We are using PreStage Enrollment and want to skip setup and have the first login to be Autologin with the created user during PreStage Enrollment so the rest of the Jamf policies can finish before the first Network user logs in.Has anyone done this before and can help with what has worked and how to do it. any help would be appreciated.

Working on deploying and updating Jamf Connect in our environment.Found out in Jamf Pro I could deploy Jamf Connect and updates in the Jamf Application settings based off my configuration profile. I configured for "Automatically Deploy and Update Jamf Connect" set it to version 2.13.0, and update type set to Maintenance.It successfully deployed to a computer with an extremely old version however on the reset of the test devices that are running 2.1.3 up to 2.12.0 are listed as "Acknowledged" with no logs like I'd normally see. I can't find anything on what this Acknowledged status means.

Just throwing this out there, does anyone know of any projects or threads around how to automate the Chrome profile setup? There are so many screens and buttons for the users to click to sign in to their Chrome profile, it's one of the major hurdles of our new staff deployments -- every new hire needs a tech to walk them through it. (luckily we are K12 so mass-hires only happen once a year and we can usually handle them in a group Orientation). I'm not holding my breath, but if anyone knows of anything that could streamline this, I'd love to hear about it.

Has anybody installed Outlook Add-ins via JAMF?  I'm hoping for a path to install an Add-in via a preferences file. My O365 engineers are primarily looking at deploying via O365. I'm just hoping for a "plan B".

I'm trying to switch to using just a profile to manage FileVault instead of a policy.Currently we push out a profile that contains the following:If I turn on "Enable FileVault" what would that do to existing computers if I pushed the profile back out as they all have FileVault enabled.This is our current policyWe had both a config profile and policy because originally we had to move all our keys from Sophos to Jamf a couple of years ago and followed this guide homebysix/jss-filevault-reissue: A framework for re-escrowing missing or invalid FileVault keys with Jamf Pro. (github.com)Additionally the reason we want to do this is to Enable FV as early as possibly before we run our DEPNotify script so users don't need to logout at the end of our DEPNotify process.

HeyWe run Jamf fundamentals and I'd like to setup Jamf connect. I've looked at Okta as a IdP provider but also see Google provides the service. As we use Google Workspace for email, calendars etc.  Should we stick with Google for IdP?I'm looking for an easy to use / setup system. What IdP do you recommend for a business of 40 users?Easy setup, reliability and security is key a decider  on what IdP to go for.Any advice on this would be great. 

I’m preparing to register for my first ever JNUC conference and need to know what the refund policy is before I commit. September is still a long way out and lots can change between now and then. I have an email in to JAMF but figured I would ask here in case anyone had a clue. Related to that, wondering about sources for coupons. $1200 is a good chunk of change, especially when you add in airfare and hotel. Thanks!

Hi there, I would like to disable the use of multiple desktops on a fleet of Macbook Airs (Monterey 12.4 - M1 chip). Limiting access to Mission Control does not limit the multiple desktop/spaces function. I've looked around for scripts but haven't found any that will work and I am not that adept at writing what looks to be a more complicated one.  Thanks

Hi, as we are experiencing some issues with our Jamf Infrastructure Manager I thought maybe I should set it up from scratch again.My Idea was to set up a new one connect it to Jamf Pro. After successful registration in Jamf Pro, switch the used LDAP Proxy in the LDAP-settings. And after success remove the old.Does anyone know if Jamf Pro supports multiple JIMs? Has anybody done something similar? Kind regards, Matthias

Hi Jamf Nation,I am wondering what the best practice is for managing local admin accounts on corporate MacOS devices. We have over 500 Silicon Macs in our environment and currently configure a local admin via PreStage Enrollment as well as a policy to push our local admin account to a few non-Business Manager devices. We try to avoid typing this password in locally at all cost, but it happens from time to time. When we need to cycle the password, we do not have an easy way to do this today.I am skeptical this is the best way to manage local accounts and feel like there should be a solution like FileVault where each device has a unique local admin password that is escrowed in Jamf Pro. In doing some google searches, I found reference to something that may be similar for Windows called LAPS.What is everyone else doing to securely manage local admin accounts?

I've had 6 of my Mac users come to me this week with this issue.  The Chrome icon on the dock has a question mark.  Any idea what could be causing this? I had Chrome deploying via the new Mac Apps feature but have since turned it off to see if that could be the issue.  One of the users has had the issue since I turned off the deployment so that isn't the issue.  It's very frustrating

Hi Everyone - Need your help on urgent basis to resolve this issue. The laptop is brand new with M1 chip and having Monterey OS, while taking it out from the box after selecting region and language, JAMF connect page is coming and black page is reflecting. As a workaround we are resetting the MACs and issue is getting resolved.Need a permanent fix.

I apologise to my fellow Mac experts for stating what to them will be obvious but do so for the benefit of other readers.Mac apps (mostly) use XML format preference files signified by a file extension of .plistThese preference files can be in one of three locations.1. ~/Library/Preferences - that is in the Preferences folder in the Library folder in the users home directory2. /Library/Preferences3. /Library/Managed Preferences(I am deliberately ignoring the ByHost folders.)In theory it does not make any difference which location is used, it is also possible to have the same plist file in more than one location and have some keys in one copy and some keys in the other and the macOS will effectively merge the two although if a key is in both obviously only one version will have an effect.This works for me for the case of a preference file in ~/Library/Preferences and /Library/PreferencesHowever if I have the same preference file pushed out via - in my case Jamf Pro so that it ends up in

I have a prestage enrollment that auto skips all setup pages and creates a local admin account.I have a policy that runs after successful prestage enrollment that does two things: 1. Runs a script to set auto login for the account created during the prestage enrollment, and 2. reboots the machine immediately.The script successfully runs and the logs say the following:Blessing macOS System on /...Creating Reboot Script...But the system never reboots.If I manually sign in with the only user account on the Mac, the system reboots within seconds of hitting the desktop.If I manually reboot from the login window without logging in, the system logs in automatically (as it should), but then immediately reboots once it hits the desktop.Anyone else seeing this behavior? Should it be rebooting at the login window?

I have an Okta LDAP interface configured for LDAP queries; Active Directory is on the other end of Okta. I can query for users from Jamf via the LDAP connection but I can't find any groups that were created in Active Directory and then synced to Okta. I can find Okta groups just fine, though. I'm hoping it's an attribute issue of some kind.

Hi nation, one of my current projects is to try to hide the WiFi password from the user in any way.Our setup is: Deploystudio Image and DEP with PreStage Enrollments. The WiFi Setup with all SSIDs come from Casper - 3 different policies. Our students are local administrators on their own machines.This is why they also can access the keychain. 1st I thought its hidden and not written to the keychain when I use just the Wifi Profile, but unfortunate it will be written to the keychain first time the SSID gets connected.Is there a way to prevent the password to be written to the keychain? Or is there a way to make the entry unaccessable for the current logged in user but readable for the whatever process activates and connects to the Wifi?

Hi,Has anyone got a guide for automatically locking a Mac with a users AD account is disabled?There was some mention of it at the London Jamf event this year using webhooks and azure events.Thanks.

I just inherited a JSS one week after a 650 Macbook Air deploy. In this deploy, no machines have been bound or named, but asset tag info was recorded into the JSS (in the asset_tag field). Each of them has the name "Macbook Air" or "User's Macbook Air". What I need to do: Rename the devices (both in actuality and in the JSS) using data already stored in the asset_tag field of the JSS record for each machine. The names need to be changed to the asset tag with “-MAC” after it. An example is: If my asset tag is 12345, my computer name needs to be “12345-MAC”. I need to be able to run this script in a policy, once against each machine to change its name. Only after this is done can I move forward and begin to bind machines to active directory. Any assistance would be great, and thanks in advance!

I'm testing a Jamf connect login profile. When I log into a Mac using my credentials I'm always required to "Allow" the app to connect to my Google Account. Is there a way to reduce the amount of times the consent window pop up? It currently pops up every time after a successful login. Any helps appreciated! Thanks!

When auto-launching Self Service post-enrollment isn’t enough, continually prompt your users to actually setup their new MacsBackgroundWhile we thought we’d done everything to help ensure our users had a seamless experience in setting up their new Macs, we recently realized we should prompt those users with computers which have successfully enrolled, but still have yet to run our Setup Your Mac post-enrollment policies.Continue reading …

I'm using this script to auto set search domains at login. It works great but the user has to enter their password twice. Is there anyway to bypass? Thanks! #!/bin/sh SearchDomains="" # Install DNS servers and DNS search domains /usr/sbin/networksetup -setsearchdomains "Wi-Fi" $SearchDomains /usr/sbin/networksetup -setsearchdomains "Thunderbolt Ethernet" $SearchDomains /usr/sbin/networksetup -setsearchdomains "Thunderbolt Ethernet 2" $SearchDomains /usr/sbin/networksetup -setsearchdomains "Ethernet" $SearchDomains /usr/sbin/networksetup -setsearchdomains "USB Ethernet" $SearchDomains # Remove setup LaunchDaemon item srm /Library/LaunchDaemons/com.company.networksetup.plist # Make script self-destruct srm $0

So I am trying to install GarageBand iOS on an Apple Silicon device. But I get this error."Media lookup returned no results for this platform" I used this guide.https://grahamrpugh.com/2021/08/24/jamf-ios-apps-on-macos.htmlIs there a better way?Thanks

Good morning,is there by chance a good source to check out a step by step update from Jamf Connect 2.6.0 to 2.13.0 ? I am a little bit lost on which steps to start with first. Do I need to create a test Configuration Profile and deploy it only on one machine etc...Thank you.Best RegardsRen

We'll soon be deploying Jamf Protect to our endpoints and are using the built-in integration between Jamf Protect and Jamf Pro to do the initial PKG and config profile installs. In our environment, most users are admins on their machines and one thing we discovered during testing was that someone could easily throw away the Jamf Protect app and be unprotected. To remedy this, we've created an EA that tracks the installed version of the Jamf Protect binary (or returns "Protect binary not found") and populates a smart group if the binary isn't present. A policy then re-installs Jamf Protect on any computer in that smart group.The one downside we've noted to this approach is that the EA only gets updated once daily on inventory collection, so it's possible for a computer to go up to 24 hours without Jamf Protect. Any ideas on how to accelerate the re-install in this situation? 

Folks,This is a question we have asked much previously but want to refresh this.We are having challenges on our network for authenticating MAC books using the JAMF and Cisco ISE integration.We see Cisco ISE provides various attributes like "MDM Manufacturer", MDM SerialNumber", "MDM DeviceRegisterStatus" etc. but none of these are working. We are trying to figure out what best will work in this case.  With reference to the same checking for guidance from the community.  Thanks!!