Skip to main content

General Discussions

What your peers are saying about all things Apple

  • 10,000 Topics
  • 245,067 Replies
10000 Topics
V
VarepsilonNew Contributor
asked in General Discussions
Timed profiles - not reliable

A profile called "whitelist during school hours" is setup with a time filter. It has a whitelist, so that private games and other unwanted apps will disappear from the students' home screen. Unfortunately, the profile works only for 60-80 % of the iPads automatically. We have to push the button "re-try" in the administration console, or we have to ask the students to open the app Jamf Student, so that their iPads asks the Apple Push Server for any updates (including updates on profiles).Have you experienced non-reliability with time filtered profiles?Any suggestions how to fix that are welcome. (We tried IP address based profiles that work a bit better, but they aren't reliably either.)

130
N
M
mstydelContributor
asked in General Discussions
iPad Private Wifi (MAC) Address

Found out today that some students have the "Private Wi-Fi Address" option enabled in the settings for their appropriate SSID.  We don't want this setting enabled on any of our iPads so we have it disabled in all of our wifi SSID config profiles.  I had one this morning that I was able to enable and disable it, I tried restarting but no change, also tried removing and adding that SSID's config profile but no change, I could still enable or disable.  All of our devices are running ~16.6 or newer, probably around half have gone to iOS 17.  I'm guessing it defaulted to off rather than on like an unmanaged SSID would normally due to the profile disabling it, some just found that they could enable it for whatever reason and have.

230
JesseC1006
I
infrase2020Contributor
asked in General Discussions
802.1x LAN Profile

Hi allApologies if this has been answered already but we are trying to push an 802.1x LAN profile down to our macOS devices.We have managed to push the wireless equivalent down with a certificate etc however when we try and create the LAN equivalent the device doesn't pick the certificate defined in the profile. Has anybody come across this issue before? We've seen a similar issue in the past with windows devices where you have to start the wired auto config service but wasn't sure if something similar was required on macs?thanks  

570
J
rabbitt
rabbittValued Contributor
asked in General Discussions
Configure Platform Single Sign-On for Okta Identity Engine with Jamf Pro

NOTE: Okta Verify appears to have rolled back to 9.23.0 as the official release which is working in macOS 18.1 beta 6.  iOS SSOe support appears to be working in 9.24.1 with iOS 18.1 beta 6. Limitations and RequirementsApple has made two revisions to the PSSOe framework.  V1 allowed for Password authentication and can be used with macOS Ventura and greater.  V2 added functionality for authentication with PSSOe to include SmartCard and Secure Enclave credentials. At this time, Okta supports the V1 framework with limited support for V2 with Shared Device Keys.  The “Password”authentication method is available with Okta.  PSSOe support is limited to local account password sync only.  The PSSOe credentials are not used for authentication to Okta gated resources.  To complete the setup for the full expected behavior of PSSOe, an administrator must set up both the Extensible Single Sign-On extension (SSOe) configuration and the PSSOe configuration on the same device.  Okta uses a hybrid of t

4790
rabbitt
C
CrepuscularDaveNew Contributor
asked in General Discussions
Data Volume still exists after Erase All Content

Not a Jamf Pro issue, but Jamf Pro does hightlight it.  Four years ago when we got our first Silicon Macs, we occasionally found the odd machine which we couldn't log on with our admin account. Password wobble. We never found our the reason and just went into Startup Options, wiped the Volume Group and re-enrolled.  We now have more Macs, almost all Silicons now, so we see the problem more.  In order to ensure that our first admin account has Secure Token, we create it through Jamf Policy.  We've found that on Macs where we've flattened it with Erase All Content, or even Disk Utility in Startup Options (yes we definitely delete the Volume Group, not just Macintosh HD), we get the odd case where the Policy failed because "a folder with that name exists".So Erase All Content, and even Disk Utility says it has erased the Data Partition, but somehow it hasn't. Not knowing as much about Macs as I do about PCs, I'm guessing that the partition table is held in NVRAM,

10
C
L
Lion55Contributor
asked in General Discussions
Chrome Managed Bookmark Title

Can anyone help with JSON script line to change the name of Managebookmarks?  "ManagedBookmarks": { "type": "array", "title": "Bookmarks",

250
L
perryd84
perryd84Contributor
asked in General Discussions
JAMF LAPS Tools

Hi all,I've done a lot of work on creating a LAPS tool of my own which can be found here https://github.com/PezzaD84/macOSLAPS But with the release of 10.49 the JAMF LAPS solution is looking a lot better than initially. So I have created a couple of tools to help configure the LAPS settings and view the LAPS account and password.Check them out here:LAPS Configurator tool - https://github.com/PezzaD84/JAMFLAPS-ConfiguratorView LAPS Credentials - https://github.com/PezzaD84/JAMF-LAPS-UIPlease note these are very early release so there will be changes to come!All feedback is welcome😁

570
perryd84
kwoodard
kwoodardValued Contributor
asked in General Discussions
Extension Attribute for Cortex XDR version

I suck at writing extension attributes... I need one that will determine the version number currently installed on a Mac. I have a Smart group setup to filter out current versions, leaving computers with old versions. I need the EA so when I pull a report, I can not only see what version is installed, but compare it to the macOS that is installed on that same machine. Is there a tool or something to help create an EA like this?

340
kwoodard
SMR1
SMR1Valued Contributor
asked in General Discussions
Deploying Office 365 updates issues

Just checking to see if anybody else is running in to this issue. When we started deploying Office updates, we were using Installomator, but we started seeing some issues where not all of the office apps were updating. We then switched to the package, but we're having the same issue, where some of the office apps aren't updating and it breaks the app, so we have to just rerun the installer. The other issue is, after it updates, it sometimes removes the icons from the dock, but not all it'll just remove one.

140
J
U
ucdcastilloNew Contributor
asked in General Discussions
Extension attribute for Microsoft Office 2021

I had this extension attribute that will tell me if the mac had Office 2016 or 2019 installed, I need one now for office 2021, can anyone help me modify it? #!/bin/bashwordVersion=$(defaults read "/Applications/Microsoft Word.app/Contents/Info.plist" CFBundleShortVersionString)majorVersion=$(awk -F '.' '{print $1}' <<< "$wordVersion")minorVersion=$(awk -F '.' '{print $2}' <<< "$wordVersion")if [[ $majorVersion -ge "15" ]]; thenif [[ "$majorVersion" -ge "16" ]] && [[ "$minorVersion" -ge "17" ]]; thenecho "<result>2019</result>"elseecho "<result>2016</result>"fielseif [[ -d "/Applications/Microsoft Office 2011/" ]]; thenecho "<result>2011</result>"elseecho "<result>Not Installed</result>"fifiexit 0

90
kwoodard
G
GTroS92123
asked in General Discussions
Is it possible to password protect specific apps?

This is for iPhone. I have enrolled some devices and i was wondering if its possible to password protect certain apps so the user has to input the passcode to open X app.  Thanks!

30
Boogietr0n
dan-snelson
dan-snelsonHonored Contributor
asked in General Discussions
Determining a Mac’s SSID (like an animal)

SSID discovery in macOS 15 Sequoia need not require excessive execution cycles Background One of the many under-the-hood changes in macOS 15 Sequoia of which Mac Admins should be aware is how to determine a Mac’s currently assigned Service Set Identifier (SSID), commonly known as the name of the user’s selected Wi-Fi network. Continue reading …

30
dan-snelson
C
ChupSuyContributor
asked in General Discussions
API assign computers from group X to Site Y

Hi All, I'm trying to automate the actual Computer to Site assignment via API as we keep on having Computers assigned to wrong Sites.. :) So far I have not had much success, does anyone maybe have an idea how to tackle this?

530
D
anotheruser1
anotheruser1New Contributor
asked in General Discussions
Run Update Inventory From Jamf Connect Custom Menu Bar

Hello,Previously, I was able to execute policy in Self Service from a Custom Menu bar in Jamf Connect, but it hasn't worked in months. When executed with Self Service closed, I get "Self Service quit unexpectedly" "Click Reopen to open application again. Click Report to see more detailed information and send a report to Apple." The command works fine if Self Service is already open though, so it seems like it's an issue just launching Self Service from the menu bar.Here is the section of the custom menu bar I'm talking about, if someone sees something that no longer works, please let me know:<dict>     <key>Action</key>     <array>          <dict>               <key>Command</key>               <string>url</string>               <key>CommandOptions</key

40
anotheruser1
T
tegus232Contributor
asked in General Discussions
LDAP integration transition AD based user and locaiton to OKTA based

Hi all,   We have recently switched our LDAP integration from AD to OKTA. How do I bulk update user and location from AD based outdated info over to OKTA based. Any assistance is appreciated.    The MUT app looks like it would require alot of manual work to setup excel and is labor intensive.  

10
T
J
jzastrowNew Contributor
asked in General Discussions
Join Mack to AD

so it seem that the build it option JAMF Pro does not woke and i see the same problem others have posted the white brick when i try a ad login, so i suck with Mac scripting also now to JAMF looking to do is when the system runs in enrollment or first boot and it see the MDM setting and start to run that.   last step would be join AD.what i am looking to have it do is1. Join AD2. set the OU3. set the AD commuter name the the SN then reboot if needed4. this maybe a second scrip ( when assign a use set the Mac name that show up in mac info to the Users name)

90
J
dan-snelson
dan-snelsonHonored Contributor
asked in General Discussions
macOS Forensically Sound* Workstation Lockout with CrowdStrike Falcon and Jamf Pro

Designed as a possible last step before a MDM “Lock Computer” command, FSWL.bash *may aid in keeping a Mac computer online for investigation, while discouraging end-user tampering Background When a macOS computer is lost, stolen or involved in a security breach, the Mobile Device Management (MDM) Lock Computer command can be used as an “atomic” option to quickly bring some peace of mind to what are typically stressful situations, while the MDM Wipe Computer command can be used as the “nuclear” option. For occasions where first forensically securing a macOS computer are preferred, the following approach may aid in keeping a device online for investigation, while discouraging end-user tampering. Continue reading …

00
dan-snelson
B
bfrenchValued Contributor
asked in General Discussions
Jamf Teacher app lock changes layout?

I received this feedback from one of our teachers testing out Jamf Teacher- When I take control and lock them in an app, it literally clears their ipads from all other apps. Which is great! Except when I clear the locks on my end, all of their apps end up in different locations on their device. So I had a few angry students that spend hours organizing and categorizing folders and apps then suddenly I come along and clear things and then their apps are all messed up and scattered. That isn't a nice feature of this app for sure. I get it. I love having my iPad organized by apps I use and in folders. It's a shame that this developer didn't think of that aspect of things when designing the app. Just a little feedback for you. Are others experiencing this?

80
M
L
LeadehhNew Contributor
asked in General Discussions
Mac Appears in JAMF, assigned in ASM, but not appearing in Automated Device or Prestage Enrollment

Hi All,I have a machine which is appearing in JAMF when searched for under the Inventory tab. However, it is not showing up in the Settings > Global > Automated Device enrolment menu, or in Computers > Enrollments > Prestage Enrollments. Can confirm that it exists in JAMF and is enrolled in the MDM in ASM.As it does not exist in 'Prestage enrollment' when booting it doesn't go through prestage enrollments.I can enrol the device using the online login https://ourjssdomain/enrol, however this is a specific use case where I need the machine to be enrolled through Prestage as the machine could be wiped whilst the user is on the go for security reasons.When running sudo profiles renew -type enrollment get the message: DEP enrollment failed: No device Enrollment configuration was found for this computer (MDMDeviceEnrollment:103)Which is obviously occurring because JAMF hasn't got it selected to run the device enrollment config, because it doesn't exist in there.Any idea on w

2600
RaGL
E
exoNew Contributor
asked in General Discussions
os_unlock_active_user_session_disable and pwpolicy_custom_regex_enforce

 Hi,I have managed to mostly create a configuration profile that will make our Sonoma Macs compliant with CIS Lvl. 2. But I have come across two problems:1. An Administrator Account Cannot Login to Another User's Active and Locked SessionIf I am not mistaken, this should be fixable in one of two ways:a) By executing/usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1which I have done, and the corresponding check, whether this has worked,/usr/bin/security authorizationdb read system.login.screensaver 2>&1 | /usr/bin/grep -c '<string>authenticate-session-owner</string>'produces a result of 1, which is correct. But still that policy is failing in Jamf Protect.b) By setting values in /Library/Preferences/com.apple.PowerManagement.plist which I have also done through a policy. But this actually sets the values in /Library/Managed Preferencesand has no effect.Can you point me in the right direction?2. When I set

400
E
E
exoNew Contributor
asked in General Discussions
CIS v8 baseline in Jamf Protect / Custom baselines

Jamf Protect hast baselines for CIS Lvl.1 and Lvl.2.Is it possible to use a different baseline, e.g. v8?

80
AntMac
M
Muadi
asked in General Discussions
Can't Login to Jamf Pro!

I'm unable to login to Jamf Pro after following the setup procedures.  I'm integrating Jamf with Google Workspace and got locked out. Google Error 403.Error: app_not_configured_for_userService is not configured for this user. I am the admin on the account and GWP.

50
AJPinto
H
HonestpuckAUNew Contributor
asked in General Discussions
Profile not installing via automatic install

I have two profiles setting proxies up in the com.apple.SystemConfiguration domain.Both work if I double click on the profile and install via system settings, neither work if I install them via Self Service or pushing them from Jamf.Running 'scutil --proxy' shows an empty dictionary and trying various websites that should work all fail.I've tried a few different version of Sonoma and none work. I'm running "11.1.1-t1701704198" Jamf Pro on-prem.

40
C
M
MStasiakNew Contributor
asked in General Discussions
Boot Loop after Installing Rosetta

Anyone else getting stuck in a boot loop after installing Rosetta? 2020 M1 MacBook installed 14.6.1, enrolled with JAMF, but after installing rosetta the computer gets stuck in a boot loop. DFU restore doesn't fix the issue. Happens with multiple laptops.

40
Jason33
R
russell_garrisoContributor
asked in General Discussions
macOS expired MDM Profile Enrolled via DEP

I have a computer where the MDM profile didn't renew last month, so it is expired. Haven't had the chance to look into why it didn't renew automatically, since I have many others that have. I did dig up some old notes from a SCEP issue I had previously and found the following command:'sudo profiles renew -type enrollment'It isn't perfect and I don't have another test with and expired profile. Running it on a test machine did require that I log in as the first "Setup User" that was logged in when the computer enrolled the first time via DEP during the assistant. After straightening that out it pretty much did what the man page suggests. A notification appeared, clicking it took me over into System Settings and a new MDM profile was installed with an expiration set to two years in the future. This does trigger an enrollement and reset some of the once-per-computer policies, so a little care was needed to descope/exclude some things that shouldn't run twice. Apart from that it seems like

180
T

Want to write for Tech Thoughts?

Earn a cool badge and Jamf Nation Reward Bytes for your published articles. We’re looking forward to your submissions!

Submit A Blog Post
Terms & ConditionsCookie settings