I have certain users who need to run a Java based application that is started from a JNLP file. The issue is that when they click on it, the built in malware scanner in MacOS Catalina blocks it. Normally they would go to System Preferences --> Security & Privacy --> General and then select to allow it to run. However, this is not available to them. Is there a way for me to set a preference or change a setting to allow this file to run, without me having to visit each machine and without the user having to do anything?

Greetings all, The advisory group for IT at our university (Notre Dame, northern Indiana, United States) suggested that we develop a "peer group" of other universities using Jamf Pro to manage their Mac fleets.  While I know that we can post conversations here, "ours is not to reason why"...  :-)   At any rate, if other higher education institutions would like to connect with us (and us with them) on a casual basis, please contact me (mild obfuscation here to hopefully avoid scraping, user bcarter at local domain nd top level domain edu).  We have just moved to the cloud product from on-prem and are particularly interested in talking to peer institutions about best practices and so forth.  Thank you for your consideration. Bruce Carter, Senior System Engineer, University of Notre Dame

Hello everyone,We've been experiencing this problem on rare occasion however it seems like its gotten progressively worse and figured I should ask for support as I cannot figure out for the life of me. I have an ongoing ticket with support but i figured why not ask the community as well.Workflow using ENTRAID:Mac boots up, user selects language, region, wifi, remote management screen appears, they sign in using their credentials, jamf connect window appears for them to reenter credentials again, account gets created and users now at the desktop.The problem occurs remote management screen>sign in using their credentials>black screen>reboots to the user language section>reboots>user language selection>repeatMy first thought is our jamf connect configuration even tho is placed inside of our prestage enrollments, and is scoped to all users and all computers will sometimes not be received by the macs. Now i only say that because if i remove the same configuration profile,

Good afternoon,I need to deploy Blender to a couple of computer labs.  Since its a drag and drop application, how do I prep this for deployment without a package?

Anybody know how to block a site like: https://sites.google.com/view/games-unblockedd/ without blocking other Google Sites? Kids are using these sites with embedded games but if I block any sites.google.com it blocks teacher created sites. Thanks!

Has anyone worked out how to actually use this new feature? I'm particularly interested to see whether this feature could pass the onpremisessamaccountname into jamf connect using a variable finally without having to add any optional claims. In short I want to pass the onpremisessamaccount name to jamf connect so that it creates a local account using the shortname that i also want to use for kerberos authentication (both of these desires at the moment require significant hoops to jump through).   I was expecting there would be additional fields available on the Entra Identity Provider Page in Jamf Pro  under 'mappings' however it still looks the same to me.   Second to that has anyone actually figured out how to actually pass these onPremisesExtensionAttributes into Jamf Pro yet? I'm so glad that Jamf Pro is providing some additional features that will help us blend on premises envirotnments more easily. Now I just need to figure out how to use them :)   Any h

Hey everyone Since a couple of Sequoia releases the version of Safari is not being updated on our Macbooks !  As example this morning I've updated my (enrolled) machine to Sequoia 18.4 but my Safari remains on version 18.2 (19620.1.16.111.6, 19620). Of 88 devices (all up to date with macOS -> 15.3.2) 77 devices only have Safari in version 18.2 ! softwareupdate -l doesn't show any available updates. Does anyone else have seen this behavior ?

My organization has opted to index the /Users/ directory for various reasons.  This hasn't been a big deal until I got a request to patch an application where the dev reused their app name and bundleID on the macOS and iOS versions.  As a result, searching for either the Application Name or BundleID catches machines with it in /Applications/ and machines that have a placeholder in ~/Library/Daemon Containers/<device info>/Data/Library/Caches/Placeholders-v2.noindex.  I'm kinda stumped on the best way to scope a smart group to include installs in /Applications/ or ~/Applications but exclude that placeholder directory.  Usually, the devs have slightly different bundle IDs we can use to make things more targeted. Does anyone here have any recommendations for the best way to scope a group so that it doesn't catch those placeholders locations?

Has anyone else had issues with a very slow to load dashboard with Jamf Pro 11, nothing I seem to do improves the load time as well as information that was present before, like build number etc... are all missing, which is fine, but it does make it give you less information and with slow load times it's just very cumbersome to use now.Any potential fixes for this, cleared cache, incognito, different browsers, no hardware acceleration, different OS, nothing seems to work on load times.

Any idea what this means? OSUpdateStatus - The software update request for this process was denied as another process is currently performing an operation. Please try again later.

Hello! At the school where I work we are planning to convert the mobile user accounts (connected to AD) to local user accounts, and make them admins.I saw the fantastic script on rtrouton's GitHub. I tested it on a test machine and works like a charm, though the issue I have is that it asks for user input, and trying to push it via policy in Jamf, it simply waits. So the question is: is there a way for me to achieve this via Jamf Pro, without the use of Jamf Connect (we currently don't have it)? Thank you

I swear I stumbled upon the ability to do this once but cannot for the life of me remember where or how I did it. So... can you re-order the search categories as seen in the screenshot below? For instance, is it possible to set it so that "Name" comes up first, then "Serial Number" then "Building" instead of how it shows up now (Name, Device Phone Number, Lost Mode Enabled)? It's nitpicky, but I was almost sure it could be done to re-order these categories. 

Doing testing in my office and pushing out several commands and profiles to a device. The device is connected to WIFI and has 5 bars signal strength. Everything works great until the screenlock kicks in, at which point, all progress comes to a complete halt. Any commands not executed going into pending with the status message "Device was busy. Will try again".Seriously, if a device has a good WIFI signal and connection, we should be able to send updates to it. This is clearly related to the screenlock kicking in. Question is, why? Is there some helper service that stops responding if the screenlock is on? Or does the WIFI stop transferring data if the screenlock is on?What if we tell our people to leave their devices plugged in over night to do a bunch of updates? Will they be pending all night long and then basically make the device useless in the morning when they unlock the screen and want to get to work? 

I created a script that prompts users to run the latest macOS update. The script works perfectly when run through a policy, so there are no issues with the overal functionality of the script. The policy is scoped only to Macs that are not yet running macOS 15.4. We have not decided to allow updates to 15.4.1 just yet. I noticed that the policy ran on a Mac running macOS 15.4. It's likely that this Mac had not yet ran a current inventory that would have put it in the macOS 15.4 smart group, which would have excluded it from running the policy. I decided to add a function to the script to check the current installed macOS and then compare it to the required macOS version. If the Mac is already running 15.4 or higher, I want the script to exit without doing anything. The idea is to run this function before doing anything else. If I fill in "15" for "reqosMajor" and "4" for "reqosMinor", this works perfectly. I put this function into a script by itself to test. Each time the function runs

This was specific to our environment but I could see other environments might run into this or something similar. Running nightly updates and reboots we ran into an issue with Intel devices that would would boot into recovery mode after updates. We did a bit of troubleshooting and realized it won't happen when you run command line softwareupdate --iaR. We couldn't have full OS updates run on these devices so we had to build a script to do that cleanly. Built a script out that looks for the macOS full installers then does a compare and skips any with the full OS update titles.    #!/bin/bash echo "Checking for updates..." # Get list of full macOS installers (e.g., macOS 14.x, Sonoma, etc.)full_os_install=$(softwareupdate --list-full-installers 2>/dev/null | awk -F': ' '/^ *Title: / {print $2}') # List available updatesavailable_updates=$(softwareupdate --list 2>&1) # Exit if no updatesif echo "$available_updates" | grep -q "No new software available."; thenecho "No u

Is anyone else experiencing multiple reauthorization prompts per day/week with Platform SSO? I have several users reporting this issue, and it's been ongoing for weeks without a clear cause.

Simply put we are looking for a way to disable the ability to save passwords in the major three browsers (Safari, Firefox, Chrome). Through all of our searching we're unable to find which preference files, or settings we can push out via Jamf to disable this. It seems the modern versions of the browsers make this complicated. Ideally if it was a package we could deploy via a policy that would be perfect, especially if the users themselves couldn't go and manually enabled this option later. Also if it was something we had to run say, once per day, we are probably open to doing that as well. Just seeing if anyone has any ideas or methods they are using.

Is anyone else experiencing an issue where Configuration Profiles are being removed? Every morning, these profiles disappear from over 30 devices, and I can’t work out why. I’ve raised it with Jamf Support, but thought I’d ask here in case anyone else has come across something similar. We’re running Jamf Pro Version 11.14.1, which we upgraded from 11.6 a couple of weeks ago. I’m not sure if the upgrade is the cause, as I didn’t notice this behaviour before the upgrade. I'm seeing this under Management History section.    

Despite documentation that seem to indicate that Bootstrap Tokens are automatically escrowed when using ADE, it still requires an admin to log in for the first time for this to happen. In order to force it, we are using scripts during Enrollment to create and activate a Secure Token for the Managed Local Admin account created during PreStage with a known password. Once it is created, the Bootstrap Token is escrowed by another script also during Enrollment. For both scripts, we pass the known password for the admin account as a parameter.   So we've now achieved our requirement to have computer labs' Bootstrap Tokens escrowed during Enrollment without an admin having to physically go to each lab PC and logging in.   However, we're concerned about the Managed Local Admin account having a fixed password. If we enable LAPS on the Managed Local Admin account, will there be any potential issues? The way we see it, the known password will just be used twice during Enrollment when th

  Hi everyone,Has anyone recently tried using the softwareupdate --fetch-full-installer --full-installer-version 15.4 command—either directly or through a Jamf policy? This applies to any version, not just 15.4. I tried running it earlier today and consistently got the error: “Install failed with error: Update not found.” I’m not sure if Apple has changed something behind the scenes, but it doesn’t seem to work anymore. I came across this recent discussion where someone else ran into the same issue:https://discussions.apple.com/thread/256042015?sortBy=rank

Hey Jamf Nation, I'm currently trying to uninstall Cortex XDR from company devices, but I'm encountering an error that says "Uninstaller not found." The uninstaller is located in the folder '/Library/Application Support/PaloAltoNetworks/Traps/bin/'. Do you have any recommendations or suggestions? Here is my script for the uninstallation: #!/bin/bash # Set your master key here MASTER_KEY="master-key-here"   # Path to the uninstaller app UNINSTALLER_APP="/Library/Application\\ Support/PaloAltoNetworks/Traps/bin"   # Check if the uninstaller exists if [ ! -d "$UNINSTALLER_APP" ]; then   echo "Uninstaller not found at $UNINSTALLER_APP"   exit 1 fi   # Launch the uninstaller and enter the tamper protection key osascript <<EOF tell application "$UNINSTALLER_APP" activate end tell   delay 2   tell application "System Events" tell process "Cortex XDR Uninstaller" repeat until exists window 1 delay 1 end repeat   set frontmost to true  

Despite documentation that seem to indicate that Bootstrap Tokens are automatically escrowed when using ADE, it still requires an admin to log in for the first time for this to happen. In order to force it, we are using scripts during Enrollment to create and activate a Secure Token for the Managed Local Admin account created during PreStage with a known password. Once it is created, the Bootstrap Token is escrowed by another script also during Enrollment. For both scripts, we pass the known password for the admin account as a parameter.   So we've now achieved our requirement to have computer labs' Bootstrap Tokens escrowed during Enrollment without an admin having to physically go to each lab PC and logging in.   However, we're concerned about the Managed Local Admin account having a fixed password. If we enable LAPS on the Managed Local Admin account, will there be any potential issues? The way we see it, the known password will just be used twice during Enrollment when th

Hello, How would I go about allowing Sidecar through the block all incoming connections toggle for MacOS's firewall? I've added the bundle ids com.apple.sidecar-relay and com.apple.sidecar-display-agent to the allow list. This did let Sidecar through but for some reason it's stopped working after a few days. No changes were made during this time.   Any help would be appreciated. Thanks!

I have a problem with deploying mac app store apps. I have setup 2 new macbook pros and both I cannot install apps from self service that are mac store apps. It fails and then opens the app store. I do not have this problem on a few macbooks that where setup a while ago. any ideas?

I have an issue in most of the mac, after enter the password it will stuck by showing loading like below image. This is happening for while restart and login or after un lock the device, to login need to do force restart the MacBooks. Does anyone faced this issue? Any solution for this?