We normally block URL's via our firewall but wanted to test blocking a specific URL for just one lab and figured I'd just use the Parental Controls in the JSS to do it. I've added both the www.domain.com and domain.com to the deny list and pushed it to my test iMac and MacBook but they can still visit the URL's. I've even rebooted the systems and flushed the cache but the URL is still not blocked. What am I missing?

With the new firmware being released tonight, I wanted to make sure I could see what versions (of the very limited number) are in our fleet. I threw this EA together, hopefully it can help someone else out! #!/bin/bash result="<result>NOT Found</result>" if [[ $(system_profiler SPDisplaysDataType | grep -i "Studio Display") != "" ]] then dispFW1=$(system_profiler SPDisplaysDataType | grep -i "Display Firmware Version:") dispFW2=${dispFW#*: Version } dispFW3=${dispFW2%)*} result="<result>$dispFW3)</result>" fi echo "$result" 

Hello everyone!Just want to know if dockutil is compatible with Monterey, Ventura and Sonoma?

Hello,I am looking to create a custom analytic that will alert when a software installation occurs.  I found this:  custom_analytic_detections/app_bundle_installedIt does work and creates alerts, however it alerts on everything installed and there are multiple alerts for each item.Is there a way to filter out System or Root level installs?  That way Jamf patches/pushes don't trigger alerts?Thanks,Don

Hi everyone I want to use FULL NAME as the Computer Name because there are too many devices and making changes one by one is painful. Do you have any good scripts to recommend.Thank you. Thanks

We would like to track leases through JAMF and will set up a report to notify us of dates. The issue is that when a device gets wiped, all information is removed. I have two questions regarding this? Is there a way I can have certain information automatically added to the device after a wipe? As it is right now, most information like who it is assigned to is removed and replaced with a serial numberIs there a way to notify me that there has been a wipe that includes the information before the wipe? As in user and location information.Thanks!

Is there way to block iOS 17? I would like to update to iOS 16.6.1 only.I have defer settings but is still showing up on iPads.Thank you  

Hiwe are having trouble with Mac-OS ventura update, I would appreciate if someone can help with this matter, trying to use the Jamf pro update feature but it's not working, even with a package on self service we are getting different errors. Thanks

Hello Everyone,  Is anyone else seeing macOS Sonoma not respecting the delay within the restrictions payload?I have the delay for Major software updates set to 90 days. In addition I also have a software restriction setup for "Install macOS Sonoma.app". Not sure how my users / systems are being updated?   

I created a small application to automate this process of creating a .p12 file for Google LDAP and Google with Jamf Connect.Here is the Github of this tool.https://github.com/kylejericson/Jamf-Connect-Google-P12er 

Hello everyone,I use a device smart group that includes all iPhones to push a background image. The criteria I am using is Model > is > iPhone. This pushes every month to make sure anyone that changes it will have it set back to the correct background. For some reason, some users reported that their iPhone background has changed to a blank, black background. Pushing the wallpaper change directly to a user's device using the wallpaper change command fixes the issue no problem. What I am trying to find out is why it's happening in the first place and how to prevent it from happening again. Thanks,Matt

We run a script through self service that migrates data from a user's old computer to their new computer (computers connected via target disk mode). Data copies perfectly, however, Jamf throws up some messages like the attached for things like Documents, Desktop, Downloads, Reminders etc. Any idea of how to allow that in advance without having to click OK every time? Config profile maybe?

Hello, I'm struggling to find a way (if there is one) to deploy via Configuration Profile via Jamf Pro the path to the Workgroup Templates.This setting normally can be found into (for example) Word:Preferences > File Locations > Set "Workgroup templates" I checked the com.microsoft.office.plist file, after changing the path into Word the file gets updated (the date / time updates), though there is no key in the plist file that tells me it's related to this kind of setting. Any help is appreciated.Thank you 

I have tried writing a script about four different ways simply to report what version cURL is installed on Macs. I am scratching my head why the value is blank after running recon on various Macs.  Below is the script:#!/bin/bash if command -v curl >/dev/null 2>&1; then curl_version=$(curl --version | awk 'NR==1{print $2}') echo "cURL is installed. Version: $curl_version" else echo "cURL is not installed." fi

Hey there, I am trying to get the mac laptops to use certificate based logons for 802.1x. The machine can join to the AD domain, it can generate a certificate and i see that certificate on the machine. However when i try and apply a jamf profile to add the certificate and wireless profile to connect to the network i get the following errors:mschap: FAILED: No NT/LM-Password. Cannot perform authenticationLogin incorrect (eap: Failed continuing EAP TTLS (21) session. EAP sub-module failed): [MS\\lmc02d<FULLHOSTNAMEREMOVED>I have tried with PEAP as well as TTLS. On the windows laptops i have connecting using the same infrastructure, they connect fine and do not require any password. What is the point of certificate based logons that require a password? Makes no sense. But jamf / macs appear to need something there. Its very possible my jamf config is the problem here.The domain root certificate is SHA-256, and is added to the same profile and trusted on the trust tab. I also pu

Hello,PROBLEM: most of our MBP pop solely use wireless network and are never getting alerted when PW is about to expire. WHAT I HAVE FOUND: On a domain joined machine on our corp wired network, the machine is in a state where it is able to get to AD where it can poll password expiration for users. This is not the case when the device is on our corp wireless. The machine is not getting network access until AFTER a user logs in. I deliver an 802.1x configuration profile to the device with trusted certificates and I am to understand that this profile (which was built using Apple Configurator) installs using a "user" context rather than "system". If delivered in the "system" context, then the device can use the machine certificate for logon. Everything I have seen suggests you must hack the .mobileconfig file (shown here https://ntsystems.it/post/joining-wifi-before-login-on-mac-os-x-108). I tried this several times several ways and have had no luck getting the wireless network to c

Hello! I сan't erase all content on macOS Ventura, I tested PreStage (cleaned the test mac several times), and it looks like I didn’t delete the profiles from the test device at some point. And now i can’t erase all content from the test device. I tried to add the device again through User-initiated enrollment, but it shows up as UNMANAGED, and I can’t delete profiles or wipe the device.Please tell me how to clean the device.

Hello, I've searched around and found no article or setting for a way to setup a profile on jamf to either disable Guided Access, Enable it or at least create a passcode for guided access. Would anyone know how this is done or if it is impossible. I essentially have over 500 devices begin managed and most like guided access but prefer to have 1 single passcode that so that others cannot change the passcode.Kind Regards,

Is there a way to run a report to see all the apps we have on the iOS Devices?

I'd like to find a way to allow users to change the following things, either without a password or using their own, instead of needing admin rights.Power settings, like how long before turning off the display on battery or power adapterNetwork settings, like changing wi-fi networks Auto-Join settingPrinting settings, like updating Options and Supplies (this only started asking for an admin password since I think Ventura)Privacy and Security, like adding an app to Accessibility.Does anybody know a good way to do this? I wish the config profiles were a bit more like GPOs in this regard because I suspect I need a script instead of a checkbox.

We seem to be running into an issue with Secure Tokens. Searching has made me realize this is something most people are having difficulty with but it's usually with the Admin account not having a token but ours is sometimes the other way around.Long story short a second admin account that was added during the enrollment stage was getting the token then other users logging into the device would not get a token, now really showing itself with updates and the users getting a "You need to be an owner" error.So I created a script to run from Self Service that just prompts the user for their password then runs the command and passes the credentials of the Admin with the secure token. However, it always errors out saying the users password is incorrect but when I test and run the same thing from the terminal on the test device it works fine. Is there something I'm missing here? Does apple do something to restrict this kind of access from a script?   #!/bin/bash # Prompt the us

Hi, i need to give access to allow our it techs to edit the user and location fields in jamf pro.i just cant find the correct checkboxes in the priviledges in jamf pro user accounts and groups... anyone...

I have an issue with registering macbooks in Company Portal.Everything is setup as described in the tech paper for device compliance:https://learn.jamf.com/bundle/technical-paper-microsoft-intune-current/page/Integrating_with_Microsoft_Intune_to_Enforce_Compliance_on_Computers_Managed_by_Jamf_Pro.htmlAll worked fine for months:While enrolling a device Self service opened the Policy for (Microsoft device compliance payload --> register computers with azure active directory)This opened Company portal and registered the device.Unfortunately it now fails everytime. The user can log in successfully but gets a "couldn't add your device" error"I have no idea where to search, since all settings involved haven't been altered.Underneath is the log I get from  Company Portal.Any ideas what to search for and where?I already created a ticket towards Jamf.2023-10-12 08:42:52.912 | telemetry | 35658 | TelemetryManager.swift: 173 (sendEvent(featureArea:type:eventTitle:duration:result:target:lo

Hey all,Just wanted to check if anyone was seeing looping restarts after attempting upgrade from 10.15-13.6We use firmware passwords and I figured this was part of the issue, so ive since removed them, however i have about 5-10 that attempted the update themselves, and now are caught in this rebooting loop. Ive reinstalled 13.6 on them from both the recovery and from a boot usb drive as well as internet recovery...with the same result. Im attempting to now try to move one to sonoma to see if that resolves it.Ive done PRAM resets...pmu resets, i did a revive from configurator. Ive done everything except wipe them fully...which i guess is the next step.Ive also done safe booting with shift held down. Not sure what the cause is, but it's really annoying.

I am trying to get Nudge rolled out to our users. So far it has been pretty good, although the setup documentation leaves a lot to be desired.I am wondering how we can customize the LaunchAgent so that it doesn't popup every 30 minutes (default) but instead maybe 6 hours apart. Do I need another Configuration Profile for the Launch Agent itself? Do I need to change my current configuration profile? I read through the documentation 10+ times and didn't get my answer.