Hi Everyone,Fairly new to JAMF here. I have all our campus Ipads in Apple School Manager. They are linked to JAMF now. I see the Serial Number in JAMF. I make sure it is checked and the ipad does not pick up remote management despite erasing it a couple of times already. Is there a step I am missing?

Dear all,I have some enrolled devices with Jamf Pro and with a managed Apple ID with problems to synchronize with iCloud Drive. It says that Mac can not synchronize with iCloud Drive.I have not activated any restriction in Jamf for this purpose. And it appeared suddenly and only in specific computers.How can I manage options to be applied to each managed Apple ID. No options from Apple Business Manager, but possible to act from Jamf Pro?Thanks!!!!

The script I run to enable Remote Login and Remote Management has been the following:#!/bin/sh # enable remote management for ardadmin /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -activate -configure -clientopts -setmenuextra -menuextra no /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -users adminuser -access -on -privs -all /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -configure -allowAccessFor -specifiedUsers -privs -all /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -targetdisk / -restart -agent -menu #enable remote login for ardadmin sudo /usr/sbin/systemsetup -setremotelogin on sudo dseditgroup -o edit -a adminuser -t user com.apple.access_ssh exit 0We just upgraded many of our computers to macOS Ventura.  I've noticed with macOS Ventura that when tryin

Hi Guys, working on a project where i need to force install certain extensions in Edge. They Keys are there and I have tried configuring using profile creator, JAMF JSON and BIll's JSON. No luck. Edge sees that its managed and allowed extensions install no problem. Blocked extensions are blocked, but those that should be force installed are not working. reaching out asking am I missing a recent change and if anyone has these working? TIA

We create a local user account for administrative tasks as part of our imaging. What we're seeing is that we'll receive a unit with some issues where we need to use that account, and the password won't work. This is not very common, but it is happening sometimes. We'd like to create an Extension Attribute that checks that account and validate if the expected password works, and if not, scope a policy to that smart group to reset it. I did see one slightly complex script here:http://www.yourownlinux.com/2015/08/how-to-check-if-username-and-password-are-valid-using-bash-script.html But it doesn't appear to work any more since the shadow hash is now under /var/db/dslocal/nodes/Default/users/<USERNAME>.plist Before I start working through that I wanted to check if anyone has any other suggestions/solutions. Thanks

Created this for myself and thought I would share. It should match all devices which will be unsupported by macOS Sonoma upon release. The benefit of matching unsupported instead of the other way around is that it should not need updated when new devices come out. If you need a smart group for supported devices instead then simply swap the operator to "does not match regex."To use, create a smart group named something like "macOS 14 Sonoma Unsupported Devices" with the following criteria:Model Identifier matches regex ^(iMac[1-9],\\d|iMac1[0-8],\\d|Macmini[1-7],\\d|MacPro[1-6],\\d|MacBook([1-9]|10),\\d|MacBookAir[1-7],\\d|MacBookPro[1-9],\\d|MacBookPro1[0-4],\\d)$  

We are a K12 private school. Our high school and middle school students are all using iPads to complete their schoolwork. Lately, we've had students come into our tech office that is having trouble taking and/or submitting tests. It turns out that quite a few have iPads at the lower limits of battery activating "low power mode", which stops background app refreshing causing them to be unable to continue their testing. Is there a way to disable Low Power Mode in Jamf Pro?

Hello,I have few iPad who get lock by activation lock, I would like to grab the code from command line ...I found that site https://github.com/dnikles/removeActivationLock who explain how to do ... but the Phyton part is not working when you have the SSO on console activated.. is there a direct API call we can do with the current version?

 Our current Nudge configuration. The Nudge button "Update Now" is only opening the MacOS Sonoma Installer application that requires admin credentials. It won't open the Self Service update policy that we have. We need the Self Service update because it doesn't require Admin credentials. The regular Sonoma app installer update just started requiring admin creds as of today for our Org so we can't use it anymore.  Anyone have the actionbuttonpath field working to open Self Service in Nudge?

As a part of standard security audits, we like to rotate the local admin password we have on our mac computers every so often. This worked well enough a year ago, however I did notice some outlier computers where there was an error saying that the admin password could not be changed due to the Secure Token. When I most recently tried to run the same script that previously worked, not only did it not change the local admin password, it seems to wipe it completely where I can no longer login using either the new or old passwords.I've tried many different workarounds to try and get the local password to change, including using Jamf's built in Local Account Management policy, and using scripts with the sysadminctl command and have thus far been unsuccessful. Some things I found in my reserach are that there must always be an admin account present on a mac, and one client must always have a SecureToken assigned before login. The most recent workaround I tried is listed below, wherein I crea

I have a computer that is already in use, which just won't register correctly in Jamf. It's registered in DEP and assigned to Jamf Pro. In Jamf Pro, the serial number doesn't show up in device search. When I trigger the re-enrollement with the user ("sudo profiles renew -type enrollment") the enrollment-flow starts as expected.However, at the end it stops with an error message "Install profile failedYour computer is already enrolled in an MDM server and can only be enrolled in one MDM server at a time". In Jamf the serial number now shows up as "DEP - [SERIAL_NO]". The username in Jamf pro is not populated (though it was collected in the flow).Also, the `jamf` binary is not installed.In the user's System Settings, only 3 profiles are listed. They have names I don't recognize, but I can't remove them. However, it is stated that "This mac is supervised and managed by: Archipunt", so it might be old profiles from our MDM (the computer is bought in 2020, and we were using Jamf Pro bef

My company is about to deploy a bunch of machines. We have set up several prestage enrollments for the computers to be set to the proper building, department, etc. Is there a way to assign machines in bulk to a prestage with something like a csv file?

How do we set up a curfew from 9pm to 6am on student M1 MBA Macbook airs running Ventura or Sonoma?

Hello.  This is more of a Microsoft question, but i'm not having luck down that route yet. We want Jamf Cloud to manage all of our institutionally owned iPads with MDM.  We want Intune to manage all user-owned Apple devices with Application Protection Policies.  The problem is, users only have 1 account.  So if they sign into a corporate iPad, they get a mix of both Jamf MDM configuration profiles and Intune application protection policies on their corporate device.  We want the Intune Application Protection Policies to ONLY apply when a user signs in on a personally owned device, and not a Jamf managed device. I don't know if that is possible since scoping an Application Protection Policy is based on AD group.  If their ID is in that group then they get Intune App.  I don't see any other criteria to filter out a device if it is Jamf MDM managed. Has anyone run into this or found a solution? Thanks

Warning: I'm just learning how to script using The Odin Project. This is a crude, but so far is effective way of checking to see if my users are on a particular wifi network, and switch them over to another as needed.Problem: We're moving away from having static admin accounts deployed on our devices and are trialing the creation of just-in-time admin accounts when servicing a computer.For this to work, wifi needs to be enabled at the MacOS login screen (NoMAD 1.5). This is achieved by pushing out a computer level config profile with a wifi payload, Wifi A. So far so good. Wifi A is heavily restricted and does not allow general internet access.However, after the user logs in, they will then have access to our normal enterprise wifi - Wifi B.How can I then ensure that my users are always connected to Wifi B upon logging in? I decided to create a launch agent that runs every 60 seconds and checks for the currently connected wifi network. If the user is found

I have a policy in Self Service that deletes a "Temp" local user account and then recreates it. We use this for lending out laptops to students so that we can delete and re-add the account every time it is returned so that we can re-lend it out with a fresh account. I would like to apply a new policy that forces the "Temp" account user to reset their password once upon first login after the account has been recreated via self service. I was planning on using the command: pwpolicy -u "$LOGGEDINUSER" -setpolicy "newPasswordRequired=1"If I scope this command in policy to a smart group that looks for the Temp local account and then runs once per user at login will this accomplish what I need? The trick is I don't want this command to run when any other accounts login and only want it to run once when the Temp account logs in for the first time after being re-created and then only again when the account is removed and recreated and logged into for the first time once again. If I use a

Anyone have a script or extension attribute to pull this info, I am looking for the type of display connected i.e. Cinema, thunderbolt, other?

I have a team of people using Final Cut Pro. This team is very sensitive to updates to FCP and their tools (as it should be) so I need a way I can make FCP available to them in Self Service - and when they want/need to update they can in self service.I am sure other admin face this. Anyone have a "recipe" I can follow?

We are deploying Cisco Anyconnect with Umbrella on our fleet of 1000+ machines. Our secops team has dictated that the firewall must be set to block all incoming connections. We cannot get Umbrella to show protected with this firewall setting enabled. When we turn it off, Umbrella works great, but incoming connections are allowed. Has anyone got it working WITH the incoming connections blocked?

Hello All,Need a help on base64 encoding for Nudge for icondarkpath iconlight path screenshotdrakpath and screenshotlightpathif I use a .jpg or png and use base64 command to generate a base64 code then what I should do with these big string generated by base64 CLI? Should I paste the big string in the path in my config profile instead of the path of .jpg or png file on end point(Mac) ? Or I should do something else? Please guide me, I dont push the .png/.jpg on mac through a JAMF policy.

Both our cloud hosted Production and Dev instances are having errors with SSO starting today.  Anyone else experiencing this issue?  I just submitted a ticket into Jamf Support.  Checked with our web team and nothing has changed on their end.  They dug into the logs and came up with this:Finally was able to find a message in the Shibboleth IdP logs.  Based on the SAML metadata, the request from the service must be signed but it is not.  This is a setting at the Jamf service and my guess is that it was changed.

I try to add shared mailboxes on a managed iPhone in the Outlook App. The Exchange is hybrid On Premises and M365. But the Shared Mailbox option is missing on my devices.If the devices are unmanaged or managed by Intune, the option appears.Is there a config parameter missing to enable the function in Jamf Pro?

We are trying to modify our com.google.chrome.plist to allow two extensions to be installed by end users.  We block all extensions in our .plist file by using the "*" wildcard under "ExtensionInstallBlocklist", and have now added the "ExtensionInstallAllowlist" policy with a string containing the two extension ID's.  The chrome://policy page shows that both of the policies are OK so they are being recognized and should be working, however, when installing those two extensions they still say they are blocked by the administrator.  The Chrome policy description page shows that blocking all extensions and allowing specified ones is the way to only allow just certain extensions.  Is there something I'm missing here?Here is our plist, website url's have been removed:<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>B

Hi All,We have been working on setting up Device compliance with EntraID for a while and had everything in place to begin rolling it out this week, everything was working as expected with devices being marked with the correct compliance.  As of Friday all of our test devices were marked as non-compliant and registering devices now seems to take significantly longer than usual, almost as if it's waiting for a 24hr sync before the devices are marked as registered in Intune and marked as non-compliant.  This seems to coincide with the timing of our update to Jamf Pro 11.Devices and users are in the correct groups and everything still appears normal from a setup perspective.Has anyone else had similar issues?Thanks,Ryan

Hi,If the devices are enrolled via UI method, the activation lock is not working on the devices to unlock them.Jamf informed us If the activation lock has been enabled THEN enrolled into Jamf Pro the activation bypass code will show but will not work in this case. The only way to get that machine unlocked is going to apple What should be the workaround apart from reaching out to Apple?