I've seen three different values for FileVault recovery key: valid unknown invalid Valid and unknown are obvious, but how does a key become invalid?

Hi Everyone, We are having a really strange file vault issue here. We have some machines that encrypt with our config, everything looks fine then, out of the blue, the personal recovery will report as invalid and shows as invalid when I check on the client with fdesetup. Then sometimes, it will resolve itself. Ive even compared DB backups to see if the recovery key changes and it stays exactly the same. I hope someone might have some ideas because this could lead to some major issues. Thanks Dave

Hi there,We have some users who needed to run Mojave until recently. We went to upgrade them (all users are remote) and I noticed that every system running Mojave stopped checking in with Jamf on 8/13/22.We disable Admin access for end users and use either the Jamf Admin user or a policy to temporarily perform admin procedures.Unfortunately both of those options are not working (Jamf admin refuses password and zero policies in Self Service will work, they just error out).The last thing I want to do is ship the computers back in and manually wipe them and restore them. Does anyone have a solution for forcing check in on systems that seemed to have dropped off?

Hi all.Anyone have a quick shell script to rename computers by looking up the serial in a CSV file? Figure it should be easy to install a CSV on the computer and then run a script to rename?Of is there another easier way to do this? Why? I duplicated a renaming policy and then didn't remove "all computers" from scope, causing buggered computer names. It would be nice to not have to fix manually.

Retirement of selected ‘Legacy’ definitions. Back in February of 2021 we announced that we would be marking a number of Patch Management definitions as deprecated. This was quickly changed to adding the text of (Legacy Definition) in the publisher column of Patch Management due to the unintended consequence of the ‘Deprecated’ tag. Since that time we had been maintaining the Legacy Definitions in sync with new new replacement definitions, though we have recommended that customers use the ‘newer’ definitions in their Patch Management policies.We have now made the decision to formall

Hello!I'm trying to dream up the best method for our SRE team, who maintains our non-IT, product-focused, VPNs... to deploy the various VPN profile files out to all company machines. Without going through IT, so they can work during their normal hours (which are far greater than IT's current hours). And this allows them to manage the VPNs swiftly.They need to deploy a number of .OVPN files to a specific folder on machine. It looks like building a .DMG is a good way to do this if we want to use Jamf... but then I get a little stuck. I see through the API (Jamf docs here, great post here) that I can give the SRE team an API key that empowers them to push that file into our Jamf file repository. But... that st

Hello, My users create shortcut icons on their home screen on the ipads from safari and then need to delete them and are unable to. This restriction seems to be enable as default as other configuration profiles restrictions on different scope are set to allow apps to be deleted and they also can not delete them. Is there a way to look at the global settings that seem to be locking down the configuration profiles?And/Or how do we check/change the ipads as supervised versus unsupervised?Thanks, TMAC

On Mojave, we deploy (lab) iMac using "kcpassword" method that auto login to an account upon enrolment completion which then runs DEPNotify to complete/start the initial setup. That same setup is not working for Catalina. Any help would be appreciated.

Hi All,I'm trying to use this script to determine if a Mac's uptime is 5 days or longer, then output results as "Yes" if so, and "No" if not. But when configured as an EA, it only gives the "No" result. What am I missing?#!/bin/bash# Get the system uptime in secondsuptime_seconds=$(awk '{print $1}' /proc/uptime)# Calculate the uptime in daysuptime_days=$(echo "$uptime_seconds/86400" | bc)# Check if the uptime is greater than or equal to 5 daysif [ $uptime_days -ge 5 ]; thenresult="Yes"elseresult="No"fi# Output the result in the correct format for Jamf Proecho "<result>$result</result>"

We have 150 managed iPads that are booked out on a lesson by lesson basis across school and we have 8 periods a day.  When students sign out of their device the user profile remains, and at the end of the day we have to delete every user profile on Jamf (via management command) to free up disk space, otherwise lessons will be impacted the following day.  The shared iPad settings are set to ‘number of users = 8’.  Also, students sometimes forget to sign out so we have to log them out as well.This is very frustrating as there isn't a blanket command for all devices to 'delete user profiles' and 'log out users' which would be a much more effective method for managing shared devices and way less time consuming. 

What is your opinion of Jamf? Do you like it? Do you hate it? What is its biggest weakness? Where does it excel? Who does Apple like most between Intune, Airwatch, and Tanium? How do end users benefit from Jamf over other support options? Pros and Cons. Who is better than Jamf?Interviewing for a position at my company and I am tasked with presenting Jamf. Specifically, I had the option to pick between W365, Tanium, and Jamf as my presentation.Any help would be greatly appreciated. I have enjoyed my research into the company so far and hope to get some real-world feedback from those who live it.Thanks in advance.

Hi All, I've been doing a lot of research on 802.1X certificates as we are looking to move away from AD-binding and move to a software such as JAMF Connect in the very near future. This has brought many challenges while researching, and I think I've just made myself more confused in the process. I'm a novice with networking, so please bear with me on that.  Here is essentially what I need to do: I need to have some way to authenticate with the network at the login window on non-bound machines. I've read that using a machine-based certificate with distribution via SCEP is the way-to-go in this scenario, which is fine at the logon window.Our security policies require that we have user-based authentication when a person is actively using a machine. So if John Smith logs in, John Smith's credentials need to be used to authenticate against the network, not the machine-certificate used at the logon window.  

Today we released Jamf Connect 2.21.0. This release includes the following changes and improvements: Jamf Connect no longer supports macOS 10.15.x. Computers with macOS 10.15.x or earlier will be unable to install Jamf Connect version 2.21.0 or later. Any automatic update workflows configured in your environment will no longer apply. Jamf recommends updating to macOS 11.x or later to ensure continued support. For Jamf Pro users, see the Deploying macOS Upgrades and Updates with Jamf Pro 10.34.0 or Later technical paper for additional information. The Jamf Connect login window now supports password passthrough for IBM and custom identity providers. The OIDCUsePassthroughAuth key can be toggled in the Jamf Connect Configuration app to enable both IBMCI and custom identity providers. To access new versions of Jamf Connec

A lot of my enrolled macs are not updating the user field. Its random but its really an inconvenience to have to update them manually.any command out there to update users and location field? when the field is not populated? My macs get named after user ID. We run a script to rename them and bind to AD based on LDAP userID.Again this is random as some work and others dont. Dont even know where to begin to look as to why.Im running latest but this happened before on all versions 9.x

Hi Everyone,I am wondering if its possible to allocating 5-10Gbs of storage of an device, to be allowed to used for updates,Thanks

Hello everyone,  I want to send an "Advanced Computer Searches" result to another team using Power Automate.Whatever I do, the email body doesn’t show the result I want “mac address”  Outlook result:  Any idea ?

Today we are releasing a maintenance version of Jamf Pro. Jamf Pro 10.44.1 fixes the following product issues: [PI111020] Resolved a Cross-Site Scripting (XSS) issue. [PI111048] An error calculating scope no longer occurs when the scope of an Azure AD group contains 1000 or more users. For additional information on what's included in this release, review the release notes via the new Jamf Learning Hub. To access new versions of Jamf Pro, log into Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Pro. Cloud Upgrade Schedule Your Jamf Pro server, including any free sandbox environments, will be updated to Jamf Pro 10.44.1 based on your hosted d

Maybe this is not possible with Jamf Now and might be with Jamf Pro. Is there a way to automatically log my users into multiple apps at the deployment stage?For example, If a user has a YouTube Kids account and a Disney+ account. Can I set up a profile to have these apps logged in when the users get to the iOS device for the first time?Having 20 or 30 apps with different login accounts can be a headache. Maybe I'm missing something or can someone point to some documentation to help me? Thank you!

We use Azure. Azure is mapped to jmaf. When I click on a device I can manually assign an Azure user to it, but when I try and add an Azure user to a static group it says I don't have any users.

Is it possible to only use the Guest account on Business Shared iPad? Not allow any user to log into a managed Apple ID, but allow the use of the Guest account. We still want the Guest account to log in and log out, which will erase the patient data. We just don't want patients logging in with an Apple ID.

We have AD-bound Macs in our Jamf environment. Our AD passwords expire after 90 days. We would like to force the change of the local break glass accounts on the Macs every 90 days, as well. I'm trying to avoid flak from users who might have changed their AD password a couple of days ago.If we deploy a configuration profile that includes the Maximum Password Age set to 90 days (the same as our AD policy), does anyone know if that will conflict with the AD policy? 

I have been using Jamf for about 5 months to lock down iPad with Web Clips. Over the past few weeks, I have struggled to get Chrome and Teams pushed out to a group of iPads.First, I logged into the Apple Business manager and Purchase 100 licenses of each.Second, I log into Janf and, on the mobile device apps page, update the apps to Install Automatically, set a scope to target a smart group, and under managed distribution, checked "Assign Content Purchased in Volume Assign" and selected a location. Chrome does install but does not take away from the license count. If I have the device in a locked-down configuration policy, I get "Pending - All licenses are in use or the license is not assigned yet".Have yet to get teams to install, just get "Device was busy. Will try again.",  the device is just idle on my desk.Any suggestions?

Hi, has anyone else faced this issue we are experiencing an issue with our domain join policy which is getting failed nowadays in the machines and Jamf policy logs are showing "Your password has expired" we already tried to reset the password and also checked with the new password but it's still showing the same thing. Do any idea what will be the reason behind this??

Hello group, I'm attempting to create a custom ForcePoint ( WebsenseEndpoint ) installer for hosting on Self Service and automated deployment via policy. At present installing ForcePoint is a manual and tedious process that involves installing two separate packages with administrative privileges. These two packages require launching and installation to be done from within the directory that contains the required " ca.cer " , " DLPClientConfig.hsw " and " localConfig.xml " files ( listed below ) .... I've used ForcePoints " WebsenseEndpointPackageBuilder.exe " package builder application on Windows which creates the folder contents listed below, great but still requires manual installation ... Does anyone have any insight or had luck creating a custom package in composer ? I've tried multiple times with little to no luck...Any help would be greatly appreciated. ForcePoint direcoty contents - 1

Hi everyone,I've almost deployed Crowdstrike successfully on our fleet using Jamf Pro and the documentation available in the Crowdstrike support portal.However, I've found that I'm unable to successfully contain a host when I've deployed Crowdstrike via Jamf. If I deploy Crowdstrike manually without Jamf, the network containment works as expected.Crowdstrike support aren't being their usual helpful selves with this issue.Could someone who has a self-hosted instance of Jamf Pro and has deployed Crowdstrike via Jamf confirm that you can network contain a mac host? Thank you.