, loss of job, loss of socks, the onset of armaged

Hi everybody, would like to share this short guide to help other users out using gmail as official server to send email.it works in both cases with @gmail.com domain and google managed one @MY13_2_domain.tld CONFIGURATION Server and Port: smtp.gmail.com : 587 Encryption: TLSv1.2 Connection timeout: 30 sec Sender Display name: JAMF Software Server Sender email address: ______@XXXX //your domain, gmail o gmail-managed Username: _______@XXXX //your domain, gmail o gmail-managed check AUTHENTICATED CONNECTION.use same email and password we used for the SMTP account. IMPORTANT NOTE:Less secure app option should be turned at ACCOUNT LEVEL, not at organization one. as a console admnistrator I wasted hours debugging this issue and realized just now that the option must be on at account level, not at organization one. Less secure apps & your Google Account hope this will help! brgds.Arkage.

I know I'm doing things the hard way. When a user gives up their Mac and it is still a viable machine, we would like to be able to use it again. Finding that getting a machine wiped and ready for redeployment to be an excruciating task. This is what we are doing now - and this is only because we obviously don't know any better:Get the Personal Recovery Key from Jamf ProBoot in RecoveryReset the user passwordLog in as the userUpgrade to the latest macOSBoot into internet recoveryWipe the driveInstall from internetThat all takes hours and I am sure there is a better way to do this.Would love to just boot off a USB disk and wipe the machine with the latest macOS supported for the hardware.I feel like that used to be a thing. Now I try and do that and cannot boot from USB, try to enable boot from USB and get Authentication Needed - Enter macOS Password - Recovery is try to change system settings. No administrator was found.As far as I know, there is a local admin set up as part of the poli

Hello. Not sure if others have had this issue, but escrow buddy is not working for us. I followed the deployment guide on the wiki, and made sure to double-check everything, but no luck. Had the user log out and log back into the MacBook (after the Policies completed), and the key is still not escrowed into Jamf. I also opened an "issue" within their GitHub, but I was curious if anyone here has experienced the same problem. https://github.com/macadmins/escrow-buddy/issues/8  Not sure what I am missing here 🤔 🤔