Anyone experienced problems with authenticating 802.1x with Cisco ISE ver 2.3 patch 4.Log in ISE shows that the EAP-TLS handshake fails with the Mac.I have in Mac the ISE server certificates trusted as well as root of ISE certificatesin ISE I have the root of Machine certificate that issues the certificates to Mac clientsWeird thing is that 802.1x authentication works in the old Cisco ISE environment ver. 2.1 patch 5. Configuration profiles on Mac and Authentication/authorisation policies in ISE are all identical.

Hi, Bitdefender has activated a new web content control module in the Endpoint Security app, which now results in the end user having to approve a system extension. I have tried to add the below approved system extensions in a config profile, but they still show up. What else can I do?

I fully intend to contact support tomorrow because I cannot find any documentation that relates to Jamf Now specifically for this issue or really anything online but I figured I'd post here and see if you guys might have any insight.My company is going from unmanaged devices to using the Jamf Now Fundamentals package which includes Jamf Connect. I set up some managed Apple IDs and federated authentication using Azure but whenever I do a fresh install on a computer after entering the Apple ID / Microsoft login I'm then prompted to create a password for the device itself. This password does not sync to the managed Apple ID / microsoft, and furthermore it seems that the user that is created is always an admin and I am unable to change this.This essentially makes the management useless as not only does the user have admin privileges, but if they were to forget this password I wouldn't be able to change it. Furthermore, it seems like they could simply sign out of their managed Apple ID and

The other day I couldn't RDP into an iMac, I could issue remote commands, I could ssh in and do things, BUT no RDP through ARD or even VNC...turns out that if "Sharing" is disabled under restrictions that that breaks RDP. I guess it kind of makes sense but I always thought of restrictions in the sense of restricting user access to settings, not disabling features. Just in case anyone else runs into a similar thing...Best,Phil

Hey how can I block the upgrade to Mac OS Sonoma?I know I can do it either with restrict software or a configuration profile but which way to go? And I really ONLY want to block the upgrade to Sonoma. We also have some users for instance that have Big Sur installed and if I block major Mac OS upgrades that would mean that they are also no able to upgrade from Big Sur to Ventura for instance.So what would be the best way to accomplish that?

Has anyone put JSS on azure and used azure lb ? Can you tell me the correct setupI'm doing a migration recently to migrate a local server room deployment of Jamf Pro to an Azure environment.In a standalone scenario (with only one JSS service turned on), whether I turn off the master or the child JSS. it runs fine.But when I turn on two jss : master and child it has issues.When I access it from the public network, after login and entering account/password is complete the page fails to load out any resources.The current access link is: public network traffic via domain name (https) to - F5 intranet (F5 redirects all traffic to azure's lb) - Lb (load balancing) - my two JSS apps

 Hi everyone,  I am trying to deploy DLP profile for Microsoft purview.I follow this link to deploy profile with jamf:https://learn.microsoft.com/en-us/purview/device-onboarding-offboarding-macos-jamfpro-mdeI can see both profile on mac os (see image) but by default its OFF. I have to enable it manually (Asking for admin password).Is there anyway I can enable it with a script i can deploy from JAMF pro ?Thanks

 Has anyone put JSS on azure and used azure lb ? Can you tell me the correct setupI'm doing a migration recently to migrate a local server room deployment of Jamf Pro to an Azure environment.In a standalone scenario (with only one JSS service turned on), whether I turn off the master or the child JSS. it runs fine.But when I turn on two jss : master and child it has issues.When I access it from the public network, after login and entering account/password is complete the page fails to load out any resources.The current access link is: public network traffic via domain name (https) to - F5 intranet (F5 redirects all traffic to azure's lb) - Lb (load balancing) - my two JSS apps

We are looking to upgrade from 10.47 to 10.50.  We've held off going beyond 10.47 while we worked on devices this summer due to the changes implemented with LAPS. Currently we have a management account configured in the "User-initialted enrollment" settings.  From what I understand, the password specified here will no longer be an option to be set on all computers for this account, and it will now rotate on each device with a randomly generated password and be stored in the device record in Jamf.  That is fine as we do not typically ever need to use that account unless something went wrong during enrollment, which typically we just wipe and start again anyways.  My first question with that change: We have 4-5 computers that the "Allow Jamf Pro to perform management tasks" box unchecked on the Inventory>General page as essentially we do not want Jamf to do anything with them and when we do, we recheck the box and type in our management account password, then

Hi everyone,I'm currently working on a custom desktop wallpaper and have learned a lot from reading older posts on here for it. My next question, or a second part of this project would involve using the same wallpaper as a login background. We currently AD bind our macs, if that's relevant.I have made the wallpaper 4480x2250 (same as Apple wallpapers). DPI 300. Any thoughts? Also, the simpler the better and to avoid me asking dumb follow-up questions, please provide explicit steps to accomplishing the solution :-)Thanks!Phil

I am restricting the apps my students use on their byod iPads during school hours using the positive list in the profile. As soon as the school hours are over, all the „private“ apps (games, social media, etc.) show up again, but in a completely messed up order. All the folders and widgets the students had set up during their time at home are gone. Does anybody know a workaround?

am i just now seeing this for the first time? or has it been here for a while? Has anyone used it? what switches does it make?  

So I’ve setup my test mac m1 Ventura, followed the integration documentation for setting up the jamf connect and deploying using Jamf Pro cloud, not done the menu bit yet as the documentation seems a little confusing. I get a Microsoft login page at the Mac boot screen in place of the standard mac login. I’m able to auth to entra fine but I’m the immediately presented with a secondary user name and password dialogue, followed by a password verify dialogue and finally I’m in. I’m hoping I’ve done something wrong and this is more streamlined in a correct setup???

Hi community,Here looking for feedback on this beta feature from jamf pro specifically on things that have not worked out for you upgrading macOS to Ventura 13.5.2- I did a test on my mac but restart is not forced - anyway a restart can be forced? - I received the Software Update notification come in successfully on my machine and I diverted it but did not received another notification even though I set for this to occur 3 timesYour input is appreciated.  

I am trying to use Google LDAP to authenticate users logging into a mac lab, but I have had nothing but issues.  The Google LDAP search is successful finding the user account, but fails with a LDAP search with (&(|(objectClass=automount))(|(automountKey=xxxxx))) failed with NO_SUCH_OBJECT. The log in process just spins and spins.  No local profile is created. I have removed all configuration profiles for the Mac and it is connected via Ethernet.  I've followed these instructions and when I test using ldapsearch, it completes successfully.  This is the first lab of macs I have used JAMF for, so I am most likely missing a step somewhere. We have Google LDAP setup successfully for logging into the lab software on the MiniMacs. Any suggestions for troubleshooting or even which logs I should look at would be greatly appreciated.  I am very close to giving up and using Active Directory.Thank you! 

Hello, I am trying to run my Office 365 download through Jamf Pro and I am getting the following errors: [STEP 1 of 4]Executing Policy Installing Microsoft Office[STEP 2 of 4]Running script install_pkg.sh...Script exit code: 4Script result:https://go.microsoft.com/fwlink/?linkid=XXXXXXX Download URL: https://go.microsoft.com/fwlink/?linkid=XXXXXXX Downloading the installation files... hdiutil: attach failed - image not recognized Failed to mount the downloaded dmg; exiting. Cleaning up installation files...Error running script: return code was 4.[STEP 3 of 4][STEP 4 of 4]

I have some questions about FileVault.Let’s say you have a new Mac computer that is installed with Jamf DEP. During the process a local admin account is created. And the computer will be bind to Active Directory. Then the device is given to the user who logs in onsite with their Active Directory credentials which creates a mobile account. Now he can login with his mobile account of course also from offsite.The Filevault configuration profile is installed and when the user logs out FileVault will be enabled. So far so good. But let’s say somebody else from AD wants to log into the computer now with their AD credentials. This would not work right? Because the “new” user cannot even unlock Filevault before the boot processWhat about the mobile accounts and unlocking FileVault. Will it work? Or do mobile accounts need to be on VPN or Onsite to reach ldap ?? 

Hello All,I have followed this guide exactly and am going crazy. https://docs.arcticwolf.com/agent/installing_mac.htmlThe error I am seeing seems to be related to the "Execute Command" section or perhaps the .sh script itself  This is what the details from the log shows:Result of command:/private/tmp/AGENT/install_AWNAGENT.sh: line 1: {rtf1ansiansicpg1252cocoartf2709: command not found /private/tmp/AGENT/install_AWNAGENT.sh: line 2: syntax error near unexpected token `}' /private/tmp/AGENT/install_AWNAGENT.sh: line 2: `\\cocoatextscaling0\\cocoaplatform0{\\fonttbl\\f0\\fnil\\fcharset0 Monaco;}'I've tried my best to confirm that the .sh is created properly, the file shows SHELL on the Icon and its definitely a plain text documentAny insight would be extremely helpful.  Also one thing to note is when I copy pasted the command from the .sh file and ran it in terminal it prompted for my password and then installedThanks

We've followed all the instructions for setting up InTune integration with our Jamf Server on both sides. When I run the self service policy to get a Mac registered in InTune, it goes through all the steps until it gets to the JamfAAD.app where it basically stops. I've let it sit with the spinning gear for an hour with no progress at all. Here's the screenshot:When I click on More Details, here's what it says: Has anyone else encountered this? What app is it trying to get? Could this window be any more vague?

We have a PreStage set up for the techs to assign computers to (we have more than one PreStage)They need access to the PreStage for computer/Device assignment.Unfortunately they need to have update access to the PreStages in order to do this.And you know what happens when techs get update access that lets them change everything, they change everything.Is there any way to lock the PreStage down but still give techs ability to assign a computer/device to a PreStage?

Hello Nation!Trying to see what's the best way these days to script Zoom installs and automatic updates for it without bothering staff with updates. Thanks in advance!-FS

Just this week, we are noticing that many Macs, but not all of them, are not able to print via our Windows print server. Nothing has changed on our Mac side.We are printing via PaperCut, so using SMB on a printer installed via JAMF and no changes to the setup.Macs not joined to the domain and not using the AD Username as the machine or profile name in many cases, but likely in many others.I can add PaperCut LPD to the print server and print via LPD - but no authentication, so the job gets stuck with no way to get it to print from Papercut, unless the users profile on the Mac is named the same as their AD username.The issue looks very similar to this one:https://community.jamf.com/t5/jamf-pro/mac-printing-issue-after-microsoft-windows-print-server-update/m-p/246842However, we don't have the server updates referenced in the thread or PaperCut advisory.Affected systems are running Monterey, Big Sur, and Catalina.One Mac that was able to print, stopped printing immediately after upgrading

Hello,We signed up for a cloud RADIUS solution for our WiFi auth through portnox.com, and then set up the environment to use SCEP and push out these profiles to our MacBooks.  Everything worked great and successfully pushed to most all of my devices (and the WiFi works great for them) however two of my devices keep throwing this very unhelpful error, and I can't for the life of me figure out what's causing it. It feels like the issue is at the device itself, however there is nothing special about either of these devices compared to the others (same profiles, same polices, etc. same OS version (Ventura).    The error simply says "Unable to obtain certificate from SCEP server at "scep-eus.portnox.com".   <InternalError:1>.   These devices are connected to the same network environment as the others, so it's nothing related to the corporate firewall blocking access, and they have the same issues when they take their laptops home.&nbsp

Hello EveryoneWhen I select a group in Software Update payload, and select Download, Install and Restart install option with Latest version based on Device eligibility, the device does download and install however it will not restart the computer.The local IT team has to touch each computer to click the Sys Pref > General > Software Update > Restart. All computers are on at least 13.4.xCurrent Jamf Pro ver 10.50.0Anyone else having same issues or know the fix

We have about 200 employees with all 100% WFH. On paper, I think our patching numbers looks good relative to our user count each week, but my boss isn't buying it as optics are funneled all through Slack and each week, we have about 3 - 5 people complain an app broke during patch. My boss also gets hit up with anecdotal issues of someone complaining to him something broke during patching, and all of that is coming to me. We are using just policy based scripts with smart Groups, instead of leveraging Patch Management, Installer, and 3rd party tools. My question is what does a healthy patching environment look like in terms of statistics? Do you have complaints each week that an app broke? What percentage just fixed an app themselves without reporting or complaining? What are you using to patch our heavy hitters: Zoom, Chrome, and Slack?