Hello all, Our organization is preparing to migrate from NoMAD to Jamf Connect. During our preparation, we created two Okta security groups where assigned users will either be granted "Standard" or "Admin" permissons on their local Mac. Once a user is added to the administrative group, their local Mac account is granted administrative permissions to their local machine as expected. However, we realized this user could login to any other Mac and gain local administrative permissions on that machine. In essense, they would potentially have root access to all Macs using Jamf Connect. How have you all navigated this concern? Are you aware of any method to limit the scope of permissions to specific computers?

Hello all, quick post here hopefully someone has experienced something similar.I have Jamf connect Notify up and running, however there is a weird part about it kicking off when a user signs in.When a user signs in as soon as the Azure window pops up it passes on through straight to the desktop screen without touching the Notify Screen.However, if we wait a few minutes and sign in, then the notify screen pops up and runs as it should.Any ideas?Thanks,Adam

Hello Jamf Nation,   Today we are releasing Jamf Pro 10.40.1. To learn more about this release and the product issues it addresses, please read the Jamf Pro 10.40.1 release notes here.   Cloud Upgrade Schedule Your Jamf Pro server, including any free sandbox environments, will be updated to Jamf Pro 10.40.1 based on your hosted data region below.   Need assistance identifying the Hosted Data Region of your Jamf Cloud instance? Check out this guide to find out how.   Hosted Region Begins Ends ap-southeast-2 Aug 12 at 1400 UTC Aug 12 at 2300 UTC ap-northeast-1 Aug 12 at 1500 UTC Aug 13 at 0000 UTC eu-central-1 Aug 12 at 2200 UTC Aug 13 at 0800 UTC eu-west-2 Aug 12 at 2300 UTC Aug 13 at 0600 UTC us-east-1 sandbox/us-west-2-sandbox Aug 13 at 0000 UTC Aug 13 at 0900 UTC us-east-1 Aug 13 at 0400 UTC Aug 13 at 1700 UTC us-west-2 Aug 13 at 0700 UTC Aug 13 at 2000 UTC  

I am trying to update the mac mini fleet via remote (mac screen sharing app). After the monetary update, I can see the login screen, but I am not able to type the username or password but mouse is working OK only the keyboard input is having a problem. Remote management from MDM enabled. I also tried the kickstart command via a script; the same behavior for most of the mac minis.

Hello all,I pushed the latest chrome update via Jamf to all our macs. It force closes the app once the policy hits and then it doesn't allow you to open Chrome back up. Only a reboot resolves the issue. Any ideas on why this could be happening? Keep in mind we had no issue with the recent zero day vulnerability a couple of weeks ago.

Does anyone know how to unlock the ipad from Jamf I cancelled my service, some of them wiped fine but some only let me reset them i need to hard reset the ipad somehow, because its still locked up by jamf.

Who uses the Google admin console? Is it free to education (community College)? We have about 500 Mac devices (iOS and Mac OS). Contacting Google support about licensing has been useless. Googles website says it's free, but since we're a large government entity, licensing agreements change and I want to make sure we're not violating in laws.Right now I have a Google chrome plist config profile hitting Macs at enrollment. According to the logs, we have a 100% success rate for the config profile installation at enrollment, but only 55% are updating.I was curious if the Google admin console was a better option, and if anyone on here experienced issues using it?I've left test devices online for weeks connected via ethernet and Chrome will not update, even though I have automatic updates turned on in the config profile.Any tips, ideas?

Hi everyone, we are using a Login script to mount Windows Network sharesthis works fine if we run it by selfservice,[STEP 1 of 4]Executing Policy Domain Login[STEP 2 of 4]Running script DomainLoginScript...Script exit code: 0Script result:paedML Windows 4.2 Anmeldeskript macOS 12.x Monterey Angemeldeter Benutzer: xxx Meine AD-ID: uid=1668260950(xxx) gid=1023584668(xdom\\Domänen-Benutzer) groups=1023584668(xdom\\Domänen-Benutzer),12(everyone),62(netaccounts),394028230(xdom\\G_Projekte),720414751(xdom\\G_Lehrer_BKS),646384096(xdom\\G_Internet),778572741(xdom\\Office365_CreateGroups),1126509300(xdom\\G_Lehrer),701(com.apple.sharepoint.group.1),1585533833(xdom\\OCTO_user_internet) Gruppenzugehörigkeit: Lehrer Home-Pfad: mldata/Benutzer/Lehrer/BKS/xxx Tausch-Pfad: mldata/Tausch/BKS Mounte Laufwerke: - Home Mounting sp01.xdom.schule.paedml Mounted file server <mountpoint>/Volumes/xxx</mountpoint> - Tausch Mounting sp01.xdom.schule.paedml Mounted file server <mountpoint>/Vol

When testing the SSO connection to AD over our VPN, if I disconnect and then later reconnect to our VPN, the SSO extension can't find the network. If I run a kinit command in terminal, this seems to resolve it, but I can't have users constantly do this because we're all WFH.

Does anyone know a way to scope Mobile Device Apps to classes? I imported the classes through apple school manager and they have all the correct students. I just don't see a way to use it nor could I find it in the Jamf Pro documentation.

BeyondTrust is telling us that the only way the "support deployment is through ARD." We are not huge fans of ARD. Has anyone been able to deploy with Jamf and the provided DMG? If so do you mind sharing how.

Hi folks. I'm trying to remove a password from Keychains for an SSID. We use a limited SSID just for device onboarding and occaisional emergency use. We don't want users selecting, using and saving it or its password past the initial onboarding. Usually they don't but as a precaution so our Deskside Support team doesn't get calls about semi-functional wifi, I'd like a mainenance script to just delete it.Thanks to @mm2270  and their tips in 257493 and @bentoms for the-local-items-keychain-in-mavericks If I issue this (less anonymized) command:security find-generic-password -l my-SSID /Users/user.name/Library/Keychains/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/keychain-2.dbThat returns:security: SecKeychainSearchCopyNext: The specified item could not be found in the keychain.This is puzzling because if I look in Keychain Access, I see the password saved in the "Local Items" (as well as the "System") keychain. Why can't it be found by the command? I've checked my spelling e

We're trying to automatically create a local admin user and set a password that incorporates an extension attribute to the password so that passwords are never the same on the computers that we scope to. Is this functionality available in Jamf Pro? Or do we need to write our own script to change the password after the user creation policy is applied, which is less secure since part of the password will be in plain text on the script?

Hello everyone Is there a way to verify if a Login Certificate is installed on a workstation?  Also to list the login certificates as I don't know the cert name

there used to be a section where we can see uploaded scripts and use those scripts if we found any of them useful. I can't find this 'scripts' section, has it been removed?I downloaded the following script in the past and was wondering if it has been updated for macOS Monterey.  The script looks to be exiting at the if [ $maj -gt 11 ] then echo echo "Check OS string format & OS X systemsetup utility for script compatibility with OS X version $osx" echo exit fi   #!/bin/sh #################################################################################################### # # Copyright (c) 2021, JAMF Software, LLC. All rights reserved. # # Redistribution and use in source and binary forms, with or without # modification, are permitted provided that the following conditions are met: # * Redistributions of source code must retain the above copyright # notice, this list of conditions and the following disc

Hello,To provide some basic background, I am a former Windows desktop engineer that used Dell Kace to configure and deploy Windows images to a wide variety of desktops and laptops, so I do have familiarity with scripted software installations and deployments in so much as those would apply to understanding the overall concepts of how Jamf works to manage devices, but I am still new to Jamf. I have not yet performed any training and have relied on my rudimentary Google skills and some higher level support within my institution to get me where I am today.Here is my situation though that I don't yet know how to tackle. I have 18 iPads sitting on my desk that need to be used by students in a lab for teaching purposes and I've been asked to deploy VitalSource's BookShelf app to these iPads and then have two eBooks available in the app on all 18 devices. I also have been provided 36 VPP codes to cover this. However, I'm not sure where or how I'm supposed to be using these codes.I got confuse

Hi allI've searched high and low, but have been unable to find anything on this. We're looking to block the ability for devices to connect / mount shares using SMB / AFP.Has anyone done this, has a script or can point me in the right direction?Cheers!

Hello Jamf Nation!I'm needing help yet again. I have users that are requesting to have the ability to uninstall apps from their computers. What is happening is they are installing items from the Self Service portal and then deciding they don't want them. Most of these apps don't have an uninstaller that I can bundle to put in Self Service. Our users don't have admin rights because we don't want them to be able to just install whatever they want. Is there anyway that we can grant them access to just uninstall apps even just the ones installed from Self Service portal? Right now they are having to submit a helpdesk ticket and then we have to remote into the computer and remove the app with our admin login. this kinda defeats the purposes of having management software if we still have to do it manually.

Dear Experts, I 'bought' some licenses of a free app via VPP. I made sure the app is 'device-assignable'. I added the app to the Mobile Device Apps, I have set it to 'Install automatically'. But in the VPP pane it always tells me "Content not available to assign to mobile devices". I have made sure there is no user assignment for this app, 'Site' is set to 'None', so what else might make this content unavailable for device assignment? I also tried to assign it to a device in scope, but the result is that the user is asked to sign in to iTunes for the installation - this is exactly what I want to avoid. Any hints are welcome.

Hello, has anyone had any luck using the API call "logflush" to flush the error logs from a policy?

Hi,Just wondering how people have found the best way to get the Chrome Homepage through Casper. Our company is pretty new to Casper, we have only had it in for a few months. I'm pretty windows based myself.I did try using Composer, opening Chrome, setting the homepage etc. I found this worked however it override pretty much every personal setting the user had in Chrome so I wasnt really happy with that.How have people done here?Thanks in advance.

hi , So we started using Jamf connect and after MANY testes we see that if the user has a password with a space in it, the password sync failes it doesn't matter if the password starts with a space or the space is in the middle of the passwordthe password just wont syncwe thought at first that maybe the macos doesn't accept password with spaces but manually setting a password with space works

Our school purchased 40 new iPads for an elementary class. (Generation 9) I noticed that students have the option to delete the app. I have checked the config file and they should not be able to do this. I also went into a few apps and made sure they couldn't delete it there also. Is it a gen 9 iPad issue? I wouldn't think so but is anyone else seeing this? Not sure what I am doing wrong. Kirk

I am interested to find out what docking station is being used by our fleet.  We have 2 or 3 that we deploy and some users go out and get their own.  Is there some way for Jamf to detect which dock is connected?In Terminal, running system_profiler SPThunderboltDataType I can see the vendor and device name for my dock, but don't see how to script pulling that into an EA.  Plus, not so sure what brands we are looking for so can't just check that.This might branch out Into a few EAs like vendor/model and firmware version

This has worked before but first time running into this issue. Nudge is requiring device to updated to Monterey 12.5 and Current version is 12.4 (image below). The device itself on Software Update is saying 12.4 is the latest update, so clicking "Update Device" on Nudge doesn't do anything.I've checked if we have any Config Profiles for deferring updates and there is nothing scoped to any devices.