Hello, I would like to know if you know how to disable Web Filtering on Forticlient VPN, please? Indeed, we use Forticlient VPN in my company. We need to install a configuration profile to set up the Filter Socket; otherwise, without it, the user gets a pop-up asking to install the Network Content Filter. The problem is that we have just implemented Jamf Security Cloud, and we have deployed a Jamf Security Cloud profile on the computers. Most of the devices don't have the Secure DNS of JSC activated, and according to Jamf support, this is because Macs can only handle one filter at a time, and other filters need to be removed or disabled. But as I mentioned earlier, if we remove the Filter Socket from Forticlient, the pop-up appears every time Forticlient is used. Otherwise, if we cannot find a solution, we will have to stop using Jamf Security Cloud, which I find unfortunate. Thank you in advance, and have a very good day.

Hi all, I am trying to work on a solution to setup a splash screen at the login for our fleet. The idea is when users log onto macs, a splash screen pop up with a user agreement message that by "logging into the computer you abite with terms and conditions etc". I created a config profile with a Login Windows Payload and in the banner I copied the user agreement message, but since the message is too long you cant see anything unless you scroll down. I also created a little app using Script Editor and packaged it, then created a config profile to add it to Login Items. but I need a better solution. I am hoping if someone has done it.   Thank you

I'm trialling PSSO at the moment, appears to work well, and the workflows are fairly good in terms of steps to follow post enrolment.  There is a prompt after Intune registration to use passkeys and passwords from Company Portal - a toggle on requiring manual intervention, does anyone know if this is configurable with plist/other Jamf config?Also, we're only using PSSO to improve auth to Microsoft products, I'm seeing wholly conflicting statements around extending that to macOS logon itself - has anyone done anything with this, i.e. override and control OS sign in/password sync, etc.

At the moment, site admins are not able to create or edit any configuration profiles with the SCEP payload, when an existing one is selected or created by a Site Admin, the page just loads the spinning loading wheel and finally errors out after some minutes. Is there a permissions setting that needs to be selected for this to work for Site Admins? Full admins work without issue, thanks.

I'm sure there is something silly I'm missing, but I was doing a test of exporting our list of devices from our ACE agreement and then using that to populate the mut template to update jamf.  It seems to grab teh serial number and Coverage number and populates it, but it leaves the Coverage End Date (aka Warranty Expiration) does not populate.  It shows properly in the preview of what will change, but it doesn't update field in jamf.  I checked the verbose logs and it doesn't show any failures.  I did see in the field that it was putting a specific time into the csv field once I expanded the field to see it.  I've tried with and without the specific time.      

Back at it again with a (potentially) useful script.   This script is designed to extract all of the system scripts from your JAMF server. Why do you want to do this? Make a backup of your scripts in case your existing backup files is missing/corrupted (or you don't have one!) You inhereited a JAMF server from another person, and this can do a "brain dump" so you can review the scripts. Why not? It is another example of what you can do with API scripts.. Source: https://github.com/ScottEKendall/JAMF-Pro-Scripts/tree/main/BackupJAMFScripts   Welcome screen Process screen

As many of you have requested, we have added the ability to change the benchmark mode (enforcement type) between Monitor only and Monitor and enforce, and also change the scope by selecting a different smart group. Editing of these settings works the same as managing benchmark rules - just open the created benchmark, make required changes, and click Deploy. Refer to the documentation if needed: https://learn.jamf.com/en-US/bundle/jamf-compliance-benchmarks-configuration-guide/page/Benchmark_Management.html Since compliance benchmarks is delivered into Jamf Pro as micro frontend, the new capability is available right away in all supported Jamf Pro instances!Looking forward to hear your feedback on the updates, and of course any general feedback on what is the next addition you would like to see.

Hi all,At System Settings -> Display -> Advanced -> Energy  you can this turn off or on  "Prevent automatic sleeping when the display" Any idea of this is possible to control this with Jamf? thanks  

As we deployed new AppleTVs we got the old AppleTVs back, some were not MDM enrolled (teacher donated). Now we are tasked with enrolling those OLD devices in our MDM. Mostly we were successfull in adding the devices to our MDM (via USB-C), but, we have a hard time with some Wi-Fi ONLY AppleTVs that were found in the mix. The apple instructions for enrolling the Wi-Fi only devices with Configurator 2 don't make any sence: Connect Apple TV HD using Wi-Fi   Apples instructions require the AppleTV to be reset/erased and left at the "Hello" screen, then, Configurator needs to PAIR to the device in order to process the enrollment, but, there is no Wi-Fi setup on the device...??? ... Anyone has any bits of advice? is MDM enrollment not possible on Wi-Fi only Apple TVs?

We have a handful of applications that are required to be on our laptops at all times. Currently, we have smart groups set with criteria for the app not being installed and a policy scoped to that group. The downside is it only updates when an automatic inventory update is done every day. Has anyone done something similar that runs more frequently?

saw this 3 times this week, pattern looks like a change in password, then MS authenticator shoots this up a few days later. using Jamf connect and entra integration,  reset MS office to complete deletion, no change, tried unenrolling, and re enrolling, cant do that at all... profile fails to install.    anyone else?    

I'm working with my mate AI, to write a clever script, to keep my kids in line from using VPN in the school, which will present them with any annoying re-petative pop up on their screen, when ever they engage the use of a VPN. it runs for 14 minutes on loop, running a 2 minute intervals check on if the local ip of the client, is within one of our networks subnets, and then checks for the reported current public IP from amazon, and if it doesn't come from one of our own, if it flags as being within one of our subnets and not with our public IP, it will proceed to prompt the end user, to turn off VPN, repetitiously, checking in every 3 minutes to see if the vpn has been turned off.basically they are using VPN to by pass, and play games in class, the constant prompt will ongoingly interrupt their games.its run every 14 minutes, so that next policy run, it will start over again. my issue is, I want it to run separately to the remaining pol

Hello all. When I use the following API point: --url $JAMFServer/api/v1/managed-software-updates/update-statuses/ I get a long list of info. This indicates I have permissions to access this data. However if I use "--url $JAMFServer/api/v1/managed-software-updates/update-statuses/filter=status=="installing" " I get a 403 error. Which is "Forbidden". It doesn't matter what filter I use, no go. Anyone know what permission needs to be set to get access to this info? Thanks.

Hey ya'll, I am currently in the middle of developing the process for converting my users over from using the Kerberos Extension to using Platform SSO on our Macs. I've got the profiles ready and all the local apps and such prepped to deploy, but when I perform the process I run into a few errors during the PSSO registration process. In particular I run into an issue at the end of the PSSO registration where it states that the "Sign in is currently unavailable", which does not happen when I enroll a device and have it go direct to the PSSO process and excluded from any of our KE profiles/policies. I was wondering if there is anyone here that went through the migration process and if anyone had any tips/tricks as to what they did to ensure a smooth user experience. I have every other piece ready to go and working flawlessly, just need to get my users in there and as we all know, the easier the experience is, the more likely users will do it quickly. Thank you!

Hello Teamwhile we expect inventory checkin to run every 15 minutes when device is On, this is not happening consistently for a few devices.Anyone observed this issue?

I have been doing some research into FV2 to see what it would take to encrypt all of my machines, but all of the information seems tailored for use in single user environments. What about multiple user environments? I have a lot of machines that are "public use," meaning that any faculty, staff, or student affiliated with my university can sit down and login with their AD credentials and get access. Given that many of these are part of a laptop checkout program, I would like to enable FDE in case they wander off. Is anyone else using FDE in an environment like this? How did you do the setup? Did you face any challenges along the way?

We are finding that when we run "Return to Service" on an iPad the location services is not turned on when it re-enrolls.  Because of this the date and the time is not set correctly.  Is there a way to force this to be ON, or a way to turn it on remotely?

hello all, I took advantage of Der Flounders excellent script to backup SS icons and made some enhancements to it.  This script is designed to extract all of the icons from all Self Service policies and store them on a local folder. Great for when Self Service starts to display generic icons...you can restore them with your backup. repo: https://github.com/ScottEKendall/JAMF-Pro-Scripts/tree/main/BackupSSIcons   Initial Welcome screen Progress dialog   Der Flounder's original script idea: 

OK..this has been a couple years in the making, but I think I finally have something ready to distribute.  In our environment (probably like yours to), the users don't have admin rights (which means they cannot run Apple's Migration Assistant), so I had to come up with a method for an end user to backup/migrate their data to another computer if they want.  Designed to be run from Self service.... Source Code: https://github.com/ScottEKendall/JAMF-Pro-Scripts/tree/main/MigrationWizard  

Hello I am attempting to block the Mac OS Sonoma BETA my boss advised me that my restricted profiles i created are wrong i will post a picture of what i have done so far when i scope the restricted software to my test mac machine it always installs and downloads the sonoma beta not sure what i am doing wrong    

Hey Jamf Nation, We're excited to announce the release of Jamf Pro 11.18.0 Beta! With this version we're releasing return to service in the Jamf Pro interface, a new Enable authentication with Jamf ID setting and more.  How to join the beta: Enroll in the Beta Program under Product Feedback at account.jamf.com. Once you enroll you’ll receive an invitation to join the Beta Forum, click “Join this group Hub” to gain access. Please also check out this recent blog on Configuring SSO in Jamf Account prior to testing Compliance Benchmarks, Blueprints, and A

It seems that on or about 6 May 25, and for whatever reason, endpoints seem to have stopped communicating with our cloud instance. After pulling logs, and running analytics, I found references to "JWT Null Key error" pertaining to "MDMActionFactory," which seems to mean our cloud instance couldn't sign--well, anything. Didn't catch it sooner because, and "song as old as time, tale as old as rhyme," ours is very much a Windows-first enterprise--meaning we're forced to install a number of agents upon our managed Mac endpoints--because InfoSec says... So we thought it was that...Turns out it was both.This past Friday evening our push proxy cert was renewed, and we pulled the trigger on the 11.17 upgrade... Now, a scripted DDM sync against all managed endpoints runs to completion (it wasn't before these referenced changes), as does a scripted command to cancel all failed commands...Despite this all policies still indicated a "pending" stat

Hi Everybody! Just throwing this one out there in hopes that someone has been in this situation before. This morning I had a report from a user that they couldn't connect to our secure Wi-Fi and upon investigating, I found that their Mac was no longer in the JSS/Jamf Pro Server (JPS?). Someone has deleted it!!! Do any of you know of any logs that may show when a Computer is deleted from the JSS/JPS and by whom? Obviously I can't check the Computer record as it is non-existent. I have of course asked the team if anyone deleted computer "X" and surprise surprise the response was "Nope, don't think so". Not looking to catch anyone out, just would like to know who to do some additional training with or in the unlikely event if there is no record of it being deleted, then maybe we have an issue with the JSS/JPS. Thanks in advance!

Hello all, We are working on leveraging the DDM managed-software-uodate API feature for pushing out enforceable updates to our endpoints. One of the issues we are seeing, however, is that some machines get stuck where the machine never updates but when I try to push and check a new plan, I get the error  EXISTING_PLAN_FOR_DEVICE_IN_PROGRESS  My question is, how do we go about canceling a plan that is already in progress?   Thank you, Alex Weiner

This one grew out of necessity at my old job.  The higher level VPs didn't want to go into each browser settings and clear their cache/cookies/history when asked to do so, so I tried to create a "one stop shop" to work on all installed browsers with a single click.  The goal was to keep their bookmarks, extensions & tabs intact...and it works "for the most part".  If anyone knows critical directories / files that should be kept during a cleanup, by all means, let me know and I can get it put into the code.  Hopefully you find this app useful. Code is here: https://github.com/ScottEKendall/JAMF-Pro-Scripts/blob/main/ClearBrowserCache.sh