Hi nation, one of my current projects is to try to hide the WiFi password from the user in any way.Our setup is: Deploystudio Image and DEP with PreStage Enrollments. The WiFi Setup with all SSIDs come from Casper - 3 different policies. Our students are local administrators on their own machines.This is why they also can access the keychain. 1st I thought its hidden and not written to the keychain when I use just the Wifi Profile, but unfortunate it will be written to the keychain first time the SSID gets connected.Is there a way to prevent the password to be written to the keychain? Or is there a way to make the entry unaccessable for the current logged in user but readable for the whatever process activates and connects to the Wifi?

Hi,Has anyone got a guide for automatically locking a Mac with a users AD account is disabled?There was some mention of it at the London Jamf event this year using webhooks and azure events.Thanks.

I just inherited a JSS one week after a 650 Macbook Air deploy. In this deploy, no machines have been bound or named, but asset tag info was recorded into the JSS (in the asset_tag field). Each of them has the name "Macbook Air" or "User's Macbook Air". What I need to do: Rename the devices (both in actuality and in the JSS) using data already stored in the asset_tag field of the JSS record for each machine. The names need to be changed to the asset tag with “-MAC” after it. An example is: If my asset tag is 12345, my computer name needs to be “12345-MAC”. I need to be able to run this script in a policy, once against each machine to change its name. Only after this is done can I move forward and begin to bind machines to active directory. Any assistance would be great, and thanks in advance!

I'm testing a Jamf connect login profile. When I log into a Mac using my credentials I'm always required to "Allow" the app to connect to my Google Account. Is there a way to reduce the amount of times the consent window pop up? It currently pops up every time after a successful login. Any helps appreciated! Thanks!

When auto-launching Self Service post-enrollment isn’t enough, continually prompt your users to actually setup their new MacsBackgroundWhile we thought we’d done everything to help ensure our users had a seamless experience in setting up their new Macs, we recently realized we should prompt those users with computers which have successfully enrolled, but still have yet to run our Setup Your Mac post-enrollment policies.Continue reading …

I'm using this script to auto set search domains at login. It works great but the user has to enter their password twice. Is there anyway to bypass? Thanks! #!/bin/sh SearchDomains="" # Install DNS servers and DNS search domains /usr/sbin/networksetup -setsearchdomains "Wi-Fi" $SearchDomains /usr/sbin/networksetup -setsearchdomains "Thunderbolt Ethernet" $SearchDomains /usr/sbin/networksetup -setsearchdomains "Thunderbolt Ethernet 2" $SearchDomains /usr/sbin/networksetup -setsearchdomains "Ethernet" $SearchDomains /usr/sbin/networksetup -setsearchdomains "USB Ethernet" $SearchDomains # Remove setup LaunchDaemon item srm /Library/LaunchDaemons/com.company.networksetup.plist # Make script self-destruct srm $0

So I am trying to install GarageBand iOS on an Apple Silicon device. But I get this error."Media lookup returned no results for this platform" I used this guide.https://grahamrpugh.com/2021/08/24/jamf-ios-apps-on-macos.htmlIs there a better way?Thanks

Good morning,is there by chance a good source to check out a step by step update from Jamf Connect 2.6.0 to 2.13.0 ? I am a little bit lost on which steps to start with first. Do I need to create a test Configuration Profile and deploy it only on one machine etc...Thank you.Best RegardsRen

We'll soon be deploying Jamf Protect to our endpoints and are using the built-in integration between Jamf Protect and Jamf Pro to do the initial PKG and config profile installs. In our environment, most users are admins on their machines and one thing we discovered during testing was that someone could easily throw away the Jamf Protect app and be unprotected. To remedy this, we've created an EA that tracks the installed version of the Jamf Protect binary (or returns "Protect binary not found") and populates a smart group if the binary isn't present. A policy then re-installs Jamf Protect on any computer in that smart group.The one downside we've noted to this approach is that the EA only gets updated once daily on inventory collection, so it's possible for a computer to go up to 24 hours without Jamf Protect. Any ideas on how to accelerate the re-install in this situation? 

Folks,This is a question we have asked much previously but want to refresh this.We are having challenges on our network for authenticating MAC books using the JAMF and Cisco ISE integration.We see Cisco ISE provides various attributes like "MDM Manufacturer", MDM SerialNumber", "MDM DeviceRegisterStatus" etc. but none of these are working. We are trying to figure out what best will work in this case.  With reference to the same checking for guidance from the community.  Thanks!!

So we use an app called Collage to mirror to our interactive flat panels. The app is from the company we purchased the panels from.  The app seems to install fine via self service and I have a configuration file to allow standard user to allow app for screensharing. The problem I am having is every time they launch the app they get hit with this dialog box that ask for admin pw. The admin pw is needed in order to send audio to the board wirelessly. If you hit cancel it will mirror the screen but it will not send audio unless you enter the admin password. Once the admin pw is entered the app works fine but how do I get the admin password sent with out the standard users seeing this box. Last resort is manually entering the admin pw on every teachers device. Staff is using 2020(intel) 13inch MBP and are on the latest Big Sur. Any advice? Alre

We are attempting to use VPP. we only have 3. 1 was added over a year ago and  is still working. Two were added just this week and those two are not working. When we click install a message in self service shows up saying Cannot each Jamf MDM Server. Then it opens the app store to the application page. The issue with this is that not all our mac users have an app store account. Which just makes things more complicated for me. 

Hello, First time posting here!  We are trying to roll out Jamf in an enterprise environment and I am seeing some PPPC configuration errors in the Management console for users.  When we initially configured this we only added Sophos strings to the "App Access" portion of PPPC.  Currently we have about 10 Sophos entries including the Identifier, Identifier type, and code requirement.  I have gone through to confirm there are no spaces at the beginning or end of any of the identifiers but my question is, should I have more entries than just Sophos?  The Jamf rep we had paid for some live sessions with sent me a screenshot of some terminal commands that had nothing to do with Sophos so I was wondering if it is typical to only have Sophos for example in these entries, or none at all?  And my main concern, will this cause any downstream issues post-go live.  Right now as it stands from the testing I have done, Sophos installs as expected so

Another thing I worked on today as a little personal project.Again, stolen adapted from Joe Farage's Firefox update script, this does the same thing but for the ESR (Extended Support Release) edition, as we're more of an ESR shop.Unfortunately, ESR is not handled by Patch Reporting, so requires manually managing version conditions (Smart Group) when updating existing installs. #!/bin/sh ##################################################################################################### # # ABOUT THIS PROGRAM # # NAME # FirefoxESRInstall.sh -- Installs or updates Firefox ESR # # SYNOPSIS # sudo FirefoxESRInstall.sh # ###############################################################################

So we received complaints that Wacom Drivers were out of date in a lab that we had upgraded and not re-imaged. Tried pushing out the vendor provided .pkg of version 6.3.31-5 using Casper Remote until I could build a proper policy. Failed on all the workstations, with this lovely output: A previous generation of the Wacom driver is currently installed on this system. To continue with installation, the outdated driver must be uninstalled. To uninstall, search for "Wacom Utility." Once in the utility, click "Remove" under the Tablet Software heading. Once uninstalled, close the Wacom utility and re-start driver installation. Anyone else have an update strategy for Wacom Drivers? This seems to be a new development. I guess I have to build an uninstall script that simulates their GUI utility. Talk about enterprise management hostility to not provide a package installer that doesn't automatically deal with pre-installed versions of

Since we updated our Jamf Pro server to 10.37, any manually enrolled device is shown in Jamf as "unmanaged" . Appears that Jamf Binary is not downloaded to device --    /usr/local/jamf  is never createdThis happens on latest Macs with M1 and macOS Monterey, and older machines with an older macOS. Any one see this before?I see there were other posts about something similar where it was suggested that Rosetta needed to be installed - but in my case it is happening on machines with Intel Macs with macOS or earlierAny info appreciated 

We use DEPNotify as part of our deployment process so we can see which stage the process has got to.As part of this, we use defaults write to set up the .plist needed to allow DEPNotify to show a "registration" dialog that lets us specify the name and role (staff/student) of the Mac.On Monterey (12.2.1) on brand new Apple Silicon M1 iMacs, this seems to be failing for some reason.In the logs we can see:  2022-07-26 10:12:08.279056+0100 0x69fea Activity 0x5e290 10301 0 defaults: (CoreFoundation) Loading Preferences From System CFPrefsD 2022-07-26 10:12:08.297138+0100 0x69fff Activity 0x5e2c0 10311 0 defaults: (libsystem_info.dylib) Retrieve User by ID 2022-07-26 10:12:08.306905+0100 0x69fff Error 0x0 10311 0 defaults: (CoreFoundation) [com.apple.defaults:User Defaults] Couldn't write values for keys ( registrationMainTitle ) in C

Just wanted to share something I got working today in my Friday afternoon Google Time.This is stolen "adapted" from Joe Farage's Reader updating script, but designed to update Acrobat Pro DC. #!/bin/sh ##################################################################################################### # # ABOUT THIS PROGRAM # # NAME # AdobeAcrobatUpdate.sh -- Installs or updates Adobe Acrobat Pro DC # # SYNOPSIS # sudo AdobeAcrobatUpdate.sh # #################################################################################################### # # HISTORY # # Version: 1.2 # # - v.1.0 Joe Farage, 23.01.2015 # - v.1.1 Joe Farage, 08.04.2015 : support for new Adobe Acrobat DC # - v.1.2 Deej, 10.11.2017: fork Reader script for Adobe Acrobat DC # ##############################

My school has been using jamf School for around 1-2 years and in that time I was able to find some interesting bugs and exploits that can be used to for Example: delete browser history, change some settings bypass the search filter Etc.And this is why i wanted to ask if there is a way to report bugs and exploits directly to jamf.

So a webclip that deals with incident reporting was on our fleet of iPads, thank link to the clip malfunctioned, so I updated the link to the correct URL and pushed the clip again, now BOTH webclips (same icon) are on the iPads- one works, one doesn’t. Any fix to get the clip that doesn’t work off the iPads?

I have a self service package that installs vmware horizon client 4.9.0. The initial run of the application pops-up a prompt to enter and administrator password (you can cancel) for 'START REMOTE USB AND PRINTING SERVICES'. how can i get rid of this pop-up prompt, so users don't see it????

Trying to export the version of an install (security) application that does not use the standard .App format.When I run the command /usr/local/agent/agent --version 2>&1  | awk '/Agent/ {print $NF}' in Terminal, it outputs the correct information.When I try to use it in a variable AgentVer=( /usr/local/agent/agent --version 2>&1  | awk '/Agent/ {print $NF}' ) (for EA) I get error "-sh: syntax error near unexpected token `2'" so I know it has to do with the special characters but don't know how to allow them.

We'd like to prevent users connecting unsecured WiFi -networks, but as this doesn't seem to be a feature (we don't want to use a whitelist / blacklist), I'm trying to find out another way to warn users, if they're using unsecured WiFi at any time. Would anyone have any idea how to do the following? As macOS is able to tell user this information about being connected to unsecured network (when clicking on the WiFi top bar WiFi icon), I thought perhaps this information could be checked somehow via terminal.If it's somehow possible to check via terminal, I'd then like to send a notification to the user, stating that they're using unsecured network and they should activate our VPN (were not using macOS integrated VPN connection). Jamf is able to provide a simple notification pop-up window to the user via command: jamf displayMessage -message "Enter your message here"   

I could use a little helpI am trying to make EA to report back when a user has signed into Kerberos SSO.The way I am trying to go about is the read the SSO log file and scan for the word "Principal"If Principal is in the log then the user signed in.This is the EA I tried to make that is not working.Thanks for any help #!/bin/bashloggedInUser=$( /usr/bin/who | /usr/bin/awk '/console/{ print $1 }' )KSSOUSERID="$( /Users/$loggedInUser/Library/Logs/Kerberos_SSO.log | grep Principal | cut -d '=' -f2 | xargs)"if [[ "${KSSOUSERID}" == "" ]] ;then/bin/echo "<result>Not Signed-In</result>"else/bin/echo "<result>Sign-In Complete</result>"fiexit 0

I would like to supply IOS devices to schools and have them managed by JAMF Pro. They are specialty devices that would not make sense for it to be put under the schools MDM.I am not sure if I would lease or sell them to schools.I have seen other companies that have an iPad kiosk that they sell to libraries and mange them through a MDM. Is this something that would be allowed (legal?) . The devices are not being setup to be used at my company but rather for outside entities.Anyone know the answer or where I could get the answer?Thanks