Purpose: While Jamf Pro can deploy multiple packages as part of a pre-stage enrollment, some MDMs are not capable of this. Alternatively, if a client computer is on a slow network connection or a user proceeds through Setup Assistant very quickly before Jamf Connect can be installed, a user may experience an unexpected result of getting a macOS login screen. By wrapping the Jamf Connect installer package in another installer package with assets and a postinstaller script, administrators can add custom branding images and scripts in a single package. Tools required: Jamf Composer or similar tool to create .pkg files. Procedure: Collect wallpaper images, branding logos, help files, scripts, and any additional assets needed for a zero touch deployment of Jamf Connect. Refer to https://www.jamf.com/blog/zero-touch-deployment-with-jamf-pro-and-jamf-connect/ for a larger discussion on this topic. Keep the assets to be included in the file as small as possible. For best user experience

Hi all, I am trying to find the plist that I can target to restrict Nessus Agent from being clickable in System Prefs. Any ideas?

I am importing data from jamf into ServiceNow using the REST API and for some reason the Storage Section is not expanding so I can add those fields, other ones like userandlocation and hardware,  any ideas why this would be?

Hello,My company wants to upgrade all devices to Safari v16.4.1. I know it's possible to upgrade from each endpoint via System Settings/Preferences. But can it be done via Jamf? I figure at the very least I'll need the latest installer, and I can't find a way to get it. I'm also aware that the latest Safari is bundled in the latest version of macOS, but if possible I'd like to avoid having to upgrade the OS. In a perfect scenario I would create a policy with the Safari installer and scope it to all machines, but I'm not sure this can be done. Just throwing the question here in case somebody knows for sure. Any advice is appreciated. Thank you.  

Hi all,Wanted to share that we are actively developing to implement deferrals in an upcoming beta release of Jamf Pro, targeting between Q4 of 2021 and Q1 of 2022 to solve for the below use case.As a Jamf Admin, I want to issue a remote command for my macOS devices to update their OS, while also giving them the option to defer the OS update so that their critical workflows aren’t interrupted (ex. during a presentation), while also ensuring they stay up to dateExample mass action/remote command workflows moving forward:(Existing) Admins can issue a remote command to a set of devices to download and install to an upgraded version of macOS ASAP, restarting end-user machines as necessary(Existing) Admins can issue a remote command to a set of devices to download to an upgraded version of macOS and notify the end user(Upcoming, net new) Admins can issue a remote command to a set of devices to download to an upgraded version of macOS and notify the end user, and input a MaxUserDefe

When connecting the ipad to Apple configurator, there is a big podlock icon. And I'm unable to install profiles on it. Please help. Any recommendation/advise is much appreciated. Thanks!

Hey there,It's that time again folks! We're revving up to upgrade our Mac computer labs at the university this summer. Last time, in 2019, we traded in our Network Accounts with mobile home folders for NoMAD Login when we upgraded from macOS Mojave to Big Sur. While the just-in-time user creation of NoMAD Login is certainly slick, the AD home folder mounted as a share instead of the symlinked home folder we could get with Network Accounts has caused some headaches since last time around. Namely, students have been accidentally saving files to the local storage, leading to a search party for their missing data and lots of time wasted that could have been better spent elsewhere.I know that Network Accounts and linked home folders were far (very far) from perfect, but this file-saving mess was never an issue before. So here we are, ready to upgrade once again and looking to overhaul, or at the very least lightly revise our user management. That's where you come in, the infinitely competen

Hi Guys,We renewed our push certificate and it seems that this has not updated on the iPads we are managing meaning that we cannot send any commands out to the iPads. We know restoring them through AC2 works but we manage about 500 of them so isn't feasible to do this for every single one. Is there a way round this?We had the idea of downloading the certificate itself from somewhere and manually installing it but can't seem to find a downloadable copy of the certificate, only the jamf token.Any suggestions would be greatly appreciated.

One method of upgrading your customized Setup Your Mac script to the latest versionIntroductionApple’s Automated Device Enrollment helps streamline Mobile Device Management (MDM) enrollment and device Supervision during activation, enabling IT to manage enterprise devices with “zero touch.”Setup Your Mac aims to simplify initial device configuration by leveraging swiftDialog and Jamf Pro Policy Custom Events to allow end-users to self-complete Mac setup post-enrollment.Release CycleFor each of the last several months, an updated version of Setup Your Mac has been released (and reviewing SYM’s CHANGELOG shows it).Many Mac Admins share the same sentiment:I’d like to upgrade to the latest version, but there doesn’t seem to be an easy way to both use the new features and maintain my customizations.UpgradingThe following high-level overview is written for Visual Studio Code; James Smith has an excellent presentation on Visual Studio Code for Mac Admins.Continue reading …

Hello community,we are using jamfschool to push wifi profiles to our iPads.What settings in the restrictions tab are best practice to prevent sharing these connectionsor to show the password?thanks 

Hello,we are a school with many iPads that are managed but also able to be privatly used by the students. For this we allow parents to use the Jamf Parent app. We have currently an iPad that keeps getting a profile installed that restricts a lot of the apps and other functions as well, basically rendering the iPad almost useless. I have talked to the parent who installed the app and he said "something went wrong" and he had to uninstall the app and now he cannot set up it anymore after reinstalling. When trying to rescan the QR code by the parent, the parent app  says: "This device has already been added to the overview page" (translated from the german: "Dieses Gerät wurde bereits zu ihrer Übersichtsseite hinzugefügt").This is a snippet from the activity log:It seems to me as if the jamf server keeps thinking it needs to install the profile without the parents app issuing the command. Can this happen? If I manually clear the parents restrictions on the device it is in fact c

So the first time around the MDM profiles didn't install correctly. Now when I try to manually delete the old profiles it won't let me because of the above error.  Even if I logon with local admin rights ... I even tried to logon with local admin rights and run sudo /usr/bin/profiles remove -allBut it errors and says profiles: There are profiles installed that marked non-removableI need to get this laptop built today can anyone help? 

Hi allIs there any way that we can find out what is the current Apple ID on the Mac ??

We are attempting to build a compliance dashboard for senior leadership.  One of the top compliance items is that macOS be up to date.  That criterion is defined as that the endpoint must be on the latest patch and version of macOS within 30 days of release.  What we need is a data source that we can poll for the most recent version of macOS and when it was released so that we can feed the logic in the dashboard.Has anyone put together something like this, and if so, what did you use for the data source for the current version and patch level of macOS?

My Script doesnt seem to be working any ideas. Can anyone see what is wrong.#!/bin/sh#get serial numberserial=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}')#Define Laptoplaptop=$LPTcomputerName="$LPT-$serial"# Set the ComputerName, HostName and LocalHostName/usr/sbin/scutil --set ComputerName "$computerName"/usr/sbin/scutil --set HostName "$computerName"/usr/sbin/scutil --set LocalHostName "$computerName"  

I bought a MBP last year that came with Monetary OS installed. During setup I connected to the internet just fine with no issues.A year later I upgraded my computer and was going to sell the one I got last year, I went to do a full wipe of the drive and install Ventura OS. Upon setting it up and connecting to the internet I was presented with a message stating my device can be configured my Netflix remotely.I am curious as to how initially I never saw that message then when I go to upgrade the OS now my device is somehow MDM locked?Of course I have no way of contacting Netflix IT to resolve this as I feel this is some mistake. Is there any way to get this unmanaged or removed? When I continue with the setup it takes to a screen where at the bottom I can see different servers like jamfcloud as if its trying to connect and then it brings me to a screen to sign in to google, if I do that it just errors out. My only way to bypass is to not connect to the internet but I had to downgrade bac

Hello, I was wondering if any knows of a way, if it's either scripting, or making changes to the PPD file, to automate the process of configuring a printers Department ID? We are deploying a Canon copier, that is locked with a department ID, and the settings do not seem to stick, when I upload the printer to Jamf, even though, I am setting them locally, on my computer. Any insight into this would be greatly appreciated! :)  -Loren 

I'm trying to automate Department ID configuration for our Canon MFD's deployed. Composer says that changing the department ID modifies the PPD file for that printer, however I can't seem to find where in the PPD file this is being changed. Has anyone had any luck deploying printer payloads with the Department ID included? If so how? Help.

Beginning yesterday morning, we started noticing commands to our iOS devices that are removing EDU profiles. Nothing in classes or users assignment on the devices has changed, but I'm finding that many devices are losing their EDU profile. I can look at classes and see who is listed as teacher, and then I go to a device assigned to that user and it shows the EDU profile was removed in the past day even though the class is still there. Our classes are not created from Apple School manager, so it's not a change in the sync because we don't have Apple Education Support configured. I also manually created a class and added myself as the teacher, but no EDU profile has installed or come up in pending commands. Has anyone else seen a mass removal of EDU profiles, or know what would cause this?

Hello, trying to remove the demon known as SEP from a few machines. I am deploying the Broadcom provided script via PKG, then invoking it via policy with the -A switch. The following appears in the logs:Result of command: TERM environment variable not set. TERM environment variable not set. com.symantec.mes.systemextension.systemextension com.symantec.mes.systemextension.systemextension is systemextension SystemExtensionName: com.symantec.mes.systemextension find com.symantec.mes.systemextension need to be uninstall in /Applications/Symantec Solutions/Symantec Endpoint Protection.app Removing /Applications/Symantec Solutions/Symantec Endpoint Protection.app 29:114: execution error: Not authorized to send Apple events to Finder. (-1743) Failed to remove /Applications/Symantec Solutions/Symantec Endpoint Protection.app. ATTENTION: You must use the uninstall option in your product's "Symantec Endpoint Protection" menu.  It looks like it's just not permitted to remove

In our Mac classrooms we would like to standardize the right-click (as secondary button) feature on new user accounts, without having to manually make the change on setup. I'm attempting to do this with a JSON Schema affecting com.apple.driver.AppleHIDMouse.plistSo far, I've had no success. Can someone with some experience take a look at the schema and configuration profile and let me know if I'm making any simple mistakes?JSON Schema: { "title": "Enable Right-Click as Secondary Click", "type": "object", "properties": { "Button2": { "type": "integer", "title": "Secondary Click Button", "description": "Set the value to 2 to enable the right-click as a secondary click." } } }  Plist Preview: <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Button2</key> <in

Our machine certificates are formatted by hostname.domain.comWithin the certificate payload, should I use CN=$COMPUTERNAME.domain.com or CN=$HOSTNAME.domain.com? I was hoping I could do it by DNS name only  - but the Certificate payload requires a subject.    

i want to create an extension attribute to display FileVault recovery key.No luck with this one.Thanks for your advice

Customer Education is back again with our second Jamf Pro Release Notes video! Join us for an overview of some of the new features and enhancements that are available in Jamf Pro 10.45. We hope this new resource continues to provide additional details to support your use of the features in this release. We got so much wonderful feedback from you all last time to help us make this one better, so feel free to leave a comment and let us what you liked and how we can make it even better next time. Take the quiz below to test your Jamf Pro 10.45 knowledge!  

I use a Policy that runs the script below to name our MacBooks to the machine's S/N that runs after enrollment and lately it stopped working.  It might be since Ventura came out or one of the revision, but I cannot confirm.  I can run the commands manually so they commands haven't changed.  Any suggestions would be great. #!/usr/bin/env bash# Get the Serial Number of the Machinesn=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}')# Set the ComputerName, HostName and LocalHostNamescutil --set ComputerName $snscutil --set HostName $snscutil --set LocalHostName $sn