Hi there, Whenever we order a new batch of laptops and we turn them on with hardwired internet, it doesn't go to the Remote Management screen. It goes from Accessibility to Migration assistant, essentially allowing someone to create a local account. I'm not sure what's missing. They are in our ABM and they are in the appropriate prestage enrollment groups I have to go through setting up the laptop with a temporary account and then wipe it in system settings (erase all content and settings,) then it "activates" again in order for it to pick up JAMF connect. Is there a better way to handle these types of issues? We plan on using zero touch but we can't send out brand new laptops if they just can't connect to remote management for the first time out the box.

On Windows, you can set general DNS search suffixes (i.e. suba.domain.com, subb.domain.com, etc). Then there is also a "Connection-specific DNS suffix" setting the DNS server can share when the machine connects to the network (i.e. site1.suba.domain.com) depending on your office location. On Macs it seems to let you either take what the network gives you (which is limited to 1 entry) or use a longer list of manually specified options. Is there a way to mimic the Windows functionality of having a few general search domains which are set by script or config profile, but let the local network set a local search domain?

Hello Jamf experts! I am primarily a Microsoft Intune/SCCM admin.  I also manage our Jamf Pro environment for MacOS.  We currently use a SCEP Cert Profile in intune tied to an NDES server to deploy an 802.1x certificate to allow our azure joined Windows devices access to our on premise domain.  We currently have our macs bound to the domain to allow a cert request for this.  We recently got our Jamf Connect setup going and have no reason to bind to the domain anymore.  I have read the documentation on how to set up Jamf Pro as a SCEP Proxy but I am NOT a mac expert and don't really understand what needs to be put in the fields of this setup.  I'm assuming the URL is the Scep Server Url .  I'm not sure what to put in for Name, Subject, Subject alternative Name Type, or what options I should choose, or what Certificate I should use as the Signing Certificate.  I'm lost.  I opened a ticket with Jamf Support and they sent me the link to the

i have a script that runs software update via JamfHelper, however I cannot get the actual software update command (via API) to run untiless the JamfHelper window is quit. Anyone know how to run a process while still keeping the JamfHelper window open/active?  my syntax is as follows: /Library/Application\\ Support/JAMF/bin/jamfHelper.app/Contents/MacOS/jamfHelper \\ -windowType hud \\ -lockHUD \\ -title "macOS Security Updates" \\ -heading "macOS Updates Now Installing" \\ -description "Installation can take up to 45 minutes.. Close and save your work now." /usr/bin/curl -s -X POST -H "Content-Type: text/xml" -u ${apiUsername}:${apiPassword} ${jamfProURL}/JSSResource/computercommands/command/ScheduleOSUpdate/action/install/id/${jamfProCompID}

I am working to update our Lightspeed Relay cert and need to create a folder to house the .pem files. And I’m in over my head on this one. Kinda, sorta adept at Composer, but not enough to pull this off. Any help will be appreciated.

Hello,I'm having an issue with an app which is Downloaded from the Mac app store through VPP on Jamf. The app MSG viewer for Outlook creates files in /private/var/folders/.../T/.....Cwd.bundle. Several of the files that get created in this temporary folder are quarantined including Cwd.bundle. If the quarantine flag is removed from the Cwd.bundle file it works until next reboot when the files are removed. I have tried working with the vendor but they believe it has something to do with 3rd party security software on our Macs. I though the problem might be related to translocation, but I don't see how that would be an issue with an app directly from the app store. If I download their software directly from their site the problem does not occur AND no files are written in /private/var/folders at all.  I'm just looking for a solution. I've tried various profiles to allow apps from this vendor including using PPPC utility and allowing all but this does not resolve. Any sugge

Hi all, I know this isn't the NoMAD Login support channel but just asking on the off chance anyone else out there has found a workaround to this issue since Jamf Connect is the commercial version of NoMAD. When using a Macbook Air (M1), the NoMAD Login screen randomly goes off center with black bars on 2 sides as if the resolution of the background image is smaller than the screen's and it isn't "stretching" to fill. No other Google result out there except for a single report here about 9 months ago which remains open. 

Here is how I check for macOS updates, install the recent available and reset Jamf Connect login window.- Requires a local admin username, PID and password.Create a Script in Jamf Pro. #!/bin/zsh -i vers=$(sw_vers -productversion) install=$(softwareupdate --list-full-installer | sed -n '3p' | tr : '\\n' | tr , '\\n') name=$(echo "$install" | sed -n '2p' | sed -e 's/^[ \\t]*//') number=$(echo "$install" | sed -n '4p' | sed -e 's/^[ \\t]*//') if ls /Applications/Install\\ macOS* 1> /dev/null 2>&1 ; then rm -rf /Applications/Install\\ macOS* fi if [[ "$number" > "$vers" ]] ; then echo "Installer available $name $number." launchctl asuser <ADMINPID> sudo -u <ADMINUSERNAME> softwareupdate --fetch-full-installer --full-installer-version $number if [[ -d "/Applications/Install $name.app" ]]; then echo <ADMINPASSWORD> | "/Applications/Install $name.app/Contents/Resources/startosinstall" --agreetolicense --forcequitapps --nointeraction --user <AD

just curious if anyone has ran into this scenario. before purchasing jamf, i already had filevault enabled for my mac users, I was saving the recovery key to a safe somewhere in our environment. now that i have jamf, i want jamf to manage those keys with its filevault profile. would i need to decrypt my devices? and re-encrypt upon enrollment so that jamf can manage those encryption keys?

Due to macOS13 not being supported on 2012 Mac mini, which has been providing testing via ESXi faultlessly over the years.. I'm now looking at both UTM and VirtualBuddy.I can enrol and most things work. .but.. looks like recon is not able to see the disk..  thus storage in the device record is zero! This is a problem!Any suggestions for a fix or another method for working virtualising of macOS13 using an ARM Mac?VMWare seems quite far off on this with Fusion.. as for ESXi.. I don't think that's happening...

Just wondering if anyone is using a digital signage solution (mac based)?If so, do you like it and company details? Gabe ShackneyPrinceton Public Schools

Hi folks.I try hard to get VPN On Demand to work. Unfortunately, it currently does not work with Jamf Pro's built-in way (PI-101098), so Jamf Support referred me to iMazing Profile editor. Getting bits and pieces from various web resources together, I tried to built a working VPNOnDemand.mobileconfig by myself, but as soon as I deploy it to my client, it does not have any affect.The VPN on Demand configuration should basically do the following:1.) If client connected to a certain company WiFi network ("SomeWifiNetwork" in the example), it should generally NOT use VPN at all.2.) If NOT connected to the WiFi network above, but any other network, it should ALWAYS establish a VPN connection while trying to connect to certain domains (example1.com and example2.com in the example).3.) Trying to connect to VPN server via L2TP ("1.2.3.4" in the example), shared secret included ("SHAREDSECRET" in example), user name and password should be prompted (hence not included in example).When I deploy i

I am attempting to set (or more accurately clear) recovery lock on an M1 Macbook Air using bash. I work for a school district but we are using Jamf ProWe have had an issue where several hundred of our fleet have been (seemingly) randomly getting set into Recovery Lock. Some after initial log in. Others after our end users have had the device for a few hours or days. While the larger issue of what's triggering it is being investigated, I was trying to help speed up the process of getting these devices back into our users hands and clear the recovery lock code (and then set another one) so they could get back in.We have a little under 10K M1 MacBook Airs and I was able to obtain the management ID (as detailed here) for the devices I want to do this too. I am new to scripting but was able to work my way through obtaining a bearer token and parsing the different pages to find the device in question (using jq to pull the relevant management ID).I've looked at every sample script I could fin

I have found several articles on keyboard shortcuts in the JSS and different modifications to those shortcuts over certain JSS upgrades. But I can't find any information on how to disable JSS shortcuts all together. Is there a way to do this?

Provide your users a seamless post-enrollment experience when setting up their new MacsIntroductionApple’s Automated Device Enrollment helps to streamline Mobile Device Management (MDM) enrollment and device Supervision during activation, enabling IT to manage enterprise devices with “zero touch.”Setup Your Mac aims to simplify initial device configuration by leveraging swiftDialog v2 (or later) and Jamf Pro Policy Custom Events to allow end-users to self-complete Mac setup post-enrollment via Jamf Pro’s Self Service.Continue reading …

We have deleted managed iPads from JAMF without wiping them.What is the suggested way to wipe the devices now?  They still have JAMF self-service on them and it seemingly looks as if they are still managed.  I have tried a reset already but there is no erase all content and settings option. Cheers

Hello Everyone,i have a Problem with some macBooks, some of them has no space on their HDD, System Data is about 100GB, where can i find this Data to delete ?

Deploying O365 with full pkg inc Teams.Auto update via config profile. Looking at https://macadmins.software/ I can see what the version numbers are, along with tracking in JAMF via Patch Man. Both MacAdmins and JAMF show Teams as version 1.5.00.28558 installed Teams says its up to date with version 1.5.00.2760 MAU says 'everything is up to date' I've seen this also with OneDrive going out of whack..  I have a ticket in with MS 🙄  but in the meantime.. any ideas? 

Hi folks.I try hard to get VPN On Demand to work. Unfortunately, it currently does not work with Jamf Pro's built-in way (PI-101098), so Jamf Support referred me to iMazing Profile editor. Getting bits and pieces from various web resources together, I tried to built a working VPNOnDemand.mobileconfig by myself, but as soon as I deploy it to my client, it does not have any affect.The VPN on Demand configuration should basically do the following:1.) If client connected to a certain company WiFi network ("SomeWifiNetwork" in the example), it should generally NOT use VPN at all.2.) If NOT connected to the WiFi network above, but any other network, it should ALWAYS establish a VPN connection while trying to connect to certain domains (example1.com and example2.com in the example).3.) Trying to connect to VPN server via L2TP ("1.2.3.4" in the example), shared secret included ("SHAREDSECRET" in example), user name and password should be prompted (hence not included in example).When I deploy i

So, we had an interesting task of getting Time Machine to work over SMB and making it all scripted for zero touch and automated for remounting on reboots.We have a working script! And we are sharing it with y'all.How does it work?"Autofs" is the key to making this all work.and crontab for activating the mounts on reboot or disconnect/reconnect/We use computer serials as usernames for users SMB mounts to a Time Machine share. and each computer has their own folder by serial in the share, A Sparebundle file is the TimeMachine backup destination in each folder per computer.We run the script via a policy per computer with parameters filled for the script.notes:one odd behavior, if the script fails, a reboot helps get it working, not sure why yet, Requirements:Terminal PPPC, with full disk access,Crontab PPPC with full disk access. script:#/bin/bash # INPUT PARAMETERS: # password # size # server #---------------------------------------------- # o pipefail # -E = err trap inheri

Hi Jamf Nation,As a newbie to the Jamf space, this may be a relatively easy question I just have found it is quicker to just ask first before struggling through a lot of documentation haha.I want to allow our student network users to be able to print from all applications to our secure print server because  they currently receive pop-ups like these:And there is not always an admin like a prof\\lab manager\\technician around to approve. I just want to set a Jamf config. profile that allows printing from all applications, especially from Adobe products for our art students. Currently there doesn't look to be a config. profile preventing this but maybe this is a default for standard users and how the print server is configured via Jamf. However, one of my former colleagues created a config. profile to allow users to modify the printer list which looks like: Does this look like this could fix my issue because the printer isn't locked and allow modifications is selected? Than

Hey All,As part of our DEP workflow, we have Jamf Connect Login to create the account but as a previous step we have the Jamf SSO + PreStage LDAP auth features enabled - Has anyone seen where this can cause issues with corrupting users' account when they try and log-in after a reboot. Im currently investigating where after a reboot users are getting stuck at a macOS loading bar after they have auth'd to FileVault and wondered if the above is causing a conflict.let me know what you think ...Rob 

Hey all!I'd like to have an alias that points to Self Service available on the desktop of all Macs across our fleet. I guess there are several ways of doing this. Just looking to get some ideas on what a quick and easy method would be.Thanks!

Hello.  I'm fairly new to Jamf Pro and need a little guidance.  I sent a Mass Action MacOS update to 12.5 to the smart group All Managed clients.  I followed the workflow for Download Mac and allow to install later with a deferment of 3 times.  So far no one is seeing any message come up that the software update needs to be installed.  It's been over 12 hours and I would have thought they would see something by now.  I'm not sure if I missed something and I've gone back over several times to see if I did it right.  I can see the looking at the computers that the policy for 12.5 is in the scope for each mac with the trigger set to "check-in".  I had a few users run sudos for policy and recon but nothing comes up to prompt them to install.  I have no idea what the user experience is supposed to look like so if anyone knows please enlighten me. 

This is something I have been wishing for a while and decided to put it together myself. It is ready to be used as a JSS Computer Extension Attribute if you want to automate Druva inSync re-install/re-activate via Smart Group or simply obtain a list of computers on which Druva inSync is currently Inactive. Please note: the script is using jq JSON parser, which can be installed on each mac using only a script as I posted here: https://community.jamf.com/t5/jamf-pro/homebrew-and-js-deloyment-using-only-scripts/td-p/247472  You can get the script here on my gist: https://gist.github.com/shurkin18/2c0a1e454f5dbac8b91cfca5893e7722 Or from below:      #!/bin/bash ########################################################################################################################################################################## ################################################################################################################