We've been using LDAPS for some time without issue. It recently stopped working sometime over spring break when not in regular use. SSL certificate had expired on 03/30, so the new/current SSL certificate was uploaded but the issue is still not resolved. No other settings have been changed, firewall or otherwise.Test simply returns, "Unable to connect to the LDAP Server." "No Suggestions Available".Cloud logs don't seem to provide anything more specific. I'm not sure what may have changed to cause this issue; may have been Windows Updates on the LDAP servers, or possibly something on the JAMF Cloud side?JIM was a bit behind, so updated it from 2.2.2 to 2.4.0 and rebooted with no change.I can connect using regular LDAP (non-secure/test-only). Somehow there's a problem with the certificate, I just don't know what it is or where to find more specifics. The Subject and SAN both match the FQDN of the host, as expected. And as I said, this has been working without issues for several years, o

I'm being assigned to find out AppConfig for Epic Rover App, so we can deploy the App with server URL and path. There's not much information online, and seems like most app developers are not aware of this feature at all. Ranting aside, anyone has anything related to share?Thanks in advanced

Hi All,We have just purchased 3 Mac Studios with Apple Studio Displays.The problem is I would like to record the serial/asset numbers of the displays to the Mac Studio they are connected to.Anyone got any ideas around this?

So we have had Jamf Connect and Jamf Pro for a 4+ months now and things are going pretty well (read as: still new to Jamf Pro)However I had my first ever "I totally forgot my Azure password" call the other day.After reseting their Azure Password. We were faced with getting the local password reset. No problem, just enter the wrong password three times and I'll give you the recovery key to get in - right?We could not get the MacOS login screen to prompt for a recovery key after many failed attempts. I eventually used the admin credentials to do it.I am testing on a Ventura 13.3 machine enrolled in our Jamf Pro instance running Jamf Connect 2.22.0 and I cannot get MacOS to prompt for a recovery key after trying 10+ unsuccessful logins.Is this a configuration policy in my Jamf Pro? Could it be something configured in Jamf Connect?

I am trying to set an email address as the office licensing activation email.This is what is showing up on the profile on the test machine OfficeActivationEmailAddress = "$O365_licensing_email"Under the Application & Custom Settings paylods I havestring$O365_licensing_emailUnder the computer extension attributes I have:O365_licensing_email:IT@domainnamehere.comWhat am I missing to get that email address populated into the profile payload?

I'm looking for an extension attribute that I could add that would report whether the currently logged in user has the old or the new Outlook UI.  We've run into some issues that seem to be fixed by switching between the two and while we have a gut feeling for how many of our users are still on the old UI, it'd be nice to have some data to back that up.  I haven't been able to find any preference files or anything else specifically that would really tell me one way or the other.  Has anyone else found anything that works?

Hello folks! Wondering if it's advised to remove a computer from Jamf Protect if we plan to repurpose it from one user to another - or will Jamf Protect be able to tell it's on a new user, with a new hostname, etc? Noticed that one of our computers hadn't checked in "3 months" yet it's checking into Jamf Pro every day. Upon digging noticed that the host or computer name were different in both. Thanks!

Is it normal for a policy that only has a script as the payload to never get logs? I have our "master enrollment" script that calls on other policies after enrollment and it shows "pending" on end for any computer. What's strange is that the policies that it calls within the script work/are triggered.Trigger: Enrollment CompleteFrequency: Once per computerScope: All computers - Specific Users

Hello Jamf Nation! We hope your April has started off great! I'm pleased to announce the availability of Jamf Pro 10.46.0 Beta. New features and additions include additional device attribute reporting enhancements, Configuration Profile enhancements, a Volume Purchasing Location redesign, further improvements to LAPS, and more! How to join the beta: We’ve also made some changes to the Beta enrollment process with our new Jamf Nation platform. Please enroll in the Beta Program under Product Feedback at account.jamf.com. Once you’re enrolled you’ll see a link to the Beta Forum. There will be a short delay between enrollment and Jamf Nation beta forum access - you will receive a notification in Jamf Nation to join the beta forum. Once you receive the invitation click on "Join this group Hub" to access the forum.   If you have any questions please email beta@jamf.com.  As always, the beta program is operated under non-disclosure, so please do not share an

Need a way change your Jamf Management Account in a automated way?Check this out:https://www.ericsontech.com/2023/04/change-jamf-management-account.html 

Hi all, We have this script in place to merge or override favourite servers on our clients;#!/Library/Frameworks/Python.framework/Versions/2.7/bin/python # change the above path to your own python if you don't have Munki installed """ Merges add_servers into current favorites and removes remove_servers. Run as root to update all users or as normal user to update just that user. """ import os import getpass import subprocess import uuid import Foundation favorites_path = "/Users/{user}/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.FavoriteServers.sfl2" # add these servers if they don't exist already # use a tuple: ("<name>", "<path>") to set a name for the favorite. # otherwise just use a string and the path will be used as the name add_servers = (("My Name", "smb://server.example.com/share"), "vnc://server.example.com") # remove these servers if they exist. Use a wildcard (*) at the end to remove all shares # does not support ("&l

Afternoon Jamf nation I looking for people who have successfully built a custom dock using this method here https://community.jamf.com/t5/jamf-pro/build-a-custom-macos-dock/m-p/264565Its sort of working, it only seems to be building the dock the second time the same users logs in. Any suggustion on how I can fix this behavouir as I need the dock to be created for every user that logs in when they log in. As this will eventually be deployed to a lab.ThanksTom

I've enrolled our school's fleet of iPads and am currently in progress doing the same to our Macs using Apple Configurator 2. The devices populate correctly in ASM and then I assign them to Jamf Pro, but when I try a test case of Apple Classroom with a teacher Mac and student iPad (assigned as such in ASM with Managed Apple IDs) I see some unusual behavior. The ability to lock students into apps is completely grayed out, as well as the Lock and Mute features. After some troubleshooting with Jamf, I've tried stripped-down PreStage Enrollment profiles on completely wiped devices to ensure no profiles were causing issues, added and re-added the devices to ASM several times, wiped the Mac completely and reinstalled OS, etc. Finally they posited trying the configuration on two like devices--doing so requires me to purchase an iPadOS version of Apple Classroom app on ASM and deploy it through Jamf so I can add it to an iPad. But the app will not appear in Jamf for deployment. I've been back

Using Self Service, it says packages are installed - but they are not anywhere on the Mac. I can't see where anything is configured incorrectly.

I have installed Ivanti client and connected to it, I am using a PSAM feature. To use this I need to get a system extension blocked for the SAM. And I need to allow it on the Security & Privacy section. Issue: I am not getting this prompt nor appeared in the Security & Privacy section. Can any one help me on this. Do we have any terminal command or any other process to enable the system extensions prompt?  OR to manually allow this extensions?  

Hey allcurrently we have the problem that some users can no longer log in to SelfService.We have turned off our LDAP server and switched everything to Azure AD with SSO.We have also changed the configuration so that a login does not have to be required in SelfService. However, after clicking the login button, only a white screen appears: However, this does not apply to all users. Network and Internet can be excluded.Does anyone have any ideas? 

New malware to worry about:https://www.uptycs.com/blog/macstealer-command-and-control-c2-malwareUptycs recommends the following measures and actions:Keep your Mac systems up-to-date with the latest updates and patchesOnly permit the installation of files from trusted sources that allow ‘App Store’ or ‘App store and identified developers.’In Ventura (13.3), "App Store" and "App Store and identified developers" are the only two settings under Security, but it looks like there is a way to run unsigned apps anyway under the "Developer" section?  I am thinking of adding a block for "weed.app" in JAMF - Restricted Software. I didn't see a confirmation that weed.app is the process name, so that is a bit of a guess.

Greetings all! In iPad Prestage Enrollments there is a "Temporary Session Timeout" when. one enables Shared iPads for the prestage. It doesn't appear to have any affect.  Does anyone know if this feature is currently known to not work?"Temporary Session Only" also appears not to work, as there is still the option to log in with an Apple ID on my Shared iPads.I will probably have to call Jamf on this one, as I did previously for the inability for MDM commands to change the amount of time until the Shared iPad screen locks. This turned out to be a Product Issue that was reopened.  

We are trying to setup Shared iPads for one of our departments.  However, devices will timeout back to the Lock Screen after 2 minutes and we cannot locate the ability to change this to 1 hour. Our PreStage Enrollment sets the device up as a Shared iPad, Temporary Session Only, Temporary Session Timeout of 3600 secondsOur Configuration Profile targeting the device cannot set Maximum Auto-Lock or Maximum Grace Period for Device Lock settings from Passcode section or the Profile will failManually issuing a remote command to the device to Update Passcode Lock Grace Period (Shared iPad Only) or Adjust Shared iPad Settings do not seem to helpI've attempted everything I can think of at this time or have found online and no matter what, the devices will go back to the login screen after 2 minutes.  As these iPads will sit on screens that need to be referenced without interaction for several minutes at a time, this has created an issue where the devices are not functional for th

Hello,i have the problem, that the devices on their first registration ask to create manually a computer account. I don't know why this happened, because in the past the process was the following: We have SSO Azure and the user got the Microsoft Window to login with the Microsoft-Account credentials. After that the MacBook automatically created the local computer account like the Microsoft-Account.But now, after login with the Microsoft-Account the user must create manually a computer account and there is no automatically account creation. If you do that, you get an error after a few minutes.Can somebody help me? I do not know what is wrong with our configuration in Jamf Pro and i don't find something to fix that.Thank youJulien

Using the API, is it possible to get the value of a single extension attribute? For example if I have the follow XML<computer> <general>...</general> <extension_attributes> <attribute> <name>Domain</name> <value>DomainA</value></attribute> <attribute> <name>Firewall</name> <value>On</value> </attribute> </extension_attributes>Is it possible to request the value of the Firewall extension attribute?

Hello JAMF-ers. I am give access to upload CSV files into our inventory Preload to one of our new system technicians and I am having some issues figuring out what all is needed to be able to do this. I've given him Read, Create, and Update rights to nearly everything in our instance (except for scripts and users). I'm guessing maybe it needs delete access to something in particular? If anyone has any insight, it would be massively appreciated. 

I need assistance in settings up permission for a user that only needs to be able to upload inventory preloads for mobile devices.. currently they can only view active data but need to know hte correct permission(s) so they can upload a new CSV file.

How Erase-install script bypass the end user's admin credential to provide at the time of OS upgradation? In which step of script it is helping us to bypass the admin credential?  

We have an iPad Air software version 12.4.6 which is managed by JAMF Pro.We can no longer send commands to it through JAMF.  Everything is pending.Wifi connected fine.The capacity is full.Restriction policy does not allow to delete devices from the iPadWe simply want to wipe it.   Even unmanage device command just stays in pending.Any suggestion folks?~ Peter