Hello this is my first posting.I have an issue on one of our iMac, I tried to re-enroll and install MDM profile but says cannot install the profile. tried to remove is using "sudo JAMF removeFramework" but says "command not found!" tried to checked the but no "JAMF" folder exist. MDM profile exist in System Preferences.Is there a way to manually remove the MDM Profiles?

Hey All,First time poster so be kind :-)Setting up a Jamf Pro solution whereby we are setting up ADE enrolment for new device but also migrating devices from a different MDM vendor solution. Solution Jamf Pro integrated with EntraID/Azure for cloud IdP and also SSO to entra, Jamf Connect is being used. Devices are off corp network and have no direct sight of on premises AD i.e no Kerberos.Migrated device have local mac accounts that use the sAMAccountName (which is being mapped to EntraID (OnPremisesSamAccountName). I have configured the SSO and Cloud IdP Entra Mappings for the migrated devices so that during enrolment the device populates the User and Location inventory with all the user info. As most devices will migrate initially this is currently more important than the workflow for new device enrolments. We are migrating Macs using Jamf Migrate tool as an FYI.However, so the issue we face is with new enrolments in that they take the email/UPN as the local account name firstname.su

So I have an App that needs deploying on a group of shared iPads used by our students, within the plist file xml that's added to the apps respective config tab, there's a UniqueDevID key which I would want to pass a variable to at install.The most obvious variable would be the devices name as specified in Jamf. How could achieve this?

Hey All!Being that this is my first post here, I thought I'd front load this with a little about this meetup. We run a monthly virtual meetup the first Friday of every month (except when it falls on a holiday). We bring in one of the largest groups of experienced Jamf Admins to discuss all things regarding Jamf. During the hour we run through the newest Jamf and Apple updates followed by a Keynote by Guest Speakers and our own staff. We think it's a pretty great community where ideas are shared and questions are answered.This month we're hosting Elliot Jordan to discuss the new tool Escrow Buddy. Escrow Buddy is a brand-new open-source tool for Mac IT and security administrators who escrow FileVault personal recovery keys to their MDM. For Macs that do not have a valid recovery key in escrow, Escrow Buddy securely and transparently generates a new key during the standard macOS login process and triggers its escrow. In this session, Elliot Jordan will cover the reasons FileVault recover

Hi all,I've got someone with a 2015 iMac with Monterey 12.6 installed, trying to install MDM on it. We are able to download/install the CA profile but when trying to install the MDM profile it errors (profile installation failed an error occurred while trying to import the certificate or identity). It had been up for a fair few weeks and I thought a restart would fix it as it usually does but it didn't. It has Sophos installed, we disabled it and tried again but still no go. We updated to Montery 12.7.1 which I think is the highest it will go. Any ideas why it won't install? 

we have been deploying new M1 macbook air machines since July.  we changed our deployment workflow this year to use a workflow in MDS to deploy the os (big sur) and packages (instead of pushing packages/policies over the air through JAMF).  we skip the setup assistant and enroll into mdm through user enrollment.we haven't had any issues except that recently our users started getting the device enrollment notification saying that our organization can automatically configure their mac... even though they have the mdm profile installed and we're actively managing machines through JAMF. has something changed in big sur where this is now expected behavior?  i should hope not... any insight would be appreciated. 

Hello everyone,I am wondering what they proper way is to set up the following....I'd like to allow folks to login with their personal Apple IDs to use iMessage and to be able to connect their AirPods to their MacOS computers but then restrict everything else in iCloud (iCloud Photos, iCloud Drive, Find My, etc.). I see where you can apply iCloud restrictions via Configuration Profile but not sure if applying these also conflict with allowing the aforementioned items I'd like to leave open. Thanks in advance.

Hey Everyone, I know how secure tokens work, I know how to give them out. I have a particular question about having them automatically enabled without having to log into the account manually on each machine. I have it enabled so that every account can have a secure token, when they login. The issue I'm having, is my Local Administrator account.I have my management account as JAMFADMIN, and my local administrator is just "administrator". That's the account I use to reimage machines and do maintenance/updates. As we know, M1 machines need to have the account doing updates/OS installs to have a secure token. I have this account being made on Enrollment, so it should get one. The account is on the machine, but if I do a remote command to do an update, the secure token isn't enabled until I physically go to the computer and log into the account. Then it's available. Does anyone know how to make this token appear, without logging in?If anyone needs any other information, pleas

I just got autopkgr installed and it's copying the built packages to my distribution point. What it's not doing is creating a policy. I've checked that the account has the privileges specified in the readme. I don't see anything helpful in the logs. Anything else that I can check? The category already exists in Jamf, so it should just show up in the category?

Am am trying to secure our jamf pro portal but cant seem to find any documents on this and cant see anywhere to add it in JAMF pro, has anyone secured there logins with 2fa 

I have a script that will do the following: Create a local account based on admin pop-up box and rename the mac to this username-last4ofserial#. The account that is created is in LDAP format and is the user that I would assign in JAMF console in the user location field. I have LDAP fully set up in JAMF pro how can I make an API call to grab the username from the user account or the computer name and update the user location fields in JAMF pro console?

As it is the holiday season, I wanted to offer up a little gratitude in the form of boilerplate code related to topics that come up in the macadmins #scripting & #bash channels again & again. I hope people find it here & find it useful. 1) Logging is always a hot topic. "How do I create a log for my script?" "Where should I write log output?" etc. Without saying this solution is definitive, the script below has a pattern that I have used over & over. In fact, I paste this block exactly into any script I create that needs logging. It uses tee along with exec & with a named pipe. Why? Well, I find this works in all situations to capture all foreground & background processes executed by the script & it creates a dedicated stream / file for the log output regardless of what the script is trying to do. 2) Jamf API. I said in an earlier post I had come up with the shortest, bestest version of making an API call with token auth. I was wrong. I made it shorter

Hello,Posting to the Jamf Community for the first time so I hope I'm in the right place :) We use Jamf Pro to manage MacBooks and iPhones. These devices are corporate devices and registered with Apple Business Manager. The MacBooks and iPhones have been successfully registered and they now also appear within Microsoft Entra as 'Entra Registered'. This was achieved by getting the staff member to log into the Microsoft Entra app on their iPhone and MacBook.Is it possible to have these iPhones and MacBooks appear within Microsoft Entra as 'Entra Joined' instead of 'Entra Registered'.'Entra Joined' means they are corporate owned devices.'Entra Registered' means they are personal/BYOD devices.

Good Morning/Afternoon,I'm trying to add a Sub-Menu with some common links that our staff and students use.  I got the menu to show as "Actions."  Shouldn't I be able to name it "RBS Links" using the MenuText key? Am I not placing it in the correct spot?See plist:<plist version="1.0"><dict><key>Actions</key><array><dict><key>Action</key><array><dict><key>Command</key><string>url</string><key>CommandOptions</key><string>REDACTED</string></dict></array><key>Name</key><string>Launch LMS</string></dict><dict><key>Name</key><string>separator</string></dict><dict><key>Action</key><array><dict><key>Command</key><string>url</string><key>CommandOptions</key><string>REDACTED</string></dict></array><key>Name&l

Hi,I'm reaching out to see if anyone has found a way to enforce the Do Not Disturb feature while driving. We are trying to limit employees from texting or emailing while driving. Does JAMF Pro allow for this? If not, have you heard of other apps that would reach the same results?

Hello everybody,I’m quite new to all this JAMF settings and configurations.In the next weeks I will have to roll out new  iPads to our teachers to replace their 5 years old 32GB iPads with the newer 64GB devices.Old and new devices are/will be managed with JAMF School.Is it possible to setup the new iPads by using proximity setup as you would do on a private iPhone when switching to a newer iPhone?Thanks for your helpGerard 

Dear allWe have been using personal iPads for students for a couple of years now, managed with Jamf School. Lots of teachers regularly restrict the functionality of student iPads, especially during tests. However, during exams, things are organised differently: students are put together in large places, such as the sports hall. In those circumstances, restrictions are sent to more than 250 students, with a time limit of several hours.While this procedure works in smaller groups, there are lots of delays and failures in larger groups. Furthermore, the time limit is not always working: often we receive calls or mails from students at home, complaining that their device is still restricted.Does anybody know of any limits to the number of iPads/devices to restrict with Jamf Teacher? Are there best practices you know of, that might impact this situation?Thanks!

Hello everyone,yesterday, I pushed out the update to our 150 Shared iPads and today I saw, that they all lost their wallpaper, WiFi as well as the complete connection to our MDM. A connection with Apple Configurator 2 was not possible, too. The devices did not check in anymore and our team had to reset all of them via Recovery Mode.We are using Jamf School.Anyone having a solution for this?Thanks!

Can someone explain why certain Jamf policy 'User Interaction' notifications appear in the macOS Notification Center, and other polices (that are configured identically) have notifications that appear in a jamfHelper utility-style floating persistent windows?

So, we have the global setting in place for auto updates of mobile apps. Up to this point, we didn't have any issues with any of them. Today, on one critical business app, the dam broke with issues when the latest version made it onto several devices. I immediately paused auto updates for now. The people who support the app are working with the vendor for a solution. Question is this, if I find a device with the previous version still installed, is there a way to extract the previous version from that device and upload it to Jamf. In essence, a manual rollback. I realize there's no way to rollback the version in a traditional way.  

We are having a terrible time with filevault and want to find out if there was some kind of definitive guide to its implementation.  Right now we are binding and using AD accounts (Implementing Connect in 2024.  Would love to hear if this would help our situation) to login.  When a user changes their password it seems like we need to disable filevault, to reset the password and then reenable filevault otherwise the changing the password through system prefs doesn’t work.  And end users can’t disable filevault this because they aren’t local administrators. Questions and issues I have:Are we supposed to use a policy or a configuration profile in Jamf Pro to enable it?  Pros and cons?We have shared Macbooks that we need to be able to logged into by new users on a regular basis.  How do we enable that new user to automatically get access to a filevault encrypted drive? Based on this should we be using an institutional key or a personal key, or does that n

I'm trying to create a smart group to check to see if the anyconnect compliance module is a specific version. Our network group is in the process of updating our ISE Compliance on the backend. We're assisting with providing devices so it can be done in waves. On the windows side of things, they have he ability to grab the compliance module version to verify. I'd like to do the same for the Mac side, so when it's updated on the backend, we can confirm it's running the correct version. I've went through the different criteria's and can't seem to find one that fits it. Just checking to see if anybody has any ideas on gathering this info to be able to verify it.

Just doing an industry survey. Those NOT in education, do you lock the wallpaper for your users? 

Hi Folks,I need some assistance. I have been trying to onboard M1/M2 through prestage enrolment and it's failing due to rosetta2 not being available as some apps not getting installed properly. Can anyone suggest to me step by step process on how to install rosetta2 on those macs before any other application?  Thanks,Rish

I think I know the answer already but wanted to give it a shot here. I have a machine purchased in June 2023 from a employee that departed the company in November. On the last day part of the procedure is an IT team member will Jamf lock the device note the code and then get the machine back from the former employee.Seems after the machine was returned a team member thought they already unlocked it and completed a wipe and then deleted the machine record from Jamf. Well now its on a Jamf lock screen and the 6 digit code isnt working or the person wrote it down wrong. It is still in ABM but I am not sure how to unlock it since its out of Jamf, even if it were still in Jamf idk how one would unlock it without the 6 digit code. I tried DFU revive but that didnt go anywhere.Wondering if anyone has any thoughts or just release it out of MDM and e-waste?