I have a machine that keeps getting Device Signature Error if I try to run sudo Jamf policy or sudo Jamf recon.I can temporarily fix this error for a few days if I removeFramework and re-enroll the machine.  The the error will come backFri Jun 17 10:14:04 IN-XXX-180122 jamf[75414]: Error Domain=com.jamf.jamfsecurity.error Code=-25293 "unlockWithPassword:error: : The user name or passphrase you entered is not correct." UserInfo={NSLocalizedDescription=unlockWithPassword:error: : The user name or passphrase you entered is not correct.}Fri Jun 17 10:14:04 IN-XXXX-180122 jamf[75414]: There was an error.     Device Signature Error - A valid device signature is required to perform the action.The time is correct on the machine.  Anyone have any ideas on this?

When I run the command below. I think it should only update the exclusion list for the mobile devices. While it does update the exclusion list it also removes the scoped devices. I'm not sure why.  curl $jamfProURL/mobiledeviceconfigurationprofiles/id/32 -H "content-type: text/xml" -H "Authorization: Basic ${apiBasicPass}" -X PUT -d "<configuration_profile><scope><exclusions><mobile_devices><mobile_device><id>$id</id><name>$name</name><udid>$udid</udid><wifi_mac_address>$wifiMacAddress</wifi_mac_address></mobile_device></mobile_devices></exclusions></scope></configuration_profile>"  

Hello JAMF NationAs the subject states I have been tasked to migrate about 50ish or so macs from one domain to another and was wondering how others like myself have got this to work as effortlessly as possible. I have some concerns and was hoping to get some Ideas on how to go about it and getting it all done properly.Currently: Machines are domain bound and in their perspective security groups and OU's and managed with (NoMad) for password changes. The usernames (mobile) currently on the machines have file-vault enabled and are the only accounts to have a secure token. Question? How or would it be possible to migrate to a new domain with a new username as the usernames do not follow the same convention as the previous domain, that would in part need to have a secure token passed to it as well as maintaining the File Vault structure already escrowed to JAMF and making sure these users are added to their new OU's and Security groups from within that New domain. Would it be eas

Does anyone else deploy this out to their users?If so, could you tell me your method. Composer does the job, but it could be cleaner.

With the increasing trend to stop binding macs to AD, I put together a script to demote mobile accounts to local. To re-iterate - this one is risky. Please test it carefully if you decide to try it out. If you find additional attributes that your fleet needed - would be interested to hear. #!/usr/bin/perl -w # mobiletolocal.sh # Created by LD # Appears safe to run whilst logged in - user keeps existing password :) my $userlist = `dscl . list /Users`; chomp $userlist; my @excludedusers = split(" ","root daemon nobody _amavisd _appleevents _appowner _appserver _ard _assetcache _astris _atsserver _avbdeviced _calendar _ces _clamav _coreaudiod _coremediaiod _cvmsroot _cvs _cyrus _devdocs _devicemgr _displaypolicyd _distnote _dovecot _dovenull _dpaudio _eppc _ftp _gamecontrollerd _geod _iconservices _installassistant _installer _jabber _kadmin_admin _kadmin_changepw _krb_anonymous _krb_changepw _krb_kadmin _krb_kerberos _krb_krbtgt _krbfast _krbtgt _launchservicesd _lda _locationd

I was curious if anybody had additional information for a project I've been working on. I'm running into an issue where in some computer labs that see frequent use, there are often many users signed into a mac at the same time and the machine begins to slow down.What I was looking to do is setup a policy where users are automatically logged out after a certain amount of time of inactivity. I see that is a configuration profile option for this setting, however from my testing it seems that the inactivity timer is only active when somebody is not on the lock screen. Is there a way using the configuration policies to log out a user after a certain amount of time, even if they are at the lock screen?

Help! So we are in the middle of implementing Jamf Connect. We require online authentication and multifactor authentication with Azure AD.But what is the workflow when a user lost his password?Sure when the FileVault login window shows, we can enter the personal recovery key. Then the online authentication window will appear, and for this the user can login with the new Azure AD password.But then Jamf Connect want to have the previous local password to sync the online and local password. But we have only the personal recovery key at this point. We cannot continue from this point on.How to proceed from here? 

Hello Jamf Nation!Does Jamf foresee any time in the near future that this option (Enable Lost Mode as a Mass Action) will be available?

I have a user who reports he is unable to boot into the Utility menu by holding Command + R on bootup.  Is this a feature of Jamf?  I have always been able to re-format when enrolled on my test machine but thought I would double check to see if there is an exclusions list users need added to to enable them to factory reset their Macbook.  I searched around online and the forums here at JN prior to posting but didn't see anything related. Thanks! 

Is there any way to lock student iPads during after school hours from say 3:30p-7:00a using Jamf Pro? We want to prevent them from being used after school hours should students sneak them home without permission. I am even open to other alternatives that would essentially perform the same function.

Hi all! Just wanted to see if anyone else is running into issues patching Zoom with Patch Management on computers that have upgraded to Big Sur? I am getting a keychain prompt after the patch completes. I can run the same patch on a Catalina machine with no issue. I first noticed this on Zoom 5.5.2, but it has happened on every patch since. I just had the same thing happen with Zoom 5.5.5 today so it does not seem like the issue will resolve itself. These are all Intel machines. Thanks!

If you are adding apps to a Device Group using the Add + button, if you have an app like Pages that is available for both iOS and Mac, there is currently no way in Jamf School to distinguish between the app types, unless you understand the subtle design differences between the icons or have a difference in the number of licences.At the very least, a subtitle that says iOS/iPadPS or Mac would be helpful. 

Hello there,I am a newbee to Jamf pro.I have downloaded "office 365", used Jamf composer to package it. Uploaded it to the Jamf server and created 2 policies.1: Install Office 365 (Make the policy available in Self Service is NOT TICKED)2: Self service - Office 365 (Make the policy available in Self Service is TICKED) I was told by a Jamf engineer, we need to create separate policies due to priority issues. I currently dont have office 365 in my Mac (I deleted it) & the app is showing in self service for me to install.I installed it through self service & its working fine but the app disappeared from self service. Why is that? Any help is appreciated.Cheers,Anam 

Hi,I either went crazy or something has changed? A simple smart group to show FortiClient 6.x version shows 7.x version as well and I can't figure out why. It's not just 1 mac, but all of the ones which have FortiClient 7.x, no version 6 present are shown as well... Has anybody seen such behavior before? This is like 101 smart group and I have no idea why is it not working like that.That smart group shows my own work mac as well, I can certainly confirm, I do not have FortiClient version 6 installed

There is a Rocketman script for removing Nomad and it works, but it leaves Nomad Pro still on systems.  Is there a similar script that will remove nomad PRO?

I've been using a function for a while in my scripts that echo's the input to stdout for Jamf to pick up when writing to the server logs when a policy runs, but also to a local .log file. If it's not an intensive script, I'll just append it to the jamf.log file using something like the line below: echo $(fHeader) "$1" >> "/var/log/jamf.log" While writing a script, I didn't see the log file I was expecting, so I just threw the line in to see something since it's always worked in the past. However, it completely wiped my existing jamf.log file and only put lines from the script my policy ran. If I do a `sudo jamf recon`, I don't see anything in the jamf.log file even after deleting and recreating the file. What am I missing? Was there a recent permissions change that messed things up? I'm currently running Monterey 12.5.

@mlev MUT 6 has worked for me in the past.  Now I  am getting an error that is it not seeing the version number we are on. We are cloud and currently on 10.40.1-t16595817502022-08-19 02:02:01 [INFO ]: Beginning CSV Parse - Attributes update.2022-08-19 02:02:01 [INFO ]: Attempting to GET the Jamf Pro Version from the API.2022-08-19 02:02:02 [ERROR ]: Failed PATCH. 401.2022-08-19 02:02:02 [ERROR ]: {"httpStatus" : 401,"errors" : [ {"code" : "INVALID_TOKEN","description" : "Unauthorized","id" : "0","field" : null} ]}2022-08-19 02:02:02 [INFO ]: Jamf Pro Version:2022-08-19 02:02:02 [ERROR ]: Enforcing Mobile Device Names requires Jamf Pro 10.33 or higher. Please upgrade to the latest version of Jamf Pro in order to use this feature. I tried redownloading the templates but now every time I try to upload a test csv MUT quits. 2022-08-19 02:35:15 [INFO ]: A stored delimiter was found. Using the stored delimiter of , .2022-08-19 02:35:23 [INFO ]: A new token was s

New to Jamf Pro and Jamf Connect. Taking over a Jamf Pro setup that was started and not used for over a year. Found an app called Jamf Verify in the pre-stage enrollment. Is Jamf Verify still an active app or has it's functions been added to Jamf Connect? I cannot even find where to download Jamf Verify... 

Any news on passthrough authentication? It's not a showstopper for shared devices (our first use case), but it may well be for single users.  I've tried setting the keys in the mobileconfig file switching the OIDCPassword setting from true to false and vice versa, it looks like the following: <key>OIDCUsePassthroughAuth</key><true/><key>OIDCNewPassword</key><false/> It shows up in the mobileconfig profile. The logs show a message of "auth state did change state to unsupported " for the WebView call from the ROPG service, likely the cause of the failure. Any news on support for third parties?

Hi allWhen we build macOS devices we use DepNotify and Installomater to install around 10 standard applications including, Chrome, Office, iTerm, Docker and a few other things. We also allow a larger selection of applications to be installed using Installomater via Self ServiceIn order to manage updates we have a policy that checks a smart group for each application to see if it is on the latest version and if the smart group indicates the machine is behind, it calls installomater again to update the applicationThis is having limited success and I'm not sure why.Could anyone advise on whether there is a defacto standard way to update applications that would meet the following criteria:1. It should work for as many common applications as possible2. It should not require users to do anything:3. It should be able to guarantee that applications are updated within a handful of days of a security update being released4. There should be minimal involvement from IT in having to package, script

At our school we follow a "security through obscurity" policy regarding WiFi connections. I know, I know.The kids never see the actual password, it is just pushed using a profile in Jamf School. But in iPadOS 16 the user will be able to see all stored WiFi passwords.Does anybody know if Jamf will be able to block that feature?Thanks!

We are planning to deploy Microsoft Edge for mac soon in our org. One my main worries is having a way to ensure the app is always auto updated. What is the best way to go about enforcing this?

I need to copy files over to a folder that I created called /usr/local/etc.  To be more specific, it's 4 files that I created that contain Lightspeed certificate files (.pem files). What's the best and easiest way to go about copying these files over to 30 Macs using Jamf?  I am not sure how a script would work since these files are stored locally.Any advice or help is appreciated.Thanks,Robert

Hi Everyone, Tomorrow is our scheduled call with a JAMF Engineer to help setup JAMF connect for us. I was wondering if anyone has any advice or knowledge they want to share that I can ask the Engineer. I am getting a bit of the pre-Meeting jitters since I want to make sure everything goes well. We are an Azure shop with Federation Enabled and have started to implement FireVault since July (slow roll out). Just want to see any advice or questions you wished you have asked.  Thanks. 

HI Team,Not able to see the updated version to upload the package and push in patch management. For example abobe brackets  newer version 2.1.2 but able to see only 1.4.2. any suggestions how to get these updated. also not able to see chrome canary