Today I have ran into a problem I have not seen in the past. We have been using Jamf Teacher to restrict iPads for awhile now and have not changed anything today with our settings. We are getting a red exclamation point icon next to users names when trying to apply device restrictions now. It is happening when using the app on many different devices, and while attempting to restrict many different devices.  Any insight into this?

I asked this same question on the Clearpass forum, in case there are more people there that are doing similar things, but I'm hoping for someone with the conceptual understanding to just give me a nudge in the right direction regarding this setup. We have been using 802.1x with Machine certificates issued by AD, with ClearPass and Windows machines for a couple years now. I understand the process that the windows machine joins the domain, get's a certificate, and then our clearpass servers are domain joined and can authenticate the machine with Active Directory using some of our various AD servers. All of that works well, and makes sense to me. Now we're extending it to macbooks and adding Jamf, so that we can also set up certificates on the macbooks (they will not be domain joined) via SCEP/NDES integrated with our windows CA, with the goal of them also doing 802.1x with EAP-TLS. So far, we have the SCEP process working fine, and the macbooks obtain their certificates from our CA via S

When going in to a iPhone and utilizing the lock device button in the management tab, device lock seems to be bypassed if the user has a pin or FaceID setup. Does anyone know of a way to get around this so a phone can truely be locked and could only be unlocked by a admin or is this some sort of limitation by Jamf/Apple?   Any thoughts on this would be greatly appreciated. I was not able to come up with anything when searching the boards or documentation but could have missed it somewhere

I found this website with what appears to be really good info on how to disable Time Machine. It's dated March 2021, so I tried the first one anyway (Prong 1), and neither the sudo command, nor the MDM Profile work. The sudo command sudo defaults write /Library/Preferences/com.apple.TimeMachine DoNotOfferNewDisksForBackup -bool TRUE returns "Could not write domain /Library/Preferences/com.apple.TimeMachine".The configuration profile got installed on the machine, but after connecting an external drive, I got the prompt anyway. I figure this is old information at this point, but does anyone have knowledge on how to do effectively disable Time Machine in its entirety? I can restrict the app, but what can be done about the popup when external drives are inserted?

I would like to add applications to a users Login Items. But I do not want to add them using Configuration Profiles, as this means the user is unable to remove these applications from Login Items.I want to add them just so that they start up when the user boots the mac or logs in. But if the user doesn't want this, they should be free to remove them again.This used to be possible via Apple Script: App_Path="$4" App_Name="$5" Hidden="$6" /usr/bin/osascript <<EOF tell application "System Events" to make login item at end with properties {Path:"$App_Path", name:"$App_Name", hidden:$Hidden} EOF but it seems this doesn't work anymore.Does anyone have a way to do this?

Howdy... I’ve detected an issue where the Jamf binary stops checking in, this can be for hours, days, weeks or even months. This is evident when Macs have run their Inventory Update for "x days". It would appear that the Jamf binary begins its check-in process but never completes, this stops any further check-in attempts as the process is still running and wont attempt to check-in until the original process has completed. If you attempt to manually check-in you will get a similar error to:This policy trigger is already being run: root 88591 0.0 0.0 34245156 1048 ?? Ss 21Jul22 0:03.85 /usr/local/jamf/bin/jamf policy -stopConsoleLogs -randomDelaySeconds 300I suspect this issue is caused by a network interuption when a policy is running or a script within a policy that cannot complete (the softwareupdated process has been hanging on some versions of macOS Big Sur). There does not appear to be a time-out for the Jamf binary.CasperCheck or the new Jamf-Management-Framework-Redeploy API func

EDIT.. wrong sub group 🙄 should be in JAMF Pro.... where is delete in this thing.. ? 🤔 🤔 Any user can right click on jamf management notifications and 'turn off'.They will not turn back on until reboot.This is.. bad. Have a ticket in with jamf support, but in the meantime.. any thoughts.. iI've had poke around trying to see where this value is stored.. and so far not located.. of course the config profile for this is default from jamf and is locked out to the user. 

At it again with some more goodies!  Got a revamped GUI version of @robjschroeder excellent bootstrap script.  Changed it to be more inline with all of my other scripts that I have written: Code is here: https://github.com/ScottEKendall/JAMF-Pro-Scripts/blob/main/EscrowBootStrap.sh And some screenshots:  (1st one is the prompt users will get if they cannot escrow their account) 2nd one is to ask the user to escrow their account Result if it escrows OK... Please be sure to test before you put this into production!

Howdy folks! While people are digging into the shiny new Self Service+ app I thought I'd share a quick way to manage notifications for that app with a simple configuration profile. Why do we need this? The Self Service (Classic) app has the Notifications payload covered in the Security settings for computer management, which deploys Notifications preferences for the bundle ID com.jamfsoftware.selfservice.mac. However, the bundle IDs for Self Service+ are com.jamf.selfserviceplus and com.jamf.selfserviceplus.agent. As of the time of this writing built-in settings for Self Service (Classic) Notifications will not apply to Self Service+. Building a new configuration for Self Service+. One way to create a Notifications payload for Self Service+ is to use the built-in payload type in a Jamf Pro configuration profiles within the Jamf Pro web app. Navigate to Computers > Configuration Profiles and make a New profile. Select the Notifications option and add two payloads,

Morning, just installed the self service+ as per Jamf instructions so, downloaded .pkg, created a policy and deployed it on my admin machine as a test. In terminal i ran the command sudo jamf policy and it did install however, i got the following error shell-init: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory job-working-directory: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory shell-init: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory job-working-directory: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory shell-init: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory job-working-directory: error retrieving current directory: getcwd: cannot access parent directories: No such file or directory shell-init: error

Anyone here using the new Jamf Remote Assist?  I’ve gotten it to work a few times but it always fails now saying the cmoputer is not registered.  Then when I click the "Reregstier App button", the installation of the Jamf Remote Assist PPPC Profile always fails. I realize the feature is in its infancy, but would still like to leverage it.

Hello everyone, still a beginner with the 14 days trial.   I know what I want but I don't know how to archive that. I would like to give out a device and the user logs in with his MSO365 account. (name@comapny.com) So the device gets entrolled to "his name".   - Cloud Services connection is on. - Cloud identity provider is configured with our Entra ID. The test shows I can search for users and groups and see if they are part of a group   How do I need to proceed to get the users in Jamf Pro?   Thanks a lot in advance.

Hello - we have iCloud accounts disabled for our staff. However, many of them would like to use Apple Music as a quality of life issue, and some have a longstanding workflow of purchasing music from iTunes for work functions. In my restrictions profile I have "allow Apple Music" checked, however, in my testing I still cannot log in to either Apple Music with a subscription account, or even the iTunes section of the app.  Is there a way to enable Apple Music and iTunes for users without enabling iCloud accounts? Thank you!

I've originally written this post to my Github. Overview This document examines critical implementation challenges with Jamf Pro Computer Configuration Profiles, specifically focusing on the Restrictions Payload deployment mechanism. Three key issues have been identified, along with potential solutions and important operational considerations for organizations to implement while awaiting platform updates. Key Issues 1. Legacy Configuration Format The Jamf Pro Restrictions Payload for macOS devices continues to use an outdated deployment format, diverging from the modern "include/don't include" approach implemented in other payloads. This legacy system requires explicit value assignment for all available keys, forcing organizations to make decisions on settings they may prefer to leave unmanaged. When viewing the Security and Privacy Payload, we can see Jamf implemented the modern approach of "Include/Don't Include"     In this example, Password Change is included and re

Trying to find a simple solution to give me the IP address of an ethernet connection to a mac, if its through a USB-C adapter or a docking station.      Most of the macs stay connected to our wifi, and the service order usually puts that first so the built in jamf reporting is always giving us the wifi IP.  I would like to create an EA to give me ethernet... (even if there isnt one and the computer is only on wifi thats fine, it can report "none" or nothing.)

Back again with some more goodies.  Modified the script from https://mostlymac.blog/2021/06/09/using-a-self-service-policy-to-grant-end-users-a-secure-token/ to put a nice Swift UI interface on it and some GUI feedback on the process.   Code is here: https://github.com/ScottEKendall/JAMF-Pro-Scripts/blob/main/GrantSecureToken.sh and here are some screenshots:   and if successful: and if any failures occur:

We upgraded our on prem Jamf Server from 11.1.5 to 11.13.1 and after that when open Self Service is says "Self Service Cannot reach a JAMF MDM server".When I download a new Self Service from JAMF I just got version 11.1.3? 

Hi, I want to enable set time zone automatically using your current location radio button on system settings for all my org Mac on bulk. How do we get it, I want all the Mac date and time settings to be like it is on this image.

Hello all, I was having trouble setting the date and time automaticaly for jamf pro, i cant seem to find an option for in the config profile is there something im missing?

We have a lot of users who aren't updating Chrome. How are you enforcing updates and relaunches to apply the updates? 

Hello, We are experiencing an issue with creating a pkg using Composer from a Sequoia machine. We don't have this behavior when generating a pkg from a Sonoma machine. When we create a pkg containing a .app, for example, without anything else, no scripts, once the package is created, we can no longer open it with Composer because it gets stuck at 30% during the "converting xxx.pkg to source" phase. We have verified that Composer has full disk access in the macOS system settings. We tried deleting the /Library/Application Support/JAMF/Composer folder, but the same problem persists. We are using the Flat Package option and "automatically detect executable types" in Composer. There are no problems with dmg files. Have you encountered this type of problem before? Thank you for your help.

I am looking for a way to remove a firmware password via JSS policy. I work for a school district and we try to lockdown the computers so that the student don't have access to the recovery panel amongst other things. The problem is that there seems to be an issue with at least one of the computers not recognizing our firmware password, so we have no access either. Is there a way to do this using the built in policy (under accounts), or am I going to want to write a script based on the firm passwords article? Possibly helpful information:MacBook Airs (Mid-2011)Lion 10.7.4 and some 10.7.5current JSS 8.61

I have a script that I wish to use to remove old user accounts on Macs that have no activity after a specific date. I have ran this script manually on various Macs that we have with no issues, however when I try running it via Jamf, it gets stuck on "Installed" for the status and never executes. Even when I run a simple "echo "test"" script, this results in the same issue, so it seems that I am unable to run any scripts at all. If I go to "Result of script execution" it says "Could not load any current execution, we will try again soon...". This has been going on for maybe several months now, if anyone has any ideas on how to resolve this, it would be much appreciated. 

Hi All One question. We have some iPads with the yellow message in the Jamf at iPad details "Inactive.....". And the iPads don't get any changes over the Jamf, some new profile, App update and so. Happens it, if the iPad are to long offline and don't can be called up the infos with the Jamf School Server? Problem are, the Teacher can works further but does not realise, that they iPad don't communicate with the Jamf School Server. Is it possible to allow trustworthiness, if we download the "Supervision Identity" file over Jamf School and load it over an Apple Configurator to the iPad? Thanks Peter

Hello !I made a smartgroup for macOS greater or equal to 15 Sequoia. It should be simple:Criteria: Operating SystemOperator: matches regexValue: ^1[5-9]I have NO computer running Sequoia, but I have 3 results. 3 Intel computers with macOS version 10.14.6 (2 of them) and 10.15.7 for the last one.I searched all around and can't find where is the problem. I'm not really used with regex, but this one should be simple.Any help is welcome