During Enrollment of a Sonoma MacBook, after Remote Management starts and our required Credentials are entered, it Skips creating the Local User Account. It goes straight to a Log-in Screen instead. We do push a hidden Admin Account via Script during Enrollment. I can Log-in with said hidden Admin Account at that new Log-in screen. We only see this issue with macOS 14.x (Sonoma). We can manually Enroll a Sonoma machine without issue. Only during Enrollment of a Sonoma system is it an issue.  For our current Setup, we need the ability to Create Local Users still.  Anyone else see this issue?  

Hello,I search if somebody knows where these informations are written in the mac. I don't find command line or path to import it. My purpose is to create an extension attribute in JamfPro with these data.If somebody could help me. :-)

Hi Everyone,I used takingmoose's JSON file (link: JSON file) to deploy Google Extensions with no problem two weeks ago.Suddenly, it's not working anymore. The Configuration Profile log shows completed, and I can see it from the Profiles list on Mac. But nothing is being added to Chrome. I tried on different Macs (new provisioned or existing ones). No luck. I also created different Configuration Profiles with other user's JSON files with no luck.I also have a Configuration Profile to disable Chrome print Preview, and it works fine. It's just this Extension profile not working at all.Any Suggestion? Thank you.Jack

Hi all, Updates of MacOS via Jamf have pretty much been broken for some time and is very apparent from the hundreds of posts about this on various forums. It is very much hit or miss whether the deployment of updates works across the estate causing a headache for admins who need to ensure devices are updated. Unfortunately Jamf 10 does not yet support all the new features that Sonoma has to offer (scheduled for Jamf 11 from what i've read) in particular the ability to enforce software updates by a certain date and time and users get additional information in System Settings when an update is requested and when it's enforced.  Has anyone been able to create a configuration profile to enforce updates by a deadline with the behaviour that Sonoma has to offer?.

Opened up a case with Jamf support, they are seeing this pop up . Check your devices, especially any new device enrolled into your Tenant.  I have tried all the previous possible commands to fix and none of them worked. 

Hi all. In order to comply with a content restriction I need to be able to enforce a blacklist for 10 or so websites. I currently have these websites listed in the Content Filter section in a Configuration Profile. I'm currently using the "Built In: Limit Adult Content" filter and adding the websites we blacklist.  I'm experiencing a problem where websites and content that our end users need to access is getting caught by the built in filter and therein becoming a barrier to how the iPads are used. I'm not seeing a quick way to only be able to blacklist websites without employing the built in filter. Does anyone know a way around this without using the "Built-in: Specific Websites Only" option and adding all of the websites that our end users would access?  

Hello. I wanted to setup some EAs for CrowdStrike, regarding the Version / agentID / customerID. The command to put in Terminal to gather this info is:sudo /Applications/Falcon.app/Contents/Resources/falconctl stats agent_infoI want to get this info into an EA, if possible. There was a script someone posted earlier this year, but it is not working for me for some reason. It was in this thread. When I deploy it via Jamf, the field for the EA remains blank. Although if I run the script directly from my Mac, it displays the customerID stat just fine.Any help is appreciated.

I thought I would try to create a VM to test erase-install OS updates. I setup a VM enrolled it in JAMF, I had to do a few things, because it didn't enroll everything correctly. I'm not, trying to test erase-install, but it says, I'm not a volume owner. Any ideas or is it not possible via the VM using UTM?

In our Computers - PreStage Enrollments, it shows 63 devices. One of them is the target device. The Jamf Connect and Jamf Connect Login are scoped to all devices and usersAuto assign new devices is checked. Make MDM Profile Mandatory is checked. Automatically advance through Setup Assistant is on.If I click Computers - Search, it only shows 61 devices. Trying to limit the company data I share, but please let me know if I need to include any more information.VERSION10.50.0-t1693149930MANAGEDComputers - 61It's a latest M2 Max MacBook Pro, it did successfully enroll before a few months ago but can't now. All our server and content tokens are current, even recently updated.The device was unassigned and reassigned to Jamf in ABM. What else needs to be done? There shouldn't need to be any intervention by the remote user. Please tell me all the things I should check on our end to get this laptop to properly enroll. He's already wiped it since last syncing everything on our Jamf

I am the JAMF admin for my employer. When a Mac needs to be remotely wiped, marked as stolen, prompted to be updated etc such request come through me.I found a Mac a few months ago, that had been inactive for several months, had a name that differs from the convention set by the enrollment profile etc. No record could be found of it in the hardware database that we use for just about everything else in the company. Usually such devices are regarded as stolen/lost in transit etc. I was never informed that a device belonging to someone external to the company had a mac added to JAMF.I sent the command to LOCK it with a message to state my name and email address with a request to contact me to verify ownership. An external business partner contacted me yesterday looking for the unlock code. I had no reason to doubt he was indeed genuine. I shared with him what could only have been one or other of the two unlock 6 digit lock codes.He attempted them, but now he appears to be locked out of t

All user are login with manager Apple ID but some haver manage to log out and download there own apps, I have added a restriction policy which stops this happening.But I would like to find out who is currently logged in with their own Apple IDs.Is there any way of doing this on jamfcloud?  

Good evening all, I'm really new to Jamf, coding and forum posting, apologise if this is blindingly obvious or I've posted something i shouldn't.My company has a policy to not allow staff to have admin rights. Some of our more technical users, data scientists & developers really want to be able to install, uninstall & upgrade applications via HomeBrew. We also have to balance this with applications that are within HomeBrew that our info sec team don't want installed.In order to facilitate this we have been using the fantastic code from Github by HonestPunk called homebrew.shWe've had no issue installing Brew and command line application using brew-install-program.sh.We've blocked the end user from using the Brew commands directly in the terminal by adding a custom .zshrc file to the user directory and making it immutable.When we tried to use the brew-install-cask.sh    #!/bin/zsh item="$4" ####################### # check something set #

Please keep in mind there's several ways to deploy this. I'm sharing what worked for me :)Getting the Installer- Using the Tanium Client Deployment Tool, go to Clients, then click on Generate Archive- Choose .iso and platform osx. Click OK Creating a DMG- Open Composer- Open the .iso file by double-clicking on it- Drag the .pub file to the left column of composer- Take the file out of the directories, delete the empty directories- Drag the pkg to Composer, make sure it's outside of any directory and delete any other directory so the only two things in Composer should be the .pub and the .pkg - I changed the name to TaniumClient_osx so it was just like the .iso- Click on Build as DMG- Upload the DMG to Jamf Extension Attribute(s) (I might add more later)- Create a new EA called 'Install Status - Tanium' - Data Type: String - Input Type: Script #!/bin/bash taniumLaunchDaemon=`ls /Library/LaunchDaemons/ | grep com.tanium.taniumclient.plist` if [[ $taniumLaunchDaemon != '' ]]; th

For the last month of so, 15% of our Big Sur laptop has been skipping account enrollment during the DEP process. It forces the user to land on an account login page with no credential to login. Upon checking into the computer entry in JAMF - the username is set to root. This is a major issue for us right now and affects our zero-touch deployment. Did any of you guys see this issue recently and is there a fix?

Hello!I have an iPad Pro that we have released from Apple Business Manager and removed from JAMF Pro. There is no longer a trace of it within our system. However, after the iPad was factory reset the MDM Profile was still there from Jamf.What would be the next step in this process? Thank You in advance! 

Hi All, Since Microsoft change to Entra, when we do PreStage with Jamf Connect (using Azure as Idp) it will ask the user to select an account to sync with your Microsoft Entra ID account.this is extra step in user enrollment (we want by default to just create account) how do we achieve this?    

HI we want to set the Controls for download of pictures in the reading panel. GUI Preference > Email > Reading > Security to 2 = In all messages.Ive followed the info from here https://docs.google.com/spreadsheets/d/1ESX5td0y0OP3jdzZ-C2SItm-TUi-iA_bcHCBvaoCumw/edit#gid=0 (defaults write com.microsoft.Outlook AutomaticallyDownloadExternalContent -int 2) it writes to the plist but can not get the value to change does anyone know if this is supported in 16.23 ? or if there is something I am missing ?Thanks for the help :)

Is anyone managing Safari using a Configuration Profile on macOS Mojave? I have official documentation for Firefox and Google Chrome from Mozilla and Google respectively, but I can't find anything from Apple (or on here) about managing Safari. There's no Safari Config Profile payload in JamfPro, so I assume we'd have to use Custom Settings payload just like Firefox or Google Chrome. I want Safari to match the same bookmarks and some of the settings I've set up for the other two browsers. I'm inspecting the com.apple.Safari.plist file, but it would be great to have documentation on all the keys that can be managed currently. The Managed Preferences manifest found on JamfNation is very old (2011), so I'm not sure if some of the keys shown there are have been deprecated. Any ideas?

Why can't Jamf Pro have an easy way to add Webclips like JamfNow. I have tried using iMazing Profile editor to make some, but they never sync down. I used to use JamfNow and it was just an option to choose from for a "blueprint". Can you add this to JamfPro? If its there maybe I just am not seeing it.

Hi there,We seem to be having issues trying to SSH into devices with SSH enabled on a backdoor local admin account. This issue is only apparent when trying to connect over the internet to a host with SSH enabled. When that device is on the same local network I'm able to SSH fine without issue.I've tested multiple machines in the environment and issue is exactly the same on all machines.This is the script used to enable SSH on the target device: #!/bin/sh ssh_user="THE_USERNAME_OF_THE_ADMIN_USER_ACCOUNT" # turn ssh on systemsetup -setremotelogin on # append user to ssh group dseditgroup -o edit -a $ssh_user -t user com.apple.access_ssh # restart ssh launchctl unload /System/Library/LaunchDaemons/ssh.plist sleep 5 launchctl load -w /System/Library/LaunchDaemons/ssh.plist exit 0 And connect in Terminal using 'ssh THE_NAME_OF_THE_ADMIN_USER_ACCOUNT@targetIp' 

Hi there,I am noticing a number of machines not being able to check in when running 'sudo jamf recon' We are running 10.33, on prem➜ ~ sudo jamf recon Retrieving inventory preferences from https://xxx.xxx.co.uk:8443/... Finding extension attributes... Locating hard drive information... Locating accounts... Locating applications... Locating package receipts... Searching path: /System/Applications Locating software updates... Locating printers... Gathering application usage information from the JamfDaemon... Searching path: /Applications Locating hardware information (macOS 11.6.0)... Is anyone else noticing this? 

Hello everyone,Now Sonoma is finally released. I guess we're not alone in having trouble rolling in Macs with Sonoma. In our case we unchecked the following under Setup Assistent Options in PreStage to get it to work with Ventura:Location Services, Transfer Information, Apple Pay, Registration, iCloud Diagnostics, All Your Files in iCloud, Choose your Look, True Tone Display, Terms of AddressIn Ventura all options wasn't shown but it worked. We haven't got this set up to work with Sonoma. When it comes to Transfer Information and you click Not yet the screen goes black. Even tried to uncheck all and check Setup Assistant above Options, then it skips Creating local user account like in the link bellow.https://community.jamf.com/t5/jamf-pro/enrollment-with-macos-14-x-sonoma-skips-creating-local-user/td-p/299899Has anyone succeeded to enroll a Mac with reinstalled Sonoma (final) yet without any problems? If so, how does your Setup Assistant Options look?

In our Jamf Pro instance, I have two smart computer groups, one for Intel devices and another for Apple Silicon. The criteria is pretty straight forward in each:Apple Silicon group == "Apple Silicon is 'yes'" [OR] "Architecture Type is 'arm64'"Intel group == "Apple Silicon is 'no'" [OR] "Architecture Type is 'x86_64'"However, I have 30 devices (of ~800) that are failing into both groups for some reason.  These devices were fresh enrollments as of earlier this year or late last year, and they are all properly checking in and performing inventory updates. The criteria is correct on each device too.I tried making two new test smart groups with different criteria, and the exact same thing happens!Apple Silicon group == "Apple Silicon is 'yes'" [OR] "Processor Type like 'Apple'"Intel group == "Apple Silicon is 'no'" [OR] "Processor Type like 'Intel'"Anyone else seeing this? Not sure what to make of this, because as far as I can tell I'm not necessarily building the criteria incorrectly

Hello.For backup purposes, I want to write out an individualized launch agent plist via a shell script to certain Macs.This script should at first gather two variables locally (currently logged in user and a user specific storage directory, I would technically know how to get both of them), but then successfully hand over these two variables to an individualized launch agent created by the same script, doing watch paths on certain directories for running a backup script as soon as there is a change to the root directories.How could I leverage this?Thank you and best regardsChristian

Hello, my company decided to use Jamf Pro as MDM solution for Macs administration. Our current setup is Jamf Pro + Jamf Connect with Azure AD as IdP, and all purchased Macs are already in Apple Business Manager with Jamf as assigned MDM server.We're on last phase of polishing all apps deployment, policies configuration, scripts deployment, but found a bug (or misconfiguration) that is preventing usage of Jamf as company-wide solution yet.In perfect scenario, when new employee has been hired, brand new Mac is being purchased and delivered directly to user. Mac is already enrolled to ABM, and automatically assigned Jamf as MDM server. This user also receiving AAD credentials with temporary password to change during first account use.Please find below issue description:1. User first time power on new Mac, and connect to the Internet.2. Jamf pre-stage enrollment has been started and all config profiles deployment happens.3. When above completed, Jamf Connect shows Microsoft network login.4