So I'm trying to play in the sandbox that Apple and Jamf seem to want us to be in and I am pushing out as much as I can through configuration profiles for the user experience in our labs.I have unique docks built out for each of the different labs with a combination of the Dock portion of the config profile and an Application and Custom Settings JSON template that I found a ways back (Looks like it is this one. ). Everything seems to be working quite well and gives me a lot of flexibility across the spaces until I hit a coordinator who wants the user's Downloads folder available in the Stacks portion of the Dock. I have tried populating through the Custom Settings and through the Dock portion of the config profile with ~/Downloads and had no luck.Anyone have any thoughts on how to point to a user's home directory that do not involve uploading an entire profile outside of Profile Creator or dockutil (tried both in the past)?Thanks!

Hi all, trying to use this endpoint: https://api.zuludesk.com/docs/#api-Teacher-AuthenticateHence, a company Id is needed, according to the docs, supposed to be listed here: https://api.zuludesk.com/docs/#api-Teacher-Get_companies The last endpoint gives me an empty array. Where do I get this id from and how to associate it with a teacher? any hints appreciated 

Hello everyonePretty new to jamf so please excuse me.We are in the process of using jamf connect to elevate access currently still testing.I had one test machine that was running 2.34 elevated access was working i had about ~3minutes left of admin access, then our jamf connect policy decided to trigger (upon checkin) and upgraded to 2.35. All the sudden the request admin button via jamf connect does nothing. I checked 2 other macs that were running 2.35 and both are experiencing the same, requesting admin rights does nothing.Opening jamf connect to collect logs, I see one error that stands outProcess: Jamf Connect, Category: PrivilegeElevation, Contents: Elevation failed, role base elevation is active but OIDCAdminAttribute is not setAnd this is where it gets weird for me, initially our OIDCAdminAttribute was set to roleAfter it broke, jamf support told me is incorrect and to change it to either groups or roles & to delete the jamf connect state plist every change role>groups&gt

looking for gotcha's and issues if anyone has seen any. 

I am trying to find a way to create a policy that will restart a computer after it's been up for X number of days. I don't want it to force a reboot instantly though. I want the user to have the option to postpone it 2 or 3 times until it forces. Has anyone had any luck with this? 

Hello,Currently, we have an LDAP server configured with our on-premises Active Directory, and all user information is being retrieved from there. However, in the coming months, we will no longer be using on-premises Active Directory. We also have Okta in place. How can we configure LDAP with Okta so that Jamf can retrieve all user information from Okta?Do you have any updated documentation we can use as a reference?

I have a project that I am working on where I need to push a Adobe Package that allows only the version approved by the admin and not the user.What would be the best way to push this package and confirm that the user is not able to downgrade or upgrade the software with out our approval. Also I need to downgrade any versions that are higher than what's currently approved. Thank you!

Hello,I'm having trouble with packages out of Composer. I previously had been able to create packages and push out through JAMF Pro. However the JAMF signing certificate was accidentally deleted from my machine and I received an error in Composer that the certificate could not be found to sign the package. I tried reinstalling the cert into Keychain Access. I am pretty sure this is the correct one. It shows up in Composer now when I build the package, but when the policy is run in JAMF I get the error "Installation failed. The package could not be verified."How can I confirm the certificate is correct, or can I re-download and re-install to stop endpoints from having the error? Any assistance is appreciated.

Hi I am trying to upload iPad details using the API, this script did work it now wont it comes up with an error, would anyone be able to point me to what the issue isbellow is the error-:10: parser error : Opening and ending tag mismatch: br line 8 and p </p> ^ -:11: parser error : Opening and ending tag mismatch: p line 8 and body </body> ^ -:12: parser error : Opening and ending tag mismatch: body line 5 and html </html> ^ -:12: parser error : Premature end of data in tag html line 1 </html>And bellow here is the script#!/bin/bash ############################################################ #SCRIPT INFO ############################################################ CURRENTPATH=$( cd "$( dirname "$0" )" && pwd ) CURRENTNAME=$(basename "$0") CURRENTSCRIPT="$CURRENTPATH/$CURRENTNAME" ############################################################ # JSS Variables ############################################################ APIUSER="APIUS

Hi all,I have to deploy Enfocus PitStop Pro 24.07 via Jamf Pro, but I have struggles with that.I followed the guide what I found at Enfocus (this works fine with PitStop Pro 23):https://enfocus.my.site.com/customers/s/article/How-do-I-install-PitStop-Pro-in-silent-mode?language=en_USBut as I realized, the installer cannot install the files.When I open the PKG manually on my device and following the installation wizard, I'm stuck at "Choose Acrobat" step: when I choose my Acrobat DC the installer says: "Cannot link Acrobat bundle".Do you have any ideas what can I do with this?Thank you.

I'm trying to identify devices that have been enrolled using the Jamf School managed Apple push certificates in our iPad fleet as per this:https://learn.jamf.com/en-US/bundle/jamf-school-documentation/page/Jamf_School-Managed_Apple_Push_Certificate_Removal.html#task-1533 Prior to the UI update, I used to be able to identify them easily, following the instructions that were provided.Step 5 of section "Identifying Impacted Devices" from the link above says "....... click the number next to Devices."The number displays the correct number of devices (I can remember how may we had), but when you click on that number, all devices now get displayed.I'm hoping someone can show me how I can discover which devices are using this Jamf School managed Apple push cert.Thanks.    

Suddenly, as of a few days ago, users are prompted on every login to allow Jamf Connect to access their Google accounts. They need to scroll down and click Allow every time.The only thing that's changed recently that I'm aware of is that Jamf Connect version 2.35 went out just before the issue appeared. I tried rolling back on a test device with no luck though. Laptops are all on at least 14.4.1 of Sonoma.I found two old posts with a similar issue, but neither state what actually fixed the issue: Old post 1 and old post 2  

I mostly see this with apps that update often or are set to auto update.I do see this on newly enrolled devices and also those that have been enrolled in 2 years or more.Inventory shows the app name, but the app version or app short version is blank.Numerous inventory update or restart commands issued.I see this on my production network as well as away/unmanaged networks.Support had me initate update inventory command, and I see this fixes issues for some devices but not all.Ideas?

I'm the new admin at my school, but apparently this problem has plagued our 1:1 Macbook program for years. We whitelist/blacklist programs for a specific set of allowed functions, and our students get constant "You don't have permission to use the application [X]" popups. I'm talking 5-6 at start up and multiple times an hour beyond that. The names of these processes have changed over time, but the most common ones are:MessagesActionExtensionTVCacheExtentionlauncherGoogle Updater (this one is recent, I might have the name wrong)among many others. I've contacted JAMF support and they said to allow /Applications/Utilities/ and ~/Library into the whitelisted folders directory, but this does not solve the issue. It also allows Terminal use which is not what we wanted.Trying to find and kill individual processes via Restricted Software has no effect positive or negative.

Hey guys,Something is really messed up for us with our Cisco instance.I have attempted to find anything and everything I can on this in JAMF Nation, but no luck so far.I pushed a Cisco Umbrella / Open DNS to all out MacBook Airs with 10.15.7, Then created a "restricted software" policy to block the uninstaller, the SCG was added to exclude certain vintage devices. Well it did not exclude those devices. The SCG does have all of them listed so we are really stumped by this one.I did go in and disabled the blocking policy, but it still does not allow the uninstaller app to run even after sitting all day. I have run policy and also recon. but that did not seem to help either.If I run the uninstaller as root does it bypass the restricted software policy?A policy was created that installs the app, but it is still blocked and it does not run the app, just installs the app.Is there a method to run the un-installer in a script? Still this leaves me wondering why I cannot disable the

I sent in a support ticket about this but they're not available yet so I figured I'd post here too. We use JAMF Cloud and every single package that we had uploaded to our distribution point has disappeared. Policy logs report that the files don't exist. The web interface says "availability pending" for each package. The text for each one appears in red in JAMF Admin. Has this happened to anyone before?

do anyone have a script that will add AD Group Membership to OSX maxchine in AD. or a Apple script that will call a web service to addcomputergroup

Hello community.When I create or delete something on my Jamf site through api call (for example, creating a new policy with  POST on "/JSSResource/policies/id/-1"), I am getting a successful response with code 200 and the newly created policy's id.Then, I am trying to fetch all policies from my Jamf site (GET on "/JSSResource/policies"), but the response does not contain the newly created policy. Should I wait for few seconds before I fetch my policies and check if the creation succeeded? (Since I am running a code that does it I need to know how much sleep time I should add). Are there a different solution than doing busy waiting?All I wrote I experience for DELETE requests as well.Thanks in advance 

We used to authenticate our JAMF users (as owners of iPad-devices) against an Active Directory on our local Windows Server 2016 for several years. The server accepts only SSL connections and uses a special user for ldap-requests by jamf (no anonymous connections). The connections are secured by "Let's Encrypt" wildcard certificates which are renewed at least every three months. After each renewal I had to re-enter the domain-name on the organization/preferences/synchronization tab.This scenario worked fine since 2020. It works still fine for other services (e.g. our timetables by WebUntis, which authenticate via ldaps, too, and it's also used by our Nextcloud and by local scripts)Since several weeks it does not work any more: When I enter either LDAP-Server or LDAP-Port, there is an error "Fehler beim Abrufen des LDAP-Zertifikats" (Error retrieving the LDAP certificate). These errors are listed in our server's log:Event-ID 2085:Internal event: An LDAP over Secure Sockets Layer (SSL) co

Hi, I am looking for a way to sync my Exchange Global Address List to my users iPhones. But Jamf Pro seems to have no obvious way to do that. Can anyone point me in the right direction? Kind regards

I've got an issue with Screen Sharing on to a lab of Macs where the screen is completely black apart from the cursor moving being visable. Using Screen Sharing via Finder or using the Apple Remote Desktop application presents this issue.  The only fix I've found so far is to send the "Disable Remote Desktop" command from Computers > Management > Management Commands, force the device to check into Jamf Pro, then send the "Enable Remote Desktop" command to the device. After these steps, the black screen issue is resolved and screen sharing/ARD works as expected. When this issue occurs, I can easily log into Jamf Pro, send the management command to a smart group of my lab Macs, another management command to force them to update inventory, then a third command to force them to re-enable Remote Desktop.  Is there any way to automate this process into a policy so an engineer doesn't need to log in and manually run the commands?

i need to be able to isolate a single user with multiple machines, with very strict policies. any ideas on how to accomplish this?

Looking for a script to achieve this from JAMF Pro for  all the managed devices 

Is there any way to directly install the newest MacOS from the Recovery Mode for Macs with ARM chip? For example: I have an M2 Pro MacBook Pro that is currently on MacOS Ventura. Now I want to set it up for a new user, but if I delete the HD and reboot it in recovery I still can only install Ventura. I would have to install Ventura, Update to Monterey and then go through the whole process again.

Hi everyone,So I am trying to make it possible to ban certain apps depending on which grade the students are in. This would be really easy in a 1:1 environment, of course, but my iPads are in shared mode using managed IDs. I thought smart device groups would be a solution but this does not seem to do anything. Is this even possible with a shared iPad/managed IDs environment? Thanks a millionAlex