Is there any way to manage Screen Time/Downtime settings through JamfPro. I work at a school with a 1-1 MacBook Air program and our we want to set the computers to be unavailable during late night hours. I used to be able to manage this with a parental control config profile, but those don't seem to work under Ventura/Sonoma. Has anyone figured out a way to setup downtime hours on MacOS through Jamf Pro? Thanks!

Hello Everyone,As part of providing solution to a use case, we wanted to prevent user to create new profile in Safari 17. As per attached image, is there any setting in MDM using which we can disable this 'Start using Profiles' button  ? Thanks in advance ! 

I'm testing RealVNC Server for some of our users.When I install the Server App it asks for a bunch of approvals for pppc settings things like Accessibilty, and Screen Recording and when I look in there I see that these have been given to vncagentI used the PPPC utility to get the info for Identifier and Code Requirement and made the settings in a Jamf Configuration profile but it didn't seem to effect the computer as when I install it still prompts me for those settings.So, I created a configuration profile with PPPC Utility, and used the upload feature in Jamf Pro configuration profiles area.  That profile looks the same as mine but again still not working on the client as I still get promptedHere's screen shots of the Configuration Profile in Jamf  Any ideas on what might be the issue?  

I've setup the latest integration between Jamf Pro & inTune for Device Compliance.This is working as I can see the device in Azure as showing as compliant when I check the users devices.When I create a conditional access policy to grant access to compliant devices and one of these compliant devices tries to connect, the conditional access policy is showing as "Not Satisfied" "Require compliant device".Has anyone setup the jamf & inTune device compliance and have conditional access policies in place which are reporting that the mac device is indeed compliant, more than likely a issue with Microsoft but just want to check at least someone in the world has all this interaction working correctly & successfully with conditional access policies ? 

Happy Monday All!My organization has about 40 TVs scattered across 21 locations all over the Upper Midwest (Minnesota, Illinois, Iowa, Missouri, North Dakota and Wisconsin). TVs are generally used in the common areas of our locations to display video content for customers and in employee break rooms.Less then a dozen of the TVs were purchased through our business account with Apple and show up in ABM and JAMF. The other 30 or so TVs were purchased from various 3rd party retailers and of course do not show up in ABM or JAMF.We've recently learned that employees at our locations have been signing into their personal AppleIDs on the TVs and signing into their personal Netflix/Hulu/HBO accounts. We want to prevent this and standardize the video content experience at each location. (We have a solution in place for the content part.)So my question is this--how can I add all of these rouge 3rd party purchased TVs to JAMF? I am hoping that it can be done remotely and that I do not have t

Hello everyone,I'm new to Jamf and Jamf Protect, and I'm experiencing some difficulties creating profiles to ensure compliance with the CIS benchmark. While I've managed to make some profiles, there are specific baseline policies that I'm uncertain about. I want to enhance the security of Mac devices and enable the necessary roles. Can you please assist me with this?Thank you!

Hi, Bit of a noob here. I'm deploying a PKG via Self Service which works fine. I then want to run a "defaults write" command afterwards to set a default for the app. In my policy I added the app and then a script to run the command. Both show as successful but on the system I see no evidence of the defaults command actually doing anything. If I run the command via terminal it does what I expect. Any clues as to what I am doing wrong? Thanks

Hello, With Sonoma releasing soon, I wanted to dive into the new Software Updates feature. However, I am worried about enabling this feature and having pending updates messed up. Is there a way to see what these "in-flight updates" are for specifically? The guide below has the following warning. It seems like if I enable Software Updates Beta, I would have to re-deploy these updates, but since it is unclear what these updates are, I hesitate to enable it and ruin any pending updates I am not aware of. "Warning: Enabling the (Beta) managed software updates feature will cancel any in-flight updates. In-flight updates include any update commands that have been deployed from Jamf Pro but have not yet completed on the end user device. You can re-deploy these updates with the new experience."Any one know where I can find out specifically what these in-flight updates are for? (Beta) Updating macOS Using Managed Software Updates 

I have had two 14-inch M1 MacBook Pros run into issues applying minor updates. One was going from 13.5.2 to 13.6 and the other was 12.6.9 to 12.7.1. The Ventura machine never made it to 13.6, but the Monterey machine did manage to finish updating to 12.7.1. The authenticated restart allowed it to even check-in/inventory with Jamf.In both cases it appears that something went wrong and the result is that video doesn't work. The video cuts out as soon as your try to go past the initial startup chime and Apple logo. Holding the power key down displays the messages to get into startup options, but loading startup options is the last thing you see before it disappears. It seems like there is something wrong with the iBoot, but I am not sure what I can do about that.The only thing that works is to DFU revive the machine and go directly into recovery. If you select the SSD as a startup disk the issue returns and you have to DFU all over again. At that point you share the disk and get their dat

Hi All! I've recently run into the issue of users receiving an admin popup when trying to print. Of course I've found the solution of adding the users to the printer admin group. My main question is two-fold. 1. Is there a better way to do this, without adding them to the printer admin group? I've found some information around creating a custom CUPS policy that allows regular users to have more rights around printing, but haven't researched exactly what's going to be needed here, as it seemed like it was going to be very complex and time intensive to make work correctly.2. What risks are present from adding users to the printer admin group? The info I found regarding the CUPS policy pointed towards users being able to add and remove printers, meaning they can run printer install packages as root. This info i found was a little dated and I am not sure how much of that info may have changed in the meantime with recent OSes.Any help is greatly appreciated! 

I might be overthinking this...?I downloaded the 2023 version of the Avid Complete Plug-Ins Bundle and went to package it in Composer. Then I realized each plug-in is its own .pkg file, within a .dmg that unzips into a folder. Rather than having to manually install about a dozen plug-ins one by one, I used a post-install [shell] script. This is essentially the script (except each plug-in has its own line- I tried using a for-if loop and for some reason it didn't work, so I just did it this way):sudo installer -pkg //path/to/package.pkg -target //folder/where/it's/goingSo I realize it's really primitive, but it works- only after the installer completes, the original folder within the package (containing the plug-ins) is still on the Desktop- and it's not empty. So I'm figuring that this script duplicates the folder in order to install it in its proper destination..?I initially tried doing this using Snapshots but it took way too long. My other thought was simply to scope the packag

with Jamf 10.50 pro cloud now, we have JAMF laps using JAMF api. (https://learn.jamf.com/bundle/technical-paper-laps-current/page/General_Requirements.html)however, i do have 2 question.1. Can we define the password requirement for JAMF laps? Lets say I want so that the password will only have 15 characters and it only have upper case, lower case and number. can i define this?2. I had a look of this post. (https://community.jamf.com/t5/jamf-pro/retrieve-laps-password-straight-from-the-jss/td-p/297146) and I was wondering can we parse/escrow the password from JAMF LAPS to some extension attributes? By doing this, any admins who can login to jamf pro portal would be able to see the admin password. 

Hi All, I wanted to share this with you, it's a bookmarklet. https://pro4tlzz.github.io/JamfGetLapsPassword.htmlFollow the instructions on the page to add a button to retrieve the LAPS password straight from the JSS for a computer device. You can also reissue Jamf Pro Management Framework straight from the JSS with this bookmarklethttps://pro4tlzz.github.io/JamfHealComputer.html Enjoy

Hello Jamf Protect Community, I received an alert with the Description: JamfProBinaryModified.... Jamf Pro Binary Modified or Removed. Below I will copy information from the first two pages of the of the alert. Has anyone encountered this before and if so what resolution did you come to with it? It seems to be related to the appstore but I'm not sure why exactly this is happening and why Jamf Protect isn't simply marking this as Informational if that's what it is.----  Summary Page:JamfProBinaryModifiedThe Jamf binary is responsible for most of the actions taken by Jamf Pro. It is located at /usr/local/jamf/bin/jamf (alias at /usr/local/bin/jamf). If this file (or its alias) is moved or damaged, Jamf Pro will be unable to perform remote management actions. While an attacker might theoretically disable Jamf Pro to subvert its security controls, this detection is aimed at the end user disabling Jamf Pro without authorization. This detection alerts when the Jamf Pro binary

I'm trying to make an adjustment to the Outlook app for iOS and enforce Biometrics for the app. I have tested the following settings and know they work on a net new app deployment:<dict><key>com.microsoft.outlook.Auth.Biometric</key><string>true</string><key>com.microsoft.outlook.Auth.Biometric.UserChangeAllowed</key><string>false</string></dict>I'm trying to understand if I add this to my existing App that's deployed across all my iPhones currently if they will just update and enforce biometrics, or will I have to uninstall and then deploy the new app with the settings added?

I am looking to see if there is anything like the Make Me an Admin script that will work in macOS Ventura.  The current script does not work in Ventura. I don't get any report of errors just doesn't make the account an admin account. I do know about Privileges. I wanted something I can control the time the account is an admin. I only want to allow the accounts be admin for 30 minutes.

Testing Scheduled updates and this seems to work as advertised. I set a time and the device updates. But.. I cannot find a way to stop the update or change the date or time once sent? Sending a revised date / time via the beta Software Updates does not override the previous command.Removing plist lists for software update makes no difference and this is all DDM / jason.. Anyone dug further? 

Just wondering if any have managed to get the single sign on extension working with Google Chrome and Teams.  I can get SSO working in Outlook, but not in Chrome and teams, where I need to enter both Email adress and password when opening first time. 

We have a good number of mac devices are connected to internet, speaking to JAMF console and have the proper APNs connectivity but still JAMF is not deploying the pending configuration profile, if it is deploying then it is also slow, do you think if we have a good number of config profile created for deployment then it might be slow, or it has different causes? What is the resolution here?

Hi there,we are in the process of migrating users from one Office 365 tenant to another, and as part of the process we need to reset all Office apps running on macOS devices enrolled also in a new Jamf Instance. However, I am having some when resetting all Office apps on macOS devices. The old OneDrive volume is still visible in the side bar favorites in Finder. I can get everything else working using Office-Reset and an additional line that I am running to remove the OneDrive folder from the user's home directory, but I can't get the old OneDrive volume removed from the side bar in Finder. I have even tried uninstalling and reinstalling OneDrive. Please note, I only want to remove a specific OneDrive volume from the Finder sidebar  without affecting other favorites using a bash script, so resetting the plist is not an option for me as it will affect other favourite settings.. so far I have tried the below two scripts, but neither of them seem to do t

Are there any known problems with the 17.1 update and especially Apple TV (no 4K)? tvOS 17 pushed to our devices without problems, installing 17.1 delivers the following error "Jamf School cannot determine the OS update status. The update likely failed on the device."

Uploading any packages via the web interface immediately fails when clicking "Save" with a message, "Package failed to upload". Tried different browser, different computers, different PKGs, all the same result.The packages are not large or exotic. Any ideas?

Hi everyone,We're looking to harden our Jamf Pro environment and have a few questions before we proceed. Right now we have SSO turned on and pointing towards our IdP and it works fine. However in the Options section of Single Sign-On we have the following:Allow users to bypass the Single Sign-On authentication TICKEDI'm looking to turn this off, my question is will our break glass non-directory user account work still at the Failover URL we have generated?Enable Single Sign-On for Self Service for macOS TICKEDLeave this as-isEnable Single Sign-On for User Authentication during Enrollment UNTICKEDI'm looking to turn this on - will this redirect users to our IdP login page when they enrol a Zero Touch device?Enable Single Sign-On for Account-Driven Enrollment UNTICKEDAlso looking to turn this on, but it sounds a lot like the option above so my question is what is the difference?Once we have made the above changes, there's one more thing I'm looking to change if possible - in Enrollment c

Hello! We are in the process of implementing Cisco ISE in our environment. We are at the very beginning stages and are doing some information gathering for how we will configure ISE for all of our separate device types.We are using the "Essentials" session licenses for Cisco ISE so we are not able to integrate MDM capabilities directly into ISE and will instead be using certificate-based authentication against ISE to allow MDM devices onto the network. We would be using ADCS to pass out the certificates to the devices but were unsure how this would exactly work to pass local certs from our ADCS server to non-domain joined devices. I've seen this doc: https://learn.jamf.com/bundle/technical-articles/page/Integrating_Jamf_Pro_with_Cisco_ISE_3-1.html but just wanted to make sure that the processes in that doc are allowed with our basic license level and also if this doc is hitting the areas that are in question for me. What are other people doing to get the c

Hello Everyone,As per our company standards we need to disable the Safari profiles and Password Syncing with iCloud on macOS Sonoma, we have tried with some plist but that didn't work and does anyone has plist to block or disable the Safari profiles to iCloud. Attaching the screenshot for reference.