Hey there Jamf people! I am currently hitting a wall during Okta Device Trust Enrollment. ERROR: Command '['launchctl', 'asuser', '502', 'sudo', '-u', 'jcombs', 'security', 'default-keychain']' returned non-zero exit status 1. ERROR: Error in accessing default keychainDuring my testing, I had it set to a custom trigger so I could invoke the policies I need whenever, and that all worked great. I would get the certificates downloaded just fine. However, since replacing the policy with run on either enrollment complete or recurring check-in, I get the above error "Error in accessing default keychain."If I switch it back to a custom trigger to test again though, it works flawlessly and enrolls/downloads the certificate no problem. I am using the scripts and guide from Okta, and can't find anything like this in their troubleshooting section and tried searching here on Jamf if anyone else ran into this, but can't seem to find anything that is similar. Does anyone by chan

Hey All, We have pretty successfully deployed the Okta Device trust with little to no hiccups. As with all technology, there are bound to be some failures, and I have a specific one that I haven't been able to diagnose. I had deployed the script to a new endpoint, and it worked fine and the Device Trust worked as expected with Okta. The user then changed their password, which messed up the keychain info and things like that. After doing that, I was able to run the device trust script on the device passing the uninstall argument on the endpoint, which ran successfully. Upon trying to deploy the enrollment script to the endpoint again I receive an error ERROR: Failed to configure Device Trust : list index out of range (full script output to be posted below). The user does not have an Okta keychain on their device, nor a device_trust password on their login keychain. Has anyone else had this issue? Script result: Keychain "/Users/kielsaunders/Library/Keychains/login.k

I'm getting this message on 10.14 Macs even though the Privacy Preferences Policy Control profile is installed. Anyone got any ideas as to why it keeps popping up despite the Privacy Policy profile is installed? I also have the JamfAppleEvents.mobileconfig profile installed, and still see the popup.

Hello Does anyone had any issue with Cisco AnyConnect 4.8 deployment on Catalina?So far I had no problem deploying this policy or previous versions on Mojave and below. Manual installation works well.I collected log files from installation process.Appreciate any suggestion.

Whether on-demand or automatic install, I receive a Failed status with the detail Duplicate Request when trying to install Apple Classroom. Despite the failed status, a functioning version of the application is installed. If on-demand, My Resources in Jamf Teacher shows the Duplicate Request error along with the Get greyed out. This happens on both M1 and Intel, Big Sur and Monterey, mixed and matched. This isn't a big issue, since it does install Apple Classroom, but I can see this confusing the staff and making it annoying to manage despite it bing a first-party application. Has anyone else encountered this and/or know of a solution?

I've been waiting for the Jamf App Installers feature for awhile now. I think it's great! Some issues though I've run into that should be addressed in the future:-Google Chrome crashes if the app installer pushes the update in the background. A user will click new tab and it will say "crashed". This needs to be more graceful. Either prompt a message to close the app in notifications, or allow deferral control... something like how Installomator does it.-Allow the same scoping that policies and config profiles use. It would allow more than one smart group to be targeted.-Logs section for the installer-Allow triggering events, especially useful during DEPNotify. I currently use Installomator, but App Installers could replace the need to do that if it was able to be triggered by event for the first install.-Allow for Gradual Rollout. Create the ability to gradually roll this out in automated rings over a set time period (3 days-1 week?). This way a bad update won't hose thousands of syste

I am wondering if anyone has a timed script that JAMF can run through the policies, which will execute the Adobe Remote Update Manager to update the Creative Cloud applications?

Hi,when I assign a profile to our Macs with system preferences items disabled, it installs the profile and reloads the dock but doesn't actually disable the selected items.Is this a known issue or am I doing something wrong? 

Hi everyone,We've been experiencing issues with consistency of deployments of Mac App Store apps to our users' laptops. Our users are standard/non-admin users, and in addition to that, we are restricting the usage of the App Store. What can we do to achieve reliable deployment of these apps?Thanks!

Hi everyone!We are trying to find a way to use WhatsApp Business in a GDPR compliant way. The easiest way seems to be Apple's/Jamf's contacts restriction between managed/unmanaged apps. But there is an annoying side effect: apps like Photos or Files are considered as unmanaged, which makes is impossible to share photos or documents with managed apps like Mail.Is there a way to convert these apps into managed apps or another way of achieving GDPR compliance without limiting features/the user experience?Thanks in advance!

Hi All,I would like to check when onboarding the iPad into JAMF. Few of my devices will not show any application installed and I got to send a blank push for the application to be installed.May I know what is the root cause that some of my iPad/iPhone not able to install the application until I send a blank push?

Hi there,Some Adobe Lightroom users are seeing the permissions error below when launching the application on Monterey. Adobe provided fixes here. A script sets the permissions correctly.If we follow the instructions by downloading the shell script, dragging it into the Terminal window, and executing it under the current user with the issue, the problem is resolved.If the same script is uploaded to Jamf and run, the script tries to correct the root user and not the user logged in. The policy errors out with return code 1.Here are the script and the log results.LightroomCorrectPermission.sh#!/bin/bash# reclaim Inactive memory due to memory leaks by Jenkinsecho === `date`id=`id -u -nr`home=/Users/$iddeclare -a arr=( "Documents/Adobe/" "Library/Preferences/Adobe/" "Library/Caches/Adobe/" "Library/Application Support/Adobe/" )for i in "${arr[@]}"doecho "----------------------------------"echo "Process folder: $home/$i"echo "Restore owner: sudo chown -R $id $home/$i"sudo chown -R $id "$home/

Hi all, Lots of threads out there but have not found a definitive answer. I am using Graham Pugh's erase install script. It is working flawlessly on both architectures. My question(s) are:Has anyone gotten around the need to be logged into a Mac to enter credentials for a secure token user?If the answer is yes, how?Is there a way to hard code credentials (bad but effective) in the script? Or, is there a way to be able to enter them into Parameter fields in Jamf (better)?I manage a computer lab and logging into 700 end points to enter these credentials is going to bring sadness.TIA,/randy

Hey Everyone, I'm trying to find a solution that will allow the WiFi credentials to be forgotten the second that the user logs off of the account. We have multiple people using these laptops and each of them have their own WiFi login and we don't want one user to be using another users WiFi login. I looked around the Jamf Pro configuration profiles and couldn't find anything so I just assumed it was going to be a lot more complicated than that. I thought about deleting the certificate that our WiFi downloads when you log on so you would be forced to log back in but never really saw that through so now I'm taking any ideas. Thanks

We use Sophos as our Endpoint Protection Solution and from what we've gathered, third-party solutions alongside built-in OS protection can interfere with each other on a lower level. Sophos recommends disabling other solutions: Information on installing Sophos products alongside a competitor's software Deferring updates to our devices so that they do not upgrade to macOS Monterey is one thing but that can't be the solution for the long term. And we continue to use Sophos due to our environment having been setup already with a purchased license, Windows management, and familiarity with the service.So what would be the best move here?

We have an iPad that was brand new at the beginning of March 2022.  It was setup and Jamf Pro was showing that everything looked good, however it hasn't checked in since that initial setup and we can't figure out how to get it to communicate with Jamf.  We want to do a reset on the device and start over, but one of the restrictions we placed on the device through the configuration profile that loaded when it was initially setup was to restrict the user from doing a reset themselves.  Since the device isn't communicating with Jamf we can't issue the wipe device command from there either.  Is there anything we can try to get the device to start communicating with Jamf again?  Or anything we can do to get the device reset?  This device is in our ABM account (if that will help).

Hello,I'm looking for suggestions on stopping Mac OS  software updates?  We try to maintain control of what updates go out when because of our classes and such, and was looking for thoughts on ways to achieve this.  It drives me crazy when an issue comes up and I look at a lab and there are 2 or 3 different OS versions on different computers.Thanks for your suggestions!

We have a MBP M1 Max running Monterey 12.4 that checks in to our cloud fine, but it won't apply policies, profiles, or App Store apps. The profiles and policies are listed as pending in Management Commands, and the computer is checking in just fine (it checked in 6 minutes ago). I've tried "sudo jamf recon" and "sudo jamf policy" in the Terminal, but no joy. sudo jamf policy reports: "No policies were found for the "recurring check-in" trigger." even though the assigned policies are there, and they run without incident on other computers, so I know it's not a misconfiguration with the policy. Scoping has also been triple checked, and like I said everything is listed as pending.My usual fix would be to remove the framework and reinstall via QuickAdd, but from what I've read that's no longer an option. I'm stumped as to how to get this laptop working again, other than a wipe and re-enrollment in the MDM. 

Does anybody know how to surpress/bypass this notification after the installation finished? It's only occurs with Catalina built.

Hi :) there is the possibility to start or open the installed Self Service apps directly from the self service app Thank you 

Currently my organization is using Bootcamp in order to run specific Windows apps instead of Parallels. Is there a way to bypass the firmware prompt when switching from the Mac to the Windows OS without actually disabling the firmware itself via JAMF? Thank you

I've noticed that if I remove an app from a device it ends up in the user installed app section. How do I stop this from happening and how do I remove the apps? Any clarification on user installed apps would be great!

How capable is the MacOS management in Jamf School? I know it's not as powerful as Jamf Pro but I don't need much outside the basics. Pushing apps and OS updates, easy setup, security requirements, and ideally remote access for troubleshooting.How does that ability compare to MacOS management on Mosyle? I've read a couple posts from this sub from 2 years ago that said Jamf School was really lacking compared to Mosyle when it came to Mac management but they didn't say what the differences were. I also wonder if that's changed in the 2 years since.Any other advice or recommendations that you have for someone just starting out in this field and looking to improve the device inventory, security, and help-desk at a smaller school like this.

Good Morning, We have been using this script for quite sometime now without issue and it has been working for our intended purpose. However, we have a few machines now on BigSur that are not completing and are setting the name to the devices serial number rather than what is in Barcode 1 The script we are using is here #!/bin/bash SERIAL_NUMBER=$(system_profiler SPHardwareDataType | awk '/Serial/ {print $4}') JSS=https://tasis.tramscloud.co.uk API_USER="$4" API_PASS="$5" BARCODE_1_INFO=$(curl -k $JSS/JSSResource/computers/serialnumber/"$SERIAL_NUMBER" --user "$API_USER:$API_PASS" | xpath /computer/general/barcode_1 | awk '{gsub(/<[^>]*>/,"")};1') SUFFIX="" if [ -n "$BARCODE_1_INFO" ]; then echo "Processing new name for this client..." echo "Changing name..." jamf -setComputerName -name "$BARCODE_1_INFO""$SUFFIX"" echo "Name change complete "$BARCODE_1_INFO""$SUFFIX"" else echo "Bar code information was unavailable. Using Serial Number instead." echo "Changin

I've got a user who's JamfConnect has been stuck at "-51" for her password expiration.  She's changed her password twice over the course of a couple weeks and rebooted several times, but it never changes from "-51" Her password is valid and works in all company systems. Our password policy has passwords expiring after 90 days. Is there any known method of fixing this one? The Mac is running Monterey 12.3.1 and JamfConnect 2.12.0