Just wondering if any has instructions on how to configure an iis server as a distribution point for user images.I have tried to follow the generic instructions but just cant get it to work. Prepare to enable user images I have a basis iis server built with images but cant get past that.

Hello , I need to create local admin accounts on large group of computers. Is there any solution how to grant access to FileVault for this admin account ? I will know id and password of this admin accounts , but for now access to FileVault have only end user account(standard one )Thanks for tips 

Hello World! So from my research I am not sure this is a thing, but I am looking to spin up a test instance through Jamf Cloud for test and training purposes. I am not looking for a trial addition, and we are already using Jamf Pro. Let me know if this is something that's possible or if we are going to have to use our present environment, scope and enroll some devices for testing. Thanks so much!

Bear with me on this, but I am considering allowing 6 digit number passcode for macOS login.  My threat assessment is similar to that of an iPhone, that has a 4 digit passcode protecting the device, which essentially has access to all the same company information the Mac is going to have.  In both cases, the attack vector requires physical access to the device and then a considerable amount of number guessing, but not before locking the device out after 10 wrong guesses. Our devices will also have Password Sync installed, so users who wish to configure that certainly can, and then use their company password for login. Our Macs are all ABM -> MDM enrolled, purchased through official channels, we don't have Active Directory.  We do use Okta for but as i mentioned and I have configured Password Sync with Okta and as mentioned users can configure Password Sync if they wish. Am i missing anything here, that should require Mac login passwords to be long and c

Has anyone successfully used the SecureW2 SCEP setup with Jamf on macOS AND iOS?I am having an issue with our iOS devices not connecting to the network. They get the profile payload that includes the cert, Wi-Fi profile, and SCEP settings (the same settings as on the macOS devices) and the iOS device starts to connect but never fully connects and just cycles through the connection process over and over. The macOS devices connect fine a few minutes after they get the cert.It gets the cert from SecureW2, so that part is working, but it just never actually connects to the network. I followed their, somewhat out-of-date, instructions found here:Deploy Client Certificates via SCEP to Jamf Managed Devices (securew2.com) Anyone else had issues with the setup for iOS devices?

I have multiple Adobe 2023 packages that are failing from Self-Service. I see the following in the log when reproducing the error:Mon Aug 28 09:29:58 MachineName jamf[2225]: Checking for policy ID 1424...Mon Aug 28 09:30:00 MachineName jamf[2225]: Executing Policy Acrobat Test Policy Faculty and StaffMon Aug 28 09:30:00 MachineName jamf[2278]: Mounted file serverMon Aug 28 09:30:00 MachineName jamf[2225]: Error Domain=com.jamf.management.daemon Code=14 "mounting a file share failed because of invalid command output" UserInfo {NSLocalizedDescription=mounting a file share failed because of invalid command output}Running the same policy on the same machine using the sudo jamf policy command will successfully install the software.Any suggestions? Thanks in advance!

I'm trying to push Sophos onto a machine through Jamf Self Service and when I click install it says done but the app doesn't install. I've packaged Sophos using Composer and use the same .pkg for a Sophos policy which is pushed out to all the devices and this pulls down and installs. Any idea what I could be missing?

I want to add 1000 device into a smart computer group in jamf but I don't know how to add device in smart group using API. Can you please help me to create a computer group using API in jamf pro.

Hello guys, I have a bunch of test macs which I use for testing so I'm constantly re-imaging them and enrolling them to Jamf. I want to know if there is a way that I can automate the removal of the Jamf record without having to in Jamf gui web interface and looking for the record for the mac and then deleting it.   

Hi all,Is there any way to disable export option for some private keys and certificates in KeyChain?I tried to import the keys with -x option (Specify that private keys are non-extractable after being imported.) security import -x At the first right click to the key in KeyChain, it doesn't show the export option. However, at the second and later right click, it shows the option.

We are having a very strange excel and one drive problem.  If you use the one drive icon and use the folder view files button, any excel file you click on opens in read only mode.  If you open them in excel recent documents, they work fine.What we have done:We opened a Microsoft Case, and they examined the logs.Then they had us remove our security agents. Same problem.Then we removed management. And then it worked!On our second test machine machine, we left the agents in place, and removed management and it worked again. So we're all scratching our heads.

So, I could go to the devices and use this: If an app would like to connect to devices on your local network - Apple SupportBut surely there is a configuration policy that I could implement instead?  Basically these are restricted kids games station running on iPads and having them connect to other iPads in the building creates a potential behavior problem, bullying, etc.Would rather when they play Minecraft on these devices, they just have their own local world and nothing else.

I'm looking for a way to get the checkin history of all machines in the Org - about 500 machines, specifically I'm looking to get the history of IP addresses from which the machines checked in in the last 30 daysthe JSS does preserve the history, but only the last checkin details. /var/log/jamf.log of machines preserve it but on a scale to automate pulling the file and consolidating on a daily basis sounds complicated and prone to error. any other thought on getting this/preserving the history?

I have seen this topic a few times on the forums but never a resolution. We have an issue where when we erase an iPad the apps the previous student had installed reinstall themselves. These apps are just "Make available in Self Service". We have very few that install automatically.  We have tried various methods,, changing Year of Graduation in User and Location or Department temporarily... It doesn't always happen and the fixes don'y always resolve it.Wondering if anyone has resolved this yet. 

My company currently blocks Microsoft Auto Update via Restricted Software tab in JAMF Pro. I've been tasked with finding a way to create an exception so that Defender gets updated on all of our macs while MS auto update is still in place. Has anyone had any experience with this in the past?

Hello Jamf community, We have multiple PreStage Enrollment (1 for each lab + 1 for employee laptops). Other than each one being used as a criteria to place devices into Smart Computer Groups, there is no reason for these to exist as they all have the same settings anyway. So I am attempting to simplify this by deleting all existing PSE and creating a new one (and checking the box for Automatically assign new devices). We'll then use PO number as criteria for Smart Computer Groups or just manually assign each device to a Static Computer Group. My question is: what effect will it have on existing enrolled devices? If any of the existing devices need to be re-provisioned (e.g. a Macbook being assigned from a leaving staff to new staff), do we have to do anything special? Thanks for any advice on the matter.

We are using a policy with a script to make the currently signed in user an admin. We have tried both normal commands for making a user an admin but only certain test devices actually make the user an admin. We are in the process of wiping our devices multiple times a day to test the Pre-stage enrollment and this seems to be one of the few hang ups. For reference, this is the script we are using that works on some devices but not all:`#!/bin/bashcurrentUser=$(who | awk '/console/{print $1}')sudo dscl . -append /Groups/admin GroupMembership $currentUserexit 0`Sometimes it will work and make the account admin but then when we restart the device it will go back to being standard. No amount of re-running this script or a similar one will get it to work after the initial try if its successful either. Is there any chance there is some sort of cache or file somewhere that maybe tells the Mac that a user belongs to the Standard section that needs to be erased or appended to get rid of the

Hello, I am setting up configurations profiles that now I want to start adding in some scoping to using based on user logged in. I see when I go to exclusions it shows the options for LDAP Users, LDAP Groups. However if I go to select specific scope targets (not exclusion) for tabs I don't see LDAP Users or LDAP groups. Is this by design or is there something I can do get that to work? Thank You

Is anyone else having issues with WebClips loading on iOS 16.6?I can get the WebClips to show on the iOS device but it will not load the site I have it set for. I put the same web clip on an iOS 16.1 and the link loads with no issues. Any help would be helpful. 

I'm getting these characters n""n""n""n""n""n""n""n"" in notification emails.   The email body is / n""n""n""n""n""n""n""n"" The following computers were removed from the group "All Managed Clients"Anybody know how I can resolve this issue? I'm not even sure what is suppose to be there. Anyone have an example of a properly formatted notification?Thanks

Hello everyoneNeed assistance with users idle time.When I run the following script on my workstation ( Apple M1 Backbook Pro ) I get what I need but when I run on a M2 Mac mini, it does not work.After moving the mouse or pressing a key, the counter just keep increasing.  It looks like the IOHIDSystem is using the computer logged in time.  I am wondering is there a new way to check for user idle time, command or in Jamf Pro itself.See the out below.  #!/bin/zsh # Pause/Interval between checks checkInt=1 # Timer in sec timerLength=15 # Keep track of the idle timer lastIdle=0 # Get the current user current_user=$(who | awk '/console/{print $1}') # Get the computer name computer_name=$(hostname | sed 's/.local//') # Message to system.log log_message="User $current_user Test" # Function while true ; do ioresp=`ioreg -w 0 -c IOHIDSystem | sed -e '/HIDIdleTime/ !{ d' -e 't' -e '}' -e 's/.* = //g' -e 'q'` idleNow=`echo $(( ${ioresp} / 1000000000 ))` #

I’m wondering if there’s a way to enable lost mode on a group of iPads in JAMF School.  Using the admin interface you have to click on each iPad one at a time and then enable lost mode.  We have a number of iPads left over from last school year that need to be retired this year and I want to disable them with a message to return them to our Helpdesk staff.  I figure the best way to do this would be to enable Lost Mode.  Is there a bulk way to do this?  Maybe with an API?  I couldn't find anything about this with a casual search.Or is there any workflows that would make this more efficient?

Has anyone rolled out the new device compliance within Jamf? we have the old legacy conditional access for our Macs, but I'm wondering if we can incorporate the device compliance for the ipads first and THEN migrate the macs?

Hi,Am I the only one who thinks the latest Jamf Pro cloud UI changes are bad??The links were changed to a blue colour and the other colours look faded.Makes things look they were done by a rookie website designer.It is even worse using the iPad.I use it alot on the ipad while I am out in the field and it is almost unusable.I use it in portrait mode and I cannot see the left hand column of info UNLESS I collapse the menu.Someone needs to explain how this is an improvement!!!Please contact me for further details.

We sent a mass OS update command to install some rapid security response updates. We gave a deferment period of 7 days. This worked for the vast majority of our machines. There are a few however, that a month later are still showing the prompt widow daily. The window states 1 deferral left every day and when you click on it, no updates are available (they've already been applied).These machines are all on 13.5 and all are Apple silicon (likely a false flag). I sent a mass cancellation of commands and they are still persisting. Has anyone else had this happen?