I'm looking to configure Microsoft SCEP with our JSS environment. We are going to make our SCEP server externally available and would like to know if you have anyone has suggestions for securing the connection. To date, we've researched the following options:1. IP tunnel from our SCEP server to JAMF2. Proxy through our Web Application Proxy ADFS Proxy servers)3. Proxy through Azure AD Application Proxy Does anyone have experience with this or a recommendation on the best method?

I have been tasked with migrating computers off our onPrem JAMF Pro install to a cloud pro install.We had about 75 machines of varied OS versions (10.12.x up to 10.15.x) I have completed pretty much all of them. There were about 6 machines that i was unable to "enable remote desktop" that appeared linked to the OS version (sierra).I proceeded to push the migration script out to the sierra group (ReEnroller package) and they migrated and were checking in to cloud jamf. Part of the process is approving the new MDM profile which we were using remote desktop to click this. So, these 6 needed on site access to complete the task.When we went to the device, we noted the profiles system preference was absent/didn't have any profiles present. We then proceeded to reboot the device which then resulted in the lovely flashing question mark.I am at a loss as to what has happened here, why is the

We recently started deleting out old unused Sites in our Jamf instance as part of a routine cleanup. One of these sites happened to have set up some Managed Preference files back in the 10.9 days and deployed them to All Computers in the site. Once that site was deleted, the Managed Preferences Jamf stopped displaying 40 releases ago got dropped into the top level and kept its scope of "All Computers".We've unscoped the Managed Preferences using the API, but it looks like they're still applying to end user's machines. Does anyone have a good method for forcibly removing Managed Preferences from machines without affecting Configuration Profiles? The best thing I can come up with is runningrm -rf /Library/Managed Preferencesdscl . -delete /Computers/localhostdscl . -delete /Users/<<USERNAME HERE>> dsAttrTypeStandard:MCXSettingsand rebooting. This seems to work, but I'm not sure if this is the ideal way to handle this. 

Hello everyone,We're trying to end the installations of a Jamf Pro server in Ubuntu, we're following the manual install guide, https://docs.jamf.com/10.40.0/jamf-pro/install-guide-linux/Manually_Installing_Jamf_Pro_Ubuntu.html,when arriving to this step Creating the Jamf Pro Database Using the Jamf Pro Server Tools Command-Line InterfaceStep 5: Restarting the ServicesWhen trying to restart, appears this error, and we don't know how to fix it. any help is welcome, Thank you 

hey folks! this works! (you can make it burn any text you want of course -- just change the source of the $TEXT variable)#!/bin/bash## A script to burn Mac computer name into desktop background## requires Imagemagick and Ghostscript which you can install with homebrew## ljaeger 2022-07-28 BKGD="/path/to/current/desktop/picture.png" ## if only there was a way to get this programmatically! There isn't, I looked.ORIG="$BKGD"_original.png ;## get the ComputerNameTEXT=$(/usr/sbin/scutil --get ComputerName) ;# make a backup of original desktop pic if n

Hello everyone, hope you’re well... I’ve almost finished the CIS Benchmark compliance but there is a little recalcitrant (CIS 5.9) that resets every time you change the value: sudo pmset -g | grep -e standby do you know if there is something to change in the Jamf or Mac configuration to maintain the values you want?

Every organization has different security requirements and depending on those requirements, you may find certain methods work better or worse than others. One of the things I've been tasked with is enforcing strong passwords on our macOS endpoints. I am currently required to adhere to CIS benchmarks as well as FedRAMP guidelines. The out of the box Jamf Pro MobileConfig does almost everything I need it to do - sans the ability to use mixed case (ie upper and lower case) values (unless I want to hack away on some plist files - which I don't want to do). The Jamf CIS scripts as hosted at https://github.com/jamf don't address the password enforcement - because Jamf Pro does the basics (CIS Layer 1) natively per the MobileConfig method previously mentioned. But what if you need something a bit more robust than just the basics? Something that uses Level 1, possibly Level 2, both s

Hello Mac-Admins :) I would like to install the Logitech Options software via Self Service. But what Logitech offers us is a disaster. :/ Does anyone of you use the software? How did you provide them? The software packed via the composer and installed via Self Service policy does not work. Logitech Options does not want to start.

Hi everyone, I figured out how to get EAP-TLS wireless authentication working for iPads using publicly signed certificates with the Client Authentication OID. Here’s the basic rundown: Import InCommon CAs into the NTAuth certstore of the radius servers https://support.microsoft.com/en-us/help/295663/how-to-import-third-party-certification-authority-ca-certificates-into certutil -enterprise -addstore NTAuth ./{Filename} This allows the radius server to check the validity of the certificate used for authentication, and trust them. Create Radius Connection Request Policy - Made a copy of the ‘Use Windows authentication for all users’ Added a User Name condition so it would only apply for my specific connection (the CN of the cert) Rem

Migrating from SimpleMDM.  This was easy to setup with a config profile. <key>LoginwindowText</key><string>Serial Number {{serial_number}} - Device Name {{device_name}}</string>Is there an equivalent in JAMF config profiles ?

We are using PreStage Enrollment and want to skip setup and have the first login to be Autologin with the created user during PreStage Enrollment so the rest of the Jamf policies can finish before the first Network user logs in.Has anyone done this before and can help with what has worked and how to do it. any help would be appreciated.

Working on deploying and updating Jamf Connect in our environment.Found out in Jamf Pro I could deploy Jamf Connect and updates in the Jamf Application settings based off my configuration profile. I configured for "Automatically Deploy and Update Jamf Connect" set it to version 2.13.0, and update type set to Maintenance.It successfully deployed to a computer with an extremely old version however on the reset of the test devices that are running 2.1.3 up to 2.12.0 are listed as "Acknowledged" with no logs like I'd normally see. I can't find anything on what this Acknowledged status means.

Just throwing this out there, does anyone know of any projects or threads around how to automate the Chrome profile setup? There are so many screens and buttons for the users to click to sign in to their Chrome profile, it's one of the major hurdles of our new staff deployments -- every new hire needs a tech to walk them through it. (luckily we are K12 so mass-hires only happen once a year and we can usually handle them in a group Orientation). I'm not holding my breath, but if anyone knows of anything that could streamline this, I'd love to hear about it.

Has anybody installed Outlook Add-ins via JAMF?  I'm hoping for a path to install an Add-in via a preferences file. My O365 engineers are primarily looking at deploying via O365. I'm just hoping for a "plan B".

I'm trying to switch to using just a profile to manage FileVault instead of a policy.Currently we push out a profile that contains the following:If I turn on "Enable FileVault" what would that do to existing computers if I pushed the profile back out as they all have FileVault enabled.This is our current policyWe had both a config profile and policy because originally we had to move all our keys from Sophos to Jamf a couple of years ago and followed this guide homebysix/jss-filevault-reissue: A framework for re-escrowing missing or invalid F

HeyWe run Jamf fundamentals and I'd like to setup Jamf connect. I've looked at Okta as a IdP provider but also see Google provides the service. As we use Google Workspace for email, calendars etc.  Should we stick with Google for IdP?I'm looking for an easy to use / setup system. What IdP do you recommend for a business of 40 users?Easy setup, reliability and security is key a decider  on what IdP to go for.Any advice on this would be great. 

I’m preparing to register for my first ever JNUC conference and need to know what the refund policy is before I commit. September is still a long way out and lots can change between now and then. I have an email in to JAMF but figured I would ask here in case anyone had a clue. Related to that, wondering about sources for coupons. $1200 is a good chunk of change, especially when you add in airfare and hotel. Thanks!

Hi there, I would like to disable the use of multiple desktops on a fleet of Macbook Airs (Monterey 12.4 - M1 chip). Limiting access to Mission Control does not limit the multiple desktop/spaces function. I've looked around for scripts but haven't found any that will work and I am not that adept at writing what looks to be a more complicated one.  Thanks

Hi, as we are experiencing some issues with our Jamf Infrastructure Manager I thought maybe I should set it up from scratch again.My Idea was to set up a new one connect it to Jamf Pro. After successful registration in Jamf Pro, switch the used LDAP Proxy in the LDAP-settings. And after success remove the old.Does anyone know if Jamf Pro supports multiple JIMs? Has anybody done something similar? Kind regards, Matthias

Hi Jamf Nation,I am wondering what the best practice is for managing local admin accounts on corporate MacOS devices. We have over 500 Silicon Macs in our environment and currently configure a local admin via PreStage Enrollment as well as a policy to push our local admin account to a few non-Business Manager devices. We try to avoid typing this password in locally at all cost, but it happens from time to time. When we need to cycle the password, we do not have an easy way to do this today.I am skeptical this is the best way to manage local accounts and feel like there should be a solution like FileVault where each device has a unique local admin password that is escrowed in Jamf Pro. In doing some google searches, I found reference to something that may be similar for Windows called LAPS.What is everyone else doing to securely manage local admin accounts?

I've had 6 of my Mac users come to me this week with this issue.  The Chrome icon on the dock has a question mark.  Any idea what could be causing this? I had Chrome deploying via the new Mac Apps feature but have since turned it off to see if that could be the issue.  One of the users has had the issue since I turned off the deployment so that isn't the issue.  It's very frustrating

Hi Everyone - Need your help on urgent basis to resolve this issue. The laptop is brand new with M1 chip and having Monterey OS, while taking it out from the box after selecting region and language, JAMF connect page is coming and black page is reflecting. As a workaround we are resetting the MACs and issue is getting resolved.Need a permanent fix.

I apologise to my fellow Mac experts for stating what to them will be obvious but do so for the benefit of other readers.Mac apps (mostly) use XML format preference files signified by a file extension of .plistThese preference files can be in one of three locations.1. ~/Library/Preferences - that is in the Preferences folder in the Library folder in the users home directory2. /Library/Preferences3. /Library/Managed Preferences(I am deliberately ignoring the ByHost folders.)In theory it does not make any difference which location is used, it is also possible to have the same plist file in more than one location and have some keys in one copy and some keys in the other and the macOS will effectively merge the two although if a key is in both obviously only one version will have an effect.This works for me for the case of a preference file in ~/Library/Preferences and /Library/PreferencesHowever if I have the same preference

I have a prestage enrollment that auto skips all setup pages and creates a local admin account.I have a policy that runs after successful prestage enrollment that does two things: 1. Runs a script to set auto login for the account created during the prestage enrollment, and 2. reboots the machine immediately.The script successfully runs and the logs say the following:Blessing macOS System on /...Creating Reboot Script...But the system never reboots.If I manually sign in with the only user account on the Mac, the system reboots within seconds of hitting the desktop.If I manually reboot from the login window without logging in, the system logs in automatically (as it should), but then immediately reboots once it hits the desktop.Anyone else seeing this behavior? Should it be rebooting at the login window?

I have an Okta LDAP interface configured for LDAP queries; Active Directory is on the other end of Okta. I can query for users from Jamf via the LDAP connection but I can't find any groups that were created in Active Directory and then synced to Okta. I can find Okta groups just fine, though. I'm hoping it's an attribute issue of some kind.