THANKS DEAN! THIS WILL BE GREAT! See you at JNUC!

My organization is looking to enable the firewall but allow AirPlay, Remote Desktop. Has anyone successfully created a Config Profile that would allow this? I can see some options when I'm in the System Settings -> Network -> Firewall pref panel but those options aren't available in the config profile. 

I've gone through different discussions here (old ones) and just with a question. I can see there's no official way to set default browsers in Jamf Pro.  The only way of accomplishing this would be to either:A.) Create a script setting the default browser and deploying via a PolicyORB.) Create a custom configuration profile using iMazing Profile Editor, export it, sign it, and upload it to Jamf Pro.Has anyone done either of these and can facilitate further input so this is pushed out to a mac fleet? Your input is appreciated - thanks!  

Hi Jamf Pro,I have a user reporting that they can only use their touch ID when unlokcing from sleep, but not if they completely sign out or restart the device. I have Allow Touch ID selected in my Restrictions Config. Profile, but I'm wondering if I'm missing something else. I don't think there are any conflicting config. profiles or policies but I do have a login profile --I didn't see anything about touch ID in the Login Window payload so I assume this isn't an issue but hopefully someone can give me further insights!Thank you,G

I am hoping for a resolution for a teacher. She would like that when students open an app, they cannot close that app or open another without permissions or a passcode. She referred to this as guides access but I am sure if that is the solution she needs. Any suggestions would be appreciated.

Hello, Question: How do you write the exact text to the file instead if it spelling out the $PATH ??I am trying to copy a line with the echo command to a text file. The command works, however it writes the actual path instead of the text itself. Example: echo "export PATH=~/.npm-global/bin:$PATH" | cat >> /Users/$CURRENT_USER/.profileWrites: export PATH=~/.npm-global/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/local/jamf/bin Instead of " export PATH=~/.npm-global/bin:$PATH " I am scratching my head on this and can't seem to find any answers online, running as the user does not seem to work either as Jamf still fills in the $PATH with it's own seen above. Running from terminal as user still fill's in the path instead of the exact text.  

We manage over 1000 M1 MacBook Airs in our district and recently we've become aware of an issue with the current configuration profile to restrict access through the parental controls/curfew payload.  I've tested it out on a device and it appears to be attempting to restrict access at the specified time, but simply playing around with it, or even restarting the device seems like I can get around the restriction.  Has anyone else noticed this issue?  I'm wondering if it has something to do with the new chipset in the MBA.  We are using the A2337 model with Big Sur and now Monterey.  Both OS's appear to have the same issue.  Has anyone used a different approach to restrict access between certain hours of the day on the new M1 MBA? Thanks in advance!Keith

Hi,I have the problem that for some time now password changes for the mobile account have not been working properly. The passwords are changed via the Active Directory and the password is also synced to the devices, but it is not changed completely. Instead of one password prompts upon login there are now two. The first one which accepts the old password and the a second one which accepts the new password. It seems that the first password unlocks the hardware and the second one the account. Before it was all done by the same password. Also I should mention that if I change the network password again, it will only affect the second password (that was the new one in the first place, the old password always stays.Anyone have any experience with this?Thanks for the help!

Hello,I'm testing the installation of Tunnelblick on a remote Mac using jamf pro, the installation is correct. But when running Tunnelblick an error occurs:"the installation or repair took too long or failed. Try again?"I tried to install by creating packages in composer and downloading through jamf policies, and also through installomator. The error is still the same. Has anyone had similar problems or how can I install and run Tunnelblick correctly?

Maybe I'm crazy, be it seems to me that right around macOS 13.4 softwareupdated became more stable. Is it still crashing/hanging on your Macs? How about Sonoma? Did Apple offically address this?Are we still running launchctl kickstart -k system/com.apple.softwareupdated in a policy these days? Is this still a thing?

I'm trying to create an extension attribute for the version of Xcode Command Line Tools that is installed on each machine.The goal is to eventually have a patch policy to regularly update the versions as needed.The closest I have found is this post, however the attribute seems to no longer work and I can't seem to find any documentation to gather the version of Command Line Tools.If anyone has had any luck with this recently I would greatly appreciate any guidance. 

Hi all. I'm about to deploy a couple hundred new iPhones (which will all be enrolled in Jamf), but none of the old ones are. Half are in the Apple MDM. Does anyone know of a way to get a report on battery health from devices without the benefit of Jamf installed? Can Apple MDM do this, or is there a third-party app that could help us identify battery health across the organization, without touching every device? Thanks in advance!-ss

Microsoft has a nice post here about the adding of Defender to the Office installer that many have used in the past.  I didn't catch the change in time to block the install with a profile, and about a dozen Macs picked up the Defender component with an Office suite install.  I've fixed the go-forward issue, but cleaning up the Macs that got Defender doesn't seem as straight forward as the mentioned   rm -rf /Applications/Microsoft\\ Defender.app  from the article. There's an uninstall that is laid down with the installer that appears to remove more than just the .app itself. There's a bit of crud left behind that gets cleaned up with Defender's baked in uninstaller mentioned here sudo '/Library/Application Support/Microsoft/Defender/uninstall/uninstall' But I can't seem to run that remotely. I'd rather run the uninstaller, and let it catch things like LaunchAgents/Daemons/other crud that were installed with the installer but would be left be

Anybody know why this is happening? The same policy I'm running to get this result works on other computers. I've restarted, re-enrolled, updated inventory. Same result.

I am having some trouble with a script to change the computer name to First Last Computer Model.  Here is what I currently have and it is only changing it to First Last.  Any help would be appreciated. Here is what I have currently. #!/bin/sh#gets current logged in usergetUser=$(ls -l /dev/console | awk '{ print $3 }')#gets model namemodel=$(/usr/sbin/ioreg -rd1 -c IOPlatformExpertDevice | /usr/bin/awk -F { print $2 } | /usr/bin/sed 's/[0-9]*//g')#gets namedfirstName=$(finger -s $getUser | head -2 | tail -n 1 | awk '{print toupper($2)}')lastName=$(finger -s $getUser | head -2 | tail -n 1 | awk '{print toupper($3)}')computerName="$firstName $lastName $Model"#set all the name in all the placesscutil --set ComputerName "$computerName"scutil --set LocalHostName "$computerName"scutil --set HostName "$computerName"

Hello all, I had a question regarding the insitutional recovery key for a Macbook I'm working with. Why is it that some devices actually have the code and others I have to download the key? I'm working with a MacBook Pro 13-inch 2019, that I need to get in (machine is encrypted) -- I was wondering if there was anyway for me to reset the password with the recovery key I downloaded from Jamf? Thanks! Any input would be appreicated. 

Hello. I know there are many threads about this already, but I still haven't found out a long term solution for this problem. I also know there is a workaround, which is to re-enroll the device, and yes this works. But this requires scheduling time with the user for 10-15 minutes, and that can add up quickly.Does anyone know the root cause or how to fix this issue? Here's some info for those that need it.- We have created an extension attribute that shows if the MDM is communicating or broken- We have renewed our push certificates- We have tried the Jamf binary self-heal with the Jamf API, but no luckIt seems the only way to fix this issue is to remove the profile and framework, then re-enroll. This can get even more time consuming when the Profiles do not get removed and you have to wipe the entire system or disable SIP to remove the non-removable profiles.

We use to have Google Chrome installed on all our Ipads.But all of sudden Google Chrome is gone.And now I can't add it again. I have tried deleting one of the iPads and creating a new profile etc. and only added Google chrome.But it still does not work.Is Jamf school not compatible with Google Chrome?Or is there a nother way to add Google Chrome?Regards Jerry

Anyone else experience their cloud instance patch management definitions not showing newer versions?  It will only show the newer versions if I completely delete every patch management instance regarding that app, which we cannot do every time a new version comes out.  Any assistance is greatly appreciated, thanks.

Hello Jamf Nation,I had Jamf Connect configured to create the local user account as Administrator if the Azure AD user has the Admin role assigned in the Jamf Connect Azure AD enterprise application. This worked like a charm until we introduced an enrollment customization with Single Sign-On Authentication (with user information passthrough enabled).Now the user first has to authenticate with Azure via SSO before confirming the password once more in the Jamf Connect flow which then creates the local user. Although the user has to enter their password twice, the added benefit is of course the automatic "registration" of the user to the computer object in Jamf Pro.However, as the title of this post indicates, it seems the 'roles' attribute is now ignored and the local user is always created as Standard.Is there a way to benefit from the enrollment customization without losing the user roles functionality?PS. Using Jamf Connect 2.27.0.

I was looking at the list of Macs registered to JAMF in my company. Some get lost in international transport or are stolen etc.This can sometimes be verified by looking at the last IPv4 it used - if it is miles away I lock them with a PIN with a polite request to contact me.In this instance though, there was no record of the serial number logged in our hardware database - I locked it just to be sure.The person in possession of it has contacted me (months after I locked it), to tell me he cannot use the Mac. It turns out that he is a business partner but no reference to this was logged in JAMF.I gave him both of the two 6-digit codes I use to lock machines. Neither are being accepted.Can the activation lock bypass code (9RV5C-xxxxx-xxxx-xxxx-xxxx-xxxx) in JAMF be used to override this (by the user booting to the recovery environment and entering the code). MacBook Air (M2, 2022), macOS 13.2.1I don't want/need the user to wipe everything on the hard drive etc. Can he then just resta

We retired 200+ macs this summer.  How can I mass delete them from Protect? Doing it one at a time is not a viable use of time.

Hello all is there a script out there or a EA that can show us all users computers that are locked in JAMF? is it possible to create a smart group for this sort of request?

In my current tasks, have a challenge to find the way to detect all browsers installed on the JAMF Pro administered devices, do you have any idea about do it possible?.Regards,MR

Hello,I would like to know what the proper way is to reset a device while still keeping it under management.I have a MacBook that was added to ABM using Configurator 2 and was prestaged and is now managed in Jamf Pro. It has several policies and packages installed. Now, I want to take the MacBook back from a colleague and send it to a new colleague. He can then start with the MacBook as if it's new (=PreStage). It's important for me that the device is not removed from ABM, because everything is managed remotely.Should I simply click on "Wipe Computer"? Will the MacBook rerun the policies, etc., if it's still in scope? Or do I need to take further steps, such as flushing all policies for that MacBook?Best regards,Floh