Hi all, just a quick question for anyone who uses Keyserver. I am in the process of rolling out a new version of the KeyAccess client (v6.2.0.2) and would like to be able to use the .mpkg that is provided directly by Keyserver as it can be customized for our environment using the k2clientconfig command line options. The issue that I am running into is that if I set a policy to install the .mpkg on a machine the package is installed incorrectly (the installer logs show permissions errors). I checked out the JAMF Knowledge base and found this article (http://jamfsoftware.com/kb/article.php?id=157) which I assume is the problem that I am experiencing: "The MPKG file format may not always work natively with Casper Remote or Policy deployments. This is because embedded permissions on the files within the mpkg may conflict with the privileges used by the Distribution Point read/write user. It is suggested that you first try using the .mpkg file on a test machine. If the deployment

Hi All,Any ideas on how we can deploy Google Chat App via Jamf Pro for Mac devices? New to Jamf,Tem

Hi all,I need bit of guidance and suggestions here. I've been using Jamf for a few months now and would like to push out an update to all enrolled Mac devices for 12.6. What is the best way to push this out that doesn't restart the computer for the end user. I want them to be able to download the update in the background but restart upon confirmation of the user.  Thanks for all the help in advance!

Back in January we had a discussion here about finding the uptime of amachine and displaying a message to users to reboot their machines. I justwanted to follow up on that and hand out what I've done here to implementthat. First of all, the reason I want to implement this (because I know that was aquestion) is because my users have a tendency to not restart for over 7days, some up to a month or longer. And, I get calls about performancedegradation or strange things happening. They don't even restart when Idisplay a message that says "Software updates have been installed, pleasereboot as soon as possible." So, here's what I've done: Create the following script, named it uptoolong.sh: #!/bin/sh # Name: uptoolong.sh# Date: 3 March 2010# Author: Steve Wood (swood at integer.com)# Purpose: this script will check how long a machine has been up and displaya notification# using Growl and Growl Notify. # set some variables and grab the timedays=uptime |

I've done simple Jamf Now Auto-enrollment and have stupidly changed my User accounts to standard users using a terminal command I thought I could revert back to as and when needed. But I can't seem to revert the terminal command. Learnt my lesson is always have an extra admin account when using terminal commands.Will I be able to boot into recovery mode on these Macs and removed the setup file, which allows the macOS setup assistant to run again? Or will the Jamf Now Auto-enrollment stop me from doing this?Basically I want to do this: https://osxdaily.com/2022/03/25/no-admin-account-mac-fix-macos/ The terminal command I used was: sudo dseditgroup -o edit -d UserName -t user admin

Hi all,As we know that Apple changed the iPhone sync method to using finder as their option.https://support.apple.com/en-sg/HT210598my question now is if anyone know how to block the data transfer for iPhones on the mac via Finder? 

We are currently preparing our fleet to migrate from 2018 MacBook Air's running Mojave to 2020 M1 MacBook Air's running Monterey, and we are running into a problem. When a new machine is set up and there is no migration of a user folder, everything works fine. However, if a user folder is migrated, it seems that Self Service will SOMETIMES, not all the time, stop working. Anything that tried to install will return with "an error occured". When checking the jamf binaries by doing a "sudo jamf manage" on one machine that was exhibiting this behavior, terminal says "A valid device signature is required to perform this action" which usually tells me that something got messed up with the Jamf Binaries, so here comes the second issue.When I enter the "sudo jamf removeFramework" command in terminal, the config profiles that were installed do not go away; and, I can't remove them manually. When I try to re-enroll the machine,  it tells me to install a new MDM profile, so I do, a

A lot of different students use the laptops where I work and we have one set profile for them to use. The idea is that when the laptop logs on we can disassociate from the WiFi and also delete the password key that sits inside of the keychain access so each student can use their own WiFi username and password. I've managed to do this and I can do it manually through these commands:#!/bin/bashsleep 30echo "sleep over"sudo /usr/libexec/airportd en0 disassocsudo /usr/bin/security -v delete-generic-password -l networkaliasecho "disassociated"First I give the computer about 30 seconds to reconnect to the wifi before disassociating and then I use the next command to delete the password that sits in keychain access. These commands work perfectly fine when I run each one manually, along with when I use "sudo jamf policy -event trigger" to force it for testing, but every time I let the command run itself on logon it disassociates but never deletes the password and lets you reconnect to the

I know there is an account created when the device is enrolled into Jamf but we would like to create another admin account when the device is being enrolled and also to all the current devices we have enrolled. What is the best way to do this?

Just messing around with creating a script with a co-worker. I've seen some previous scripts that when you run them it launches the systempreferences>Software Update. I'm not very good with scripting, so I'm having issues finding what command actually opens the update window. I'm using a modified version of the script here. We did modify it, but the final step where it shuts down never kicks off. Handling macOS Software Updates with Jamf Pro | Babo D's Corner (wordpress.com).

I have not found a clear answer on this.When we get alerts on devices that have a file path of Users/<username>/Library/Logs/DiagnosticReports/XProtectRemediatorXXXX.diagAre we supposed to download that log and open it to figure out what XProtect found? Or is the XXXX in the file name the malware/virus name that was found by XProtect? I am having users download Malwarebytes to install and run to see if that finds anything. Does that sound like a good 1st step?  

Hi, If using the deferral option when sending a mass action MacOS update, does anyone know how long it is between each deferral reminder/until it forces update if last deferral has been used.

Hey Everyone!  Running into a snag with the new v1.3.1 Okta Device Trust registration process.  There is nothing wrong with the script, rather i'm running into deployment issues of command line tools (python3). This is the script I'm using to get the command line tools:#!/bin/sh echo "Checking for the existence of the Apple Command Line Developer Tools" /usr/bin/xcode-select -p &> /dev/null if [[ $? -ne 0 ]]; then echo "Apple Command Line Developer Tools not found." touch /tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress; installationPKG=$(/usr/sbin/softwareupdate --list | /usr/bin/grep -B 1 -E 'Command Line Tools' | /usr/bin/tail -2 | /usr/bin/awk -F'*' '/^ *\\\\*/ {print $2}' | /usr/bin/sed -e 's/^ *Label: //' -e 's/^ *//' | /usr/bin/tr -d '\\n') echo "Installing ${installationPKG}" /usr/sbin/softwareupdate --install "${installationPKG}" --verbose else echo "Apple Command Line Developer Tools are already installed." fi e

As a user i can give myself temporary admin by opening SelfService>Security>Install(Temporary admin rights for 10 min). So i was thinking to make some script that will be able to do such thing so i dont have to go in Self Service all the time to do so. Is something like that possible?

Hi everyone we are rolling out BT privilege management to our Endpoints and we are running into issues assigning the policies to different flex groups e.g high low and medium flex. We have the Azure AD connection enabled but we cannot assign AAD groups to Macs in the console(we can for Windows). When we assign policies via standard AD groups the policies don't filter down to the devices. Apparently this is a known bug. Ideally we don't want to use AD as we are trying to move away from Binding.We have reached out to our BT rep but we haven't made much progress. How are you all pushing policies to the different groups?

EDIT: This seems to be an issue effecting multiple JamfCloud hosted environments. I have Logged a support case with Jamf, as have other community members.I will keep this thread up to date with any information from Jamf Support. On two JAMFCloud Jamf Pro instances, running version 10.40.1-t1659581750 I am unable to save a particular script into Jamf, as every time I press Save it results in a 403 - Access DeniedWhilst debugging this I have found that there are certain character combinations that cause this error.If I try to save a script with the following text only, I will get the 403 error${a:}${}  the "a" parameter / var can be swapped with any letter or number and it will still cause the errorIf the curly braces are not touching the last $ it will save fine, if they are touching however it will error.There can be text in between the first ${a:} and the second ${} and it will still crash.The lines can even be commented out, and it will still crashe.g. the below w

Hello All I am trying to move our company to zero touch deployment. I have all my policies with custom triggers and config profiles setup, ive tested DEPnotify as a self service policy and it worked like a charm. I am having some trouble getting this to work with prestage though as i need to have JAMF connect there to login. I also saw there is something called JAMFConnectNotify but i havent seen much about it in use online. Does anyone have any info on deployment for these, i tried deploying depnotify by itself but it didnt work correctly. I was going to try with having JAMFConnect and DEPNotify as prestage packages and test. I used this guide to setup DEPnotify for prestage enrollment, https://hcsonline.com/support/white-papers/how-to-deploy-depnotify-as-a-jamf-pro-prestage-enrollment-package-with-custom-launching-scripts

I deployed Postman to a test MacOS system and the user is a standard user. Was prompted this morning to update Postman with a Admin user id and password.Did I miss a step? 

I was approached by one of my IT security guys today and he asked this question... Is there an easy way to monitor changes to "~/.ssh/authorized_keys” with the help of JAMF then send an alert the appropriate personnel? Does JAMF have any build in alerting functionality or should we use sendmail or something? We want to do it based on pen test results. After giving this a brief amount of thought, here is the first thing that came to mind... We could easily run something like an md5 checksum against the keys during regular JAMF check-ins. If MD5=true, nothing to doIf MD5=false, do some alert thing Then I gave a bit more thought and this... We might be able to use a JAMF web hook for real time detection and alerting... So the question is... Has anyone else done something like this? Did you use JAMF? If so, how so? If not, what did you use? Does anyone even care about such things?

Hi,We use a shared login for our Mac lab. When students log into Google services and close the Chrome window (but they don't quit Chrome), I'm finding that when the next student opens Chrome, the prior student's Google account is still logged in. Is there a way to force the Google account to logout when the Chrome window is closed (by hitting the red circle)? I've been able to partially achieve this by checking the "Keep local data only until you quit your browser" setting in Chrome settings, but that only works if the student quits Chrome through the menu, not if they just click on the red circle to close the window.

I have managed iPads that I have purchased the eBooks for on Apple and created Managed Apple IDs for in Jamf Pro. The eBooks are set to be available in Self Service mand scoped to be All Mobile Devices. The eBooks appear on the iPads inside Self Service, but the "get" button is grayed out. Can someone help me understand what I'm missing? 

For anyone looking for the standalone Safari 15.3 installers for macOS Catalina or Big Sur:Catalina: http://swcdn.apple.com/content/downloads/26/22/002-55628-A_1VLDC3LHDM/pcelahb6q0fqenbfoax3wvkqk03arnx7hc/Safari15.3CatalinaAuto.pkgBig Sur: http://swcdn.apple.com/content/downloads/21/26/002-53731-A_F8CKRUB2J8/50r4rgi8k5monni8c00hvy6z7n89b5yig2/Safari15.3BigSurAuto.pkgApple's KB article on the Security fixes in Safari 15.3: https://support.apple.com/en-us/HT213058Apple has released new Builds of Safari 15.3 with a single change listed: https://support.apple.com/en-us/HT213091The new support article also lists the updated Build number for Safari 15.3 as 16612.4.9.1.8 on macOS Big Sur and 15612.4.9.1.8 on macOS Catalina.Download links for the new are:Catalina: http://swcdn.apple.com/content/downloads/37/36/002-66034-A_46UFJIIHKN/rm0oq26tnrdrhgeokn8vcfoydrt4zi19an/Safari15.3CatalinaAuto.pkgBig Sur: http://swcdn.apple.com/content/downloads/13/56/002-67278-

I'm trying to get an APN Cert downloaded as a .p12 file instead of a .pem file. I'm trying to use [OneSignal.com](link URL). Anyone have any ideas how to do this? I tried downloading it from here but all I get is a .pem which doesn't work for me. https://idmsa.apple.com/IDMSWebAuth/login?appIdKey=3fbfc9ad8dfedeb78be1d37f6458e72adc3160d1ad5b323a9e5c5eb2f8e7e3e2

I am trying to set up a pretty straightforward smart group to just collect a list of machines that are eligible for FileVault encryption but that are not enabled. I have the criteria set to check for  FileVault 2 Partition Encryption State is "Not Encrypted" (just to keep it simple and test), and the list is showing 80 computers, which I know for a fact most of them are already enrolled in FileVault and Encrypted. I went in to a bunch of them to check, and when I go the Computer > Disk Encryption the status shows "FileVault 2 Partition Encryption State: Encrypted". Anyone have any ideas as to why this is not working?

Hi all, I'm attempting to distribute free books via Jamf Pro to a set of 50 iPads at the school. I read that books are actually linked to users - not devices (very annoying) - so as a test I created a user (with the Role of Student) in Apple School Manager and synced & imported this into Jamf Pro so the user account now shows up in Jamf Pro as well. In Jamf Pro - I assigned this user account to one of the iPads being managed by Jamf Pro. For the eBook I then put the the user account in the "Scope" of the book.In the "General" tab I have made sure the book is Enabled, is set to Install Automatically/Prompt Users to Install (iOS only), and have selected Free (so no need for an VPP invitation). However - the book still does not appear in the Books app on the iPad. When I open the Books app under "Reading Now" it just says "Sorry ... Something went wrong. Please try again." with a Retry button that doesn't do anything when tapped. Under "Library" it says there are "No Books. To ad