So we use an app called Collage to mirror to our interactive flat panels. The app is from the company we purchased the panels from.  The app seems to install fine via self service and I have a configuration file to allow standard user to allow app for screensharing. The problem I am having is every time they launch the app they get hit with this dialog box that ask for admin pw. The admin pw is needed in order to send audio to the board wirelessly. If you hit cancel it will mirror the screen but it will not send audio unless you enter the admin password. Once the admin pw is entered the app works fine but how do I get the admin password sent with out the standard users seeing this box. Last resort is manually entering the admin pw on every teachers device. Staff is using 2020(intel) 13inch MBP and are on the latest Big Sur. Any advice? Already contacted the company but so far they have not had anyone deploy this app via Jamf I guess.

We are attempting to use VPP. we only have 3. 1 was added over a year ago and  is still working. Two were added just this week and those two are not working. When we click install a message in self service shows up saying Cannot each Jamf MDM Server. Then it opens the app store to the application page. The issue with this is that not all our mac users have an app store account. Which just makes things more complicated for me. 

Hello, First time posting here!  We are trying to roll out Jamf in an enterprise environment and I am seeing some PPPC configuration errors in the Management console for users.  When we initially configured this we only added Sophos strings to the "App Access" portion of PPPC.  Currently we have about 10 Sophos entries including the Identifier, Identifier type, and code requirement.  I have gone through to confirm there are no spaces at the beginning or end of any of the identifiers but my question is, should I have more entries than just Sophos?  The Jamf rep we had paid for some live sessions with sent me a screenshot of some terminal commands that had nothing to do with Sophos so I was wondering if it is typical to only have Sophos for example in these entries, or none at all?  And my main concern, will this cause any downstream issues post-go live.  Right now as it stands from the testing I have done, Sophos installs as expected so not sure w

Another thing I worked on today as a little personal project.Again, stolen adapted from Joe Farage's Firefox update script, this does the same thing but for the ESR (Extended Support Release) edition, as we're more of an ESR shop.Unfortunately, ESR is not handled by Patch Reporting, so requires manually managing version conditions (Smart Group) when updating existing installs. #!/bin/sh ##################################################################################################### # # ABOUT THIS PROGRAM # # NAME # FirefoxESRInstall.sh -- Installs or updates Firefox ESR # # SYNOPSIS # sudo FirefoxESRInstall.sh # #################################################################################################### # # HISTORY # # Version: 1.1 # # - v.1.0 Joe Farage, 18.03.2015 # - v.1.1 Deej, 10.11.2017: forked for Mozilla Firefox ESR # #################################################################################################### # Script to download and install Fire

So we received complaints that Wacom Drivers were out of date in a lab that we had upgraded and not re-imaged. Tried pushing out the vendor provided .pkg of version 6.3.31-5 using Casper Remote until I could build a proper policy. Failed on all the workstations, with this lovely output: A previous generation of the Wacom driver is currently installed on this system. To continue with installation, the outdated driver must be uninstalled. To uninstall, search for "Wacom Utility." Once in the utility, click "Remove" under the Tablet Software heading. Once uninstalled, close the Wacom utility and re-start driver installation. Anyone else have an update strategy for Wacom Drivers? This seems to be a new development. I guess I have to build an uninstall script that simulates their GUI utility. Talk about enterprise management hostility to not provide a package installer that doesn't automatically deal with pre-installed versions of their own software! It's been a while since I've see

Since we updated our Jamf Pro server to 10.37, any manually enrolled device is shown in Jamf as "unmanaged" . Appears that Jamf Binary is not downloaded to device --    /usr/local/jamf  is never createdThis happens on latest Macs with M1 and macOS Monterey, and older machines with an older macOS. Any one see this before?I see there were other posts about something similar where it was suggested that Rosetta needed to be installed - but in my case it is happening on machines with Intel Macs with macOS or earlierAny info appreciated 

We use DEPNotify as part of our deployment process so we can see which stage the process has got to.As part of this, we use defaults write to set up the .plist needed to allow DEPNotify to show a "registration" dialog that lets us specify the name and role (staff/student) of the Mac.On Monterey (12.2.1) on brand new Apple Silicon M1 iMacs, this seems to be failing for some reason.In the logs we can see:  2022-07-26 10:12:08.279056+0100 0x69fea Activity 0x5e290 10301 0 defaults: (CoreFoundation) Loading Preferences From System CFPrefsD 2022-07-26 10:12:08.297138+0100 0x69fff Activity 0x5e2c0 10311 0 defaults: (libsystem_info.dylib) Retrieve User by ID 2022-07-26 10:12:08.306905+0100 0x69fff Error 0x0 10311 0 defaults: (CoreFoundation) [com.apple.defaults:User Defaults] Couldn't write values for keys ( registrationMainTitle ) in CFPrefsPlistSource<0x600001394500> (Domain: menu.nomad.DEPNo

Just wanted to share something I got working today in my Friday afternoon Google Time.This is stolen "adapted" from Joe Farage's Reader updating script, but designed to update Acrobat Pro DC. #!/bin/sh ##################################################################################################### # # ABOUT THIS PROGRAM # # NAME # AdobeAcrobatUpdate.sh -- Installs or updates Adobe Acrobat Pro DC # # SYNOPSIS # sudo AdobeAcrobatUpdate.sh # #################################################################################################### # # HISTORY # # Version: 1.2 # # - v.1.0 Joe Farage, 23.01.2015 # - v.1.1 Joe Farage, 08.04.2015 : support for new Adobe Acrobat DC # - v.1.2 Deej, 10.11.2017: fork Reader script for Adobe Acrobat DC # #################################################################################################### # Script to download and install Adobe Acrobat Updates. # Only works on Intel systems. dmgfile="acrobat.dmg" logfile="/Library/Logs/Ad

My school has been using jamf School for around 1-2 years and in that time I was able to find some interesting bugs and exploits that can be used to for Example: delete browser history, change some settings bypass the search filter Etc.And this is why i wanted to ask if there is a way to report bugs and exploits directly to jamf.

So a webclip that deals with incident reporting was on our fleet of iPads, thank link to the clip malfunctioned, so I updated the link to the correct URL and pushed the clip again, now BOTH webclips (same icon) are on the iPads- one works, one doesn’t. Any fix to get the clip that doesn’t work off the iPads?

I have a self service package that installs vmware horizon client 4.9.0. The initial run of the application pops-up a prompt to enter and administrator password (you can cancel) for 'START REMOTE USB AND PRINTING SERVICES'. how can i get rid of this pop-up prompt, so users don't see it????

Trying to export the version of an install (security) application that does not use the standard .App format.When I run the command /usr/local/agent/agent --version 2>&1  | awk '/Agent/ {print $NF}' in Terminal, it outputs the correct information.When I try to use it in a variable AgentVer=( /usr/local/agent/agent --version 2>&1  | awk '/Agent/ {print $NF}' ) (for EA) I get error "-sh: syntax error near unexpected token `2'" so I know it has to do with the special characters but don't know how to allow them.

We'd like to prevent users connecting unsecured WiFi -networks, but as this doesn't seem to be a feature (we don't want to use a whitelist / blacklist), I'm trying to find out another way to warn users, if they're using unsecured WiFi at any time. Would anyone have any idea how to do the following? As macOS is able to tell user this information about being connected to unsecured network (when clicking on the WiFi top bar WiFi icon), I thought perhaps this information could be checked somehow via terminal.If it's somehow possible to check via terminal, I'd then like to send a notification to the user, stating that they're using unsecured network and they should activate our VPN (were not using macOS integrated VPN connection). Jamf is able to provide a simple notification pop-up window to the user via command: jamf displayMessage -message "Enter your message here"   What I'm thinking that might be possible:- Create New Policy triggering on Network State Cha

I could use a little helpI am trying to make EA to report back when a user has signed into Kerberos SSO.The way I am trying to go about is the read the SSO log file and scan for the word "Principal"If Principal is in the log then the user signed in.This is the EA I tried to make that is not working.Thanks for any help #!/bin/bashloggedInUser=$( /usr/bin/who | /usr/bin/awk '/console/{ print $1 }' )KSSOUSERID="$( /Users/$loggedInUser/Library/Logs/Kerberos_SSO.log | grep Principal | cut -d '=' -f2 | xargs)"if [[ "${KSSOUSERID}" == "" ]] ;then/bin/echo "<result>Not Signed-In</result>"else/bin/echo "<result>Sign-In Complete</result>"fiexit 0

I would like to supply IOS devices to schools and have them managed by JAMF Pro. They are specialty devices that would not make sense for it to be put under the schools MDM.I am not sure if I would lease or sell them to schools.I have seen other companies that have an iPad kiosk that they sell to libraries and mange them through a MDM. Is this something that would be allowed (legal?) . The devices are not being setup to be used at my company but rather for outside entities.Anyone know the answer or where I could get the answer?Thanks

Our network team requires that we push machine ethernet/wi-fi profiles for ISE compliance to our Macs. We use Centrify to join our Macs to AD and push certs. They're no longer able to push machine profiles after the release of Big Sur (Apple GP change). We've been trying to use Jamf and it's just not working. Jamf nor Centrify support have been able to help.We have a working config profile, but we get an error that the computer is not bound to AD if using Centrify. If I connect the Mac to our domain via Apple Directory Utility it works, but we lose out on other Centrify capabilities like password sync. We know Jamf Connect is an option, but I'd like to keep using Centrify for now.Has anyone run into this? Have you found a workaround/fix?Thanks

I have one computer in my environment I haven't been able to get to encrypt.We have a single Disk Encryption Configuration which runs at enrollment, and is also available in Self Service. This Mac was enrolled as a backfill and picked up the config there...and has also run it a couple of times from Self Service...and at every restart the user sees the required approve-or-shut-down sequence and approves it...and still fdesetup reports encryption OFF with deferred enablement ON for the user for whom it should be. And that user shows SecureToken ENABLED.All suggestions gratefully accepted.--Phil SaundersMyriad Genetics

Fairly new to Jamf Connect, but can someone explain in real life scenario's what the benefits are by using Passthrough Authentication with Jamf Connect?I'm reading the product documentation, but it won't land...

Hi All, Trying to get Kernel Extensions (Not System Extensions) working for Blackmagic Desktop Video v12.0 under Big Sur. I've contacted Blackmagic support who have stated that they are still using Kernel Extensions. So far in JAMF I can get non-Admin users to approve of the extension upon installation of Blackmagic Desktop Video but I can't get the prompt to silently go away. I have referred to the community list of Kernel Extensions supplied here:https://docs.google.com/spreadsheets/d/1IWrbE8xiau4rU2mtXYji9vSPWDqb56luh0OhD5XS0AM/edit?usp=sharing and output from: echo "Team ID,Bundle Identifier,KEXT Allowed,Developer Name,Flags"> ~/Desktop/kext.csv sudo sqlite3 /var/db/SystemPolicyConfiguration/KextPolicy "SELECT * FROM kext_policy;" | sed 's/|/,/g' >> ~/Desktop/kext.csv open ~/Desktop/kext.csv Is Team ID,Bundle Identifier,KEXT Allowed,Developer Name,Flags 9ZGFBWLSYP,com.blackmagic-design.driver.BlackmagicIO,1,Blackmagic Design Inc,1 9ZGFBWLSYP,com.blackmagic-des

I'm looking for a workaround to re-enroll a mac delete from Jamf for error.I'm testing this:1. sudo jamf removeframework - to remove binary and MDM profile2. sudo profiles renew -type enrollmentMac prompt me for Authetication but when I insert login and password it faill immediatly for 2FA.In Google Account I setted to use 2FA on my iPhone with YouTube App, and It works fine if a try to access to https://accounts.google.com but not during enrollment. It works only if I used Custom Enrollment during Zero touch Enrollment.Any ideas?

Hello Guys, I have been trying to disable the Ethernet / LAN connection to our end users and only enable WIFI but my script seems to be not working well. Do you mind sharing your scripts or changes from your end?Here's my script that i also found here. #!/bin/bashvalidConnections=("Ethernet" "Wi-Fi" "USB Ethernet""Broadcom NetXtreme Gigabit Ethernet Controller""Display Ethernet""Thunderbolt Bridge""Thunderbolt Ethernet")while read connection; doif [[ $(echo "${validConnections[@]}" | grep "$connection") ]]; thensetting=$(networksetup -getautoproxyurl "$connection" | awk '/Enabled/{print $NF}')if [[ "$setting" == "No" ]]; thenDisabled+=("$connection")elif [[ "$setting" == "Yes" ]]; thenEnabled+=("$connection")fifidone < <(networksetup -listallhardwareports | awk -F': ' '/Hardware Port:/{print $NF}')if [[ -z "${Disabled[@]}" ]]; thenecho "<result>Yes</result>"elseecho "<result>No</result>"fi

I need help with a few things.1. When ASM syncs in JAMF it will not bring in my classes from ASM.2. How do you keep the App Store on the iPad so teachers can use the share button teacher app workflow.  Objective is to have the Apple App Store availble without signing-in and all get buttons grey-outed. 

Hi All! I recently deployed an Admin account to each user under our JAMF instance using the "Local User Account" payload pointed to the /Users/ directory and while it seemed to have worked at first, as if they were dominoes, each and every computer fell one by one. What I mean by that is each laptop's current user lost permission access to their entire folder(s) structure. Files disappeared, in some cases finder couldn't open, apps wouldn't open and I had a lineup of 20+ employees at a time at my desk so I could run the following script which resolved all the mentioned issues: diskutil resetUserPermissions / id -u How have others deployed local admin accounts with passwords assigned to that account before? Anything that I did incorrectly that I can take note of for next time? I have already submitted a SR w/ JAMF marked High Priority but wanted to see if the community has seen this

We are looking to change our existing ADFS SSO Configuration to Azure AD SSOIs there anything not mentioned in the Microsoft and JAMF guides that could help prevent any issues once we make the change?I have found these guides from JAMF and Microsofthttps://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Single_Sign-On.htmlhttps://docs.microsoft.com/en-us/azure/active-directory/saas-apps/jamfprosamlconnector-tutorial#configure-sso-in-jamf-prohttps://docs.jamf.com/10.33.0/jamf-pro/administrator-guide/Azure_AD_Integration.html

I'm working through some remote support issues for macs, and stuck on this one. Mac is remote, and has to use a VPN to connect to the domain. Normally, after the machine joins the domain (no problem - I connect with the VPN and join) I log off as the local user then login as the domain user. Then I create a mobile account and all's well. However, because the connection to the VPN drops once the local user is logged out, you can not login as a domain user because it can't look it up on the domain. With Windows, we get around this issue by using "Change User" which doesn't actually log off the local user and doesn't break the VPN connection to the domain. I don't see how to accomplish this on a Mac, and because we support remote users with Macs, we need to be able to set them up on the domain. One thing I tried was to create a local account using the domain ID/password, then login with it, connect to the VPN/domain, then tick "mobile accoun