I've been working on creation of a .mobileconfig to sign and upload as Configuration Profile in order to manage a few settings that I typically manage with a script.One in particular is the <key>com.apple.keyboard.fnState</key> that is in .GlobalPreferences. This is a boolean key that either toggles the Keyboard > Keyboard Shortcuts > Function Keys setting on or off:(this makes it easier to send a particular few Apple Scripts via Remote Desktop in the classroom). This is a setting that I easily can set with a defaults write script, which works well. Still, I'm using this as a gateway to try to figure out how to better manage some other settings that may be useful in configuring classrooms.There are many settings that I've been able to configure by uploading custom XML, and many others that I haven't had success with. Now, I'm attempting to use the older mcxtoprofile python script by timsutton. In the README, I started to learn more about use of "always" vs "

I’m having a strange issue that started within the last week or so. Some laptops are not receiving some configuration profiles. Two profiles in particular (maybe more but this is the first I have noticed), and not every laptop is affected. One is for Jamf Connect. It’s an uploaded profile straight from the Jamf Connect Configuration app. The other is for the Root3 support app.I have tried different versions of each profile, one using the built-in Jamf Connect schemas and one with the upload. I have tried the same with the Root3 app, one using their JSON schema and one with the plist.Neither will push down to some devices. Hardware doesn’t make a difference, and neither does os. It’s happening on Monterey and Big Sur, and intel or Apple processors.I am at a loss. Logs for both say failed on the device inventory page and pending on the profile pages.We’re on Jamf Pro Cloud.Is anyone else having issues?

I have no doubt that this has been discussed before but I can't seem to find any discussions relevant to my scenario. In the event that a user locks themselves out from their machine, how can I push a policy to reset the local account password or even create a new account when the user is unable to login and the administrator is unable to get hands on the machine?

In the past we've had something way back that I could use to set the screen resolution of a Mac Mini that was connected to a VGA splitter so I could run it to the local monitor and the projector. The Mac couldn't really tell what was attached to it and set the resolution higher than the projector could handle. A login policy with the script worked great. I haven't used it in a while, but the issue I have now is a bit different. I have an iMac at the teaching station now, and it connects to the projector with the dongle out the back. By default the displays don't mirror, and again may not set the correct resolution for the projectors display. Is there something new I'm missing that I can use to set both mirroring and then both display resolutions properly with a login policy? The settings stick for a user once they set it, but it's per user so it has to happen at each login. There has never been a command line option just built into the OS for this (to my

Hello guys, we have users where the Network AD password gets out of sync with the mac when the user changes the password every 3 months or so. We have a Self Service action that updates their network password with their mac log-in password however users do not use that very often. The macs are file vaulted, how do you guys sync the network passwords with the mac log-in passwords? Is there an easier way to do that? 

ok so I am trying to make our device enrollment as seemless as possible for our workstations guys but I am not certain what the best possible options are. Does anyone have experience with pre-stage enrollment? Trying to make this as white glove as possible and its frustrating because I know there is a better way than what we have going I just dont know enough about the configuration options for the platform to be able to maker the changes we need. Any tips or pointers would be greatly appreciated.

Hi there,I'm working on a script to wipe out student mobile accounts from our lab machines.These machines are AD-bound, provisioning options are set to create mobile account at login with no confirmation.Here's the script I'm running. As you can see, very simple because all our student accounts contain the "." character (e.g. john.doe) -- # list all users with the "." character in their namesUSERS=$( dscl . ls /Users | grep -e "\." )# echo usersecho Deleting the following users: $USERS# delete users/usr/bin/dscl . delete /Users/"$USERS"echo User accounts deleted# delete home folders/bin/rm -rf /Users/"$USERS"echo User home folders deleted The script successfully removes my test student account, but then I'm unable to re-add the student to the device from the login screen after a reboot, which will prevent students from being able to use the computers.Any ideas where I could get more information on what is broken?Alternatively, if there's a smarter way I should be doing this, I'm also o

With the software updates that JAMF has implemented does this help install the latest iOS updates for all devices and bypass the users lockscreen code? 

Hello Jamf Nation! Jamf Pro 11.3.0 Beta is now available. We have many new features and refinements available, including Computer Users UI Update for Laps and ADDE for Computers. Please view the release notes for further information. How to join the beta: Enroll in the Beta Program under Product Feedback at account.jamf.com. Once you enroll you'll receive an invitation to join the Beta Forum, click "Join this group Hub" to gain access. Email beta@jamf.com with questions. The beta program is covered by the Jamf non-disclosure agreement; please do not share any information regarding your testing on any public forum, including the non-beta areas of Jamf Nation. Use the Jamf Nation Beta Forum or contact Jamf via beta@jamf.com with any questions. Thank you to all who participate in this program!

I have to ask why are we removing this ability, Im the IT guy who wears multiple hats at work, the support person, the server guy and the network guy. Removing the ability for IT admins to set a Prestage Admin account and password is just going to create headaches for the EDU IT admin. I dont think it should be forced on every one and would work better if it was a toggle switch that you can enable or opt into. https://learn.jamf.com/bundle/jamf-pro-release-notes-current/page/Deprecations_and_Removals.htmlFunctionality to specify the local administrator account for computers in a PreStage enrollment—In an upcoming release, the ability to specify or modify a local administrator account password in a PreStage enrollment for computers will be removed from Jamf Pro (estimated removal date: March 2024). 

I'm trying to configure Jamf Pro to enforce the company requirement that devices are encrypted. Created a Configuration Profile that has Security and Privacy > FileValut > Enable FileVault enabled, but have also set Event to prompt FileVault enablement > At Login and Allow user to bypass FileVault prompts at login > Require after 3 attempts. However, when testing the Configuration Profile against my MacBook - which has FileVault turned off - I am not being prompted to enable FileVault.I have repeatedly logged out/in, shutdown/started my laptop but at no time have I been prompted to enable FileVault. While my user account is a Standard user, I have tried logging in as the Admin user but still don't get prompted to enable FileVault.What am I missing?

Hello, My organization is deploying a new WiFi system/SSID. I created a configuration profile with the certificate payload and the WiFi payload. I am having trouble configuring it to connect to our SSID. The issue I am running into is that the device connect successfully the very first time, but every time the device tries to reconnect to the Wifi, it just hangs and is unable to connect. We do not want to use the "Use Per-Connection Password" option, since that requires that credentials be entered every single time the device reconnects to the SSID. We want it setup where the user has to put in their username/password credentials, but just once. I've gotten set up where they have to enter it in every time, but we want to avoid that since our devices are usually assigned to a specific person. We are using PEAP authentication with AD accounts. I am using the $USERNAME variable for the username field. Any help would be appreciated.

Hello Jamf experts, We have a weird issue that just started occurring which we're not sure if it's because of a recent update to our Jamf Cloud instance because we hadn't added new Macs over the past few months. Anyway, we have a Configuration Profile that generates and deploys a SCEP certificate along with the Wi-Fi profile that uses the certificate. All's been well until recently when we provisioned a new Macbook Pro and it just refuses to install any Configuration Profile at all (we check in the Macbook's History > Policy Logs page in Jamf). After a lot of troubleshooting which included a check on the firewall to see if anything is being blocked (there isn't) we stumbled upon the fact that when the SCEP is applied, the Macbook immediately switches to and connects to that Wi-Fi and then it fails to proceed. When I exclude the deployment of SCEP, everything works as before. Now the question is, how can I make it so that the SCEP is deployed last? I know we can d

Hi community!I need some advice regarding software installation by policy.As useres are allowed to administer their device, they also are able to uninstall packages.How can I assure, that if a software is unsinstalled, the policy will run again and reinstall it?I'm worrying if I set a policy to Ongoing or Once a day, the software will be tried to install no matter if it's present or not.

We currently don't allow end users to use iCloud. When a user gets a new phone, we use verizon content transfer to transfer the users info to the new phone. It hasn't been working great lately. Just wondering if anyone has any recommendations. Thanks.

Hi,I am trying to install Snapgene, which requires the license install script to be executed as the logged in user as described here: https://support.snapgene.com/hc/en-us/articles/10304162065172-Command-Line-Installation-and-ActivationMy first attempt was simply to index using Composer, install Snapgene, execute script, build package with composer. Didn't work.When I execute the script locally everything works as expected, whoever as soon as I try to deploy it using Jamf Pro it won't. I then tried to follow https://scriptingosx.com/2020/08/running-a-command-as-another-user/ to no avail. The license won't be installed. Is there another way, I'm not aware of, which would execute the script locally so everything works as expected?

Hello!What is everyone's take on recommended execution frequency for app updates such as Google Chrome when using installomator?I see everywhere online states to do Recurring check-in as a trigger and execution frequency as ongoing. Wouldn't it make more sense to set the frequency to something like once a week?  That way logs aren't being flooded constantly by installomator reporting the app is already up to date?

Just for better understanding:I have a configuration policy run on user level for Outlook configuration.But I only want it to run on DEP enrolled devices (Smart Computer Group "Enrollment").How would I assign the policy?Will it run if assigned to the computer group and left "Specific Users" without configuration?If I assign it to the computer group an d "All users" it is assigned to all devices, which shouldn't happen!

Hi Guys, anybody can help me to go-through the AutoPKG.How it's work and step-by-step process to create packages and deployment to target machines.

Leverage a client-side LaunchDaemon, script and .plist trio to determine computer health, based on the Mac’s ability to execute an inventory update policy Background In the spring of 2022, I renewed my Utah’s driver license and noted it wouldn’t expire for six years. When I obtained my Ohio’s driver license last Halloween, I was tickled with the option for an eight-year expiration: “Yes, please!” When I enrolled a Mac in our Dev lane yesterday, I was also pleased that its Jamf Pro-related certificates won’t expire for more than three years. (Although, by the time you’re reading this, that box has probably already been nuked-and-paved. Thrice.) If we base a Mac’s compliance solely on the presence of valid MDM certificates, we’re probably allowing too many computers access to sensitive data However, if at next week’s traffic stop the police officer simply confirmed I had a valid driver’s license and sent me on my way with a warning to “slow down” — never double-checking what I’ve actu

Hi,I'm currently experiencing an issue regarding pushing out ibooks to our student iPads. Out of the 400 students we pushed the books out to, only 30 have received them. I'm aware that books can only be distributed to Apple IDs and all students have MAIDs created in ASM and synced over to jamf school, and the ibook licences were purchased in ASM.Looking at the users where the process failed, the status for each student reads, 'The VPP user can not be found, please try to invite the user again'. However, looking at each students' profile, their service token status reads as associated and valid.As a side note, some staff members are having the same issue. Other staff members are having different error messages which reads one of the following:'Device owner is not associated, current status is Registered. Service token status: Invitation sent''The device’s user has not been sent a volume purchasing user registration invitation. Service token status: Associated'Any help regarding these is

I've been using a script I found on Jamf nation to remove student profiles. I've been using it for over year and never had issues until recently. What's strange is it works fine on some devices (Ventura and sonoma), but on some devices it doesn't work at all. The problem devices do not have file vault enabled. They are all supervised and managed.Here's what I'm using#!/bin/bash # Get a list of all user accounts user_list=$(dscl . -list /Users | grep -v '^_') # Specify the admin account(s) that you want to exclude excluded_users=("root" "account1" "account2" "account3" "account4" "account4" "account5") # Loop through the user list and delete user profiles except admin accounts for user in $user_list; do if [[ ! " ${excluded_users[@]} " =~ " ${user} " ]]; then if [[ "$user" != "Shared" ]]; then # Exclude 'Shared' user echo "Deleting user profile for: $user" sudo dscl . -delete "/Users/$user" sudo rm -rf "/Users/$user" fi f

I've been working on improving our Jamf Self Service and how we offer applications to our users and set up their initial computer.Some of our users have had their machines migrated to Jamf from other MDMs or they were set up before we had some of our current Jamf practices in place. This means that even though someone may have Office installed on their computer, they will still see those individual apps for Word, Excel, etc in their Self Service store and they are available for installation.Is there any way to change this other than having them uninstall and reinstall using the self service applications? I'd like to find a way for these previously installed apps to be "recognized" by Jamf so they don't allow people to install a second copy over top of them. I'm worried someone is going to click install on one of these and it's going to break their app because of conflicting versions or editions.

We have been using Oomnitza to pull inventory records from Jamf for a while. Unfortunately it seems like this stopped working suddenly when we upgraded to Jamf 11. We have tried the following: 1. Enabling the user to have the SSO edit option. 2. Creating a new user specific for this. 3. Creating a full permission user to access the integration. 4. Changing the password for the integration user. nothing seems to be working. Is there an API change with Jamf 11? 

I passed the exam and received my badge, work is looking for a paper certificate. How long if at all does a cert show up on your profile so you can print it out.