Hi Jamf community. I've been having some trouble understanding if the following is even possible, so I thought I'd post here to see if anyone has any ideas or has tackled this in the past.I have an EA I created, which gets the expiration date of the machine 802.1x issued certificate. It converts the expiration date into a "Jamf friendly" format, such as 2023-08-10 10:05:00. It reports that (if found) as the result in the EA.The problem I'm having is, I want to build a Smart Computer Group that uses this information to show me any Macs that have these certificates that are going to expire in say, 30 days from now. I can't seem to use any of the built in date operators to make this work. Neither the more than x days ago or less than x days ago criteria will give me what I'm looking for. They seem to onl

Here's our setup:Enrollment Customization with SSO login that passes the username and full name to Jamf Connect so once the user hits the Jamf Connect login screen for the first time they are only prompted to verify the password.They enter the password and their account is created We recently got SecureW2 setup and it is passing certs to my test machine at the computer level, so it is a system cert. The machine connects to the Wi-Fi automatically if you are on the desktop already, or if you do the setup while connected to ethernet.  So now the problem:If I connect to our Wi-Fi network during enrollment, I can sign in using my credentials and approve the on-prem server issued cert and connect and go through the enrollment process, which includes Jamf pushing the SCEP cert and checking the logs on SecureW2 the cert is pushed back to Jamf and so Jamf should be pushing it to the machine. Unfortunately, as soon as I hit the

So I'm distributing app via Policy + Package, but I'm not sure how to "enable" the option to install such app only when the user wants to, so something that people can click as "available to install", not mandatory installation that all pc get.

HiI'm looking at maybe using Jamf Connect, with our Okta environment.So if i understand this correctly, during a login process for a user, they would turn their MacBook on, already be connected to their wifi, and just login using their Okta creds.Our Okta environment is configured to only allow login from trusted IP's (e.g our VPN)How can our users login using Jamf Connect, if the VPN hasn't been activated/enabled yet (e.g before the macbook login process has occured)Thanks

Hi! I am guessing I can use the Jamf Pro API for this on a wrapper script cronned on GitHub Actions.Could you please provide an example of using the API to re-apply en existing profile to the current laptops it is scoped?Thanks!IMPORTANT: If you wonder why I want to do this: It is because users need to disable Wandera for accessing certain wifi hotspots and sometimes they forget to re-enable it. Therefore, re-applying the profile to all the users will automatically re-enable Wandera for them.

Oh, hello there! Welcome to the Jamf Nation forum! As a member of our fine community, you may need to occasionally post a question or comment specifically about the Jamf Nation platform. That’s the purpose of this forum.    If you have product feedback in the form of a feature request for any of Jamf's products, including Jamf Nation, continue to submit those via the Feature Request portal.   As always, thank you for being a part of our great Jamf Nation!

Hello. I work for a small school district. We only have the Elementary and Middle School buildings. One of our staff constantly goes between buildings. However when they do so they begin to lose apps etc. This is due to the different network ranges we have set up.Same SSID name just different ranges. Any advice? Thanks

Hi folks,for a few weeks now we've been getting messages that the inventory has failed. The log looks like this:An error occurred while running the policy "Update Inventory" on the computer "xxx". Actions from policy log: Executing Policy Update Inventory Running Recon... Retrieving inventory preferences from https://xxx.jamfcloud.com/... Locating accounts... Locating package receipts... Searching path: /System/Applications Locating software updates... Locating plugins... Locating printers... Searching path: /Applications Locating hardware information (macOS 12.2.1)... Software update timed out after 300 seconds. The complete policy log is available in the JSS at: https://xxx.jamfcloud.com/policies.html?id=1&o=l Computer Info: ID: xxx IP Address: xxx Serial Number: xxx Can someone tell me what's going wrong? The inventory there for too long and then he breaks it off?Regards

Hi Jamf nationFor user level configuration profile to get applied, is required that the account is MDM-enabled User.We no longer bind our Macs to the active directory, instead we use local admin account with Apple SSO Extension for the connectivity to the AD.Using ADCS, we were able to deploy certificates in computer-level configuration profile and everything works smooth and flawlessly.As most of our users still have incorrect MDM-Capable user, is a reenrollment to fix this issue not an option for us.Did someone find any solution for fixing the MDM-Capable user?Any other ideas to fix this without reenrolling the device?

I'm hoping that someone else may have gone through the same workflow that I'm attempting to follow and may have some advice on how to solve this conundrum.Background:We have around 130 Intel Mac laptops and desktops in our environment, all are currently running Catalina. Unfortunately, we haven't been able to consider updating to Big Sur or Monterey until recently due to some issues with software compatibility, but now that those issues are resolved, we can finally start looking at migrating our Intel fleet to Monterey. We also recently migrated our users away from logging in with AD on-premise via Jamf Connect and Azure authentication, and as a part of that migration we deployed computer certificates with a WiFi profile for 802.1x authentication to our internal wireless network. Prior to the Jamf Connect and WiFi profile deployment, upgrading Catalina to Monterey was flawless, with the exception of the security software conflicts. After the Jamf Connect deployment, ho

Hey folks, Im trying to create a Self-Service policy that will Disable or Enable the "Smart Quotes" keyboard feature in system preferences. When I run this code in my Coderunner app it works perfectly, but as soon as I load the script in the into a Self-Service policy I seem to have issues. The policies behavior looks good, popup comes up but the setting does not change. Any ideas? Thanks in advance   #!/bin/bash #Grab current logged in user user=`ls -la /dev/console | cut -d " " -f 4` #Check smartquote status currentstatus=$(defaults read NSGlobalDomain NSAutomaticQuoteSubstitutionEnabled) #SwiftDialog Location dialog="/usr/local/bin/dialog" #DISABLES if [ $currentstatus = 1 ]; then $dialog --message "You are about to disable Smart Quotes" --icon "/usr/local/images/deepwatch-Logo.png" --mini --button1text "Disable" --button2text "Cancel" sudo -u $user defaults write NSGlobalDomain NSAutomaticQuoteSubstitutionEnabl

Hi there, We've recently migrated all our devices to jamf Pro from Meraki MDM. Our concern is because of how the jamf migrate tool brings devices into jamf Pro as user initiated enrolments that we are not able to manage local accounts the same way we would in prestage/ade enrolled devices. Is anyone aware of a means of getting control of the local user account that would make it possible for us to either delete or change the password of that account of the employee leaves? Since 80% of our devices have been enrolled in this fashion we'd be willing to use a paid solution as well.

Attempting to create a new package but stops at 99%I created a ticket, but no resolution. we started troubleshooting last Thursday.  Any ideas?

I am trying to set up JAWA (https://github.com/jamf/JAWA) to use within my organization for automated notifications to a Teams channel. We have an older Mac Pro we were going to use to host the RHEL server for JAWA. My organization's InfoSec department informed us they require this type of an application to be hosted by Azure for security and compliance purposes. I have not registered an application with Azure before, and I am also pretty foggy when it comes to certificates. I know it is a longshot as I would imagine JAWA is pretty niche, but if anyone has had to register an application with Azure before, or has successfully implemented JAWA in their organization I would immensely appreciate all the help I can get. 

Hi, is there a CLI from MacOS client to fetch the Room info under Inventory/User and Location/Room?

We're in the process of testing out Ventura. I updated from Monterey 12.6.2 to Ventura and keep getting AppSSOAgent error and it says quit or report. Our SSO is working, but this keeps coming up. Has anybody else experienced this error and have a resolution?  Thanks

Hi all,Has anyone had success using an Apple TV device on a touch screen monitor and gotten the touch feature to work? Looking to replace full blown PCs with Apple TV's for large touch screens that are used to display a webpage with different data navigable by touch.Any thoughts/successes you can share appreciated. So far all I have found out there is a bunch of "Apple TV is not a touch device" negative Nancy's. Hopefully some of you are creative and found a way.

Our setup has a generic local admin account to all enrolled macOS devices.We have a policy for FileVault that triggers on logout. I know this can be bypassed but the current workflow works for now until I can get my scenario to work.Our current fleet has encrypted and unencrypted devices.We also have a number of devices prepped, ready to be assigned and not yet encrypted. These prepped machines will have the local admin account and then get delivered to our assigned users. We use Jamf Connect's Microsoft 365 login to allow assigned users a way to create their local user profile.For the devices that are assigned and not yet encrypted, the assigned users have been canceling the encryption popup to bypass the encryption process. Ideal scenario:Do not enforce our FileVault policy to these devices that has not yet been logged in by the end users.After an end user has logged into the device, it wil

I've been testing the Mac Apps catalog and update functionality since the release of JAMF PRO 10.37.2. The timing is very interesting as right before this release we got the internal approval to procure Alectrona Patch to shore up our 3rd party patching.I'm curious though what is the trick to getting the 'InstallEnterpriseApplication' to actually "install" on Intel machines? I have no issues on ARM chipset machines but the intel machines I am testing on just hang in Pending Management Commands and never complete: 

I have a room of M1 Mac Minis used for a Digital Art/Printing lab. The instructors like to use a plug-in that has not yet been updated to run natively on Apple silicon, so to use the plugin the students/users have been finding the Adobe Photoshop.app, getting info, and ticking the Rosetta box manually... nearly every time they go to run the app (the user account is removed upon log out and refreshed via script).I'm curious if anyone has any experience managing these settings. They appear to be set in a plist file in the user's Library folder: ~/Library/Preferences/com.apple.LaunchServices/com.apple.LaunchServices.plist; but I have not had any success trying to manage this with a custom config profile in Jamf, nor does dropping the preconfigured file into place during account creation keep that box checked.

I have been trying to setup an extension attribut for the automox agent on my machines. >#!/bin/shif [ -x /usr/local/bin/amagent ] ; thenecho "<result>Automox Installed</result>"elseecho "<result>Not Installed</result>"fi<I have been running the above on a machine that I know has the agent installed but I am always getting the not installed return. can anyone give me advice?thanks

Hi, Can anyone help me to provide the latest "SetTimeZone and SetTimeServer" Jamf script? as their old scripts are not working in M1+Monterey OS. Scripts are executing without any error but Time Zone>>"Set time zone automatically using current location" tick is not not enabled. 

Hi, I'm running a script from Jamf that pulls a gitlab repo then executes a script from said repo that installs some packages leveraging brew install. The script works nicely on the intel laptop but not on M1The error showing in Jamf should the script executed other parts of the script but fails when calling brew.install.sh: line 10: brew: command not foundIf I run sh install.sh locally via terminal it works well. If I run brew in either bash to zsh it finds the command.What could be occuring differently when executing the script via Jamf Self Service that means it's completely oblivious to the brew installation?Jamf Script Snippet#!usr/bin/env bash #Get loggedInUser name loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name 😕😕 && ! /loginwindow/ { print $3 }' ) #Execute script under loggedInUser #sudo -u "$loggedInUser" ~/devtools/install.sh 

What I was doing in the past to enable the USB services doesn't seem to work on the newer version of the client.  I need to update student's client because their current version does not work on our version of Horizon now.    Previously I did the following after install.sudo chmod 755 "/Applications/VMware Horizon Client.app/Contents/Library/InitUsbServices.tool"sudo "/Applications/VMware Horizon Client.app/Contents/Library/InitUsbServices.tool" &>/dev/null Has anyone had any luck enabling the USB Remote Services for standard users?

These instructions are for those who have an existing profile created for Jamf Connect but would like to utilize properties for a newer version without creating an entirely new profile. In this case, I show how to do this for Update Watcher released with 2.19 on a profile built for 2.16.The easiest way to add the key without creating another profile, or completely redoing your current profile is to go into your current Jamf Connect Login profile, hit Add/Remove Properties and at the bottom go to Custom Property and enter in the key DisableUpdateWatcher.After that you can hit Add, then you should see it in the list of properties to add to the profile.Lastly, after you add it, you will want to choose a data type of Boolean, then you can choose True o