Skip to main content

I've used my machine to access a client's intranet, but in order to gain access, I had to install jamf.



My current version of jamf is:



$ jamf -version
version=9.101.4-t1507816971


Today, there was a dialog on my computer insisting that I had to upgrade my OS, without an obvious way to dismiss it.



That's fine, I discovered in Activity Monitor that the jamfHelper was responsible and I could easily kill this. Aside: I'm running the latest security patched version of MacOS Sierra and don't have time to test an upgrade to High Sierra right now



I just want out. It's my machine, but has this software on it.



🚩 How do I remove it with it taking out a bunch of stuff which I still need?



I'm concerned about running sudo jamf -removeFramework as I just don't know what it does.



Killing the `jamf* precesses just launches new versions of them.



Here's what's currently running after some recent kills:



$ ps -ef | grep jamf
0 68775 1 0 11:34am ?? 0:00.33 /usr/local/jamf/bin/jamf launchDaemon -enforceRestrictions -monitorNetworkStateChanges
0 68852 1 0 11:34am ?? 0:00.08 /usr/local/jamf/bin/jamfAgent
501 68906 68221 0 11:35am ttys019 0:00.00 grep jamf


🚩 Is there an easy way to prevent the jamf daemon from launching?

sudo jamf removeFramework

ditto on what @davidhiggs said.



I'm concerned about running sudo jamf -removeFramework as I just don't know what it does.


Why are you concerned? It removes the Jamf binaries, which is what you want to do.


sudo Jamf -help.



Will give you the explanation of "Jamf -removeFramework" which is exactly what you're after.



Or call the IT department of the client who made you install it and ask.


heres the 2 cents



Daemons alone.. why not just modify or move the Launch Agents & Daemons?
(/Library/LaunchDaemons/com.jamfsoftware.*.plist) & (/Library/LaunchAgents/com.jamfsoftware.jamf.agent.plist)



Since it is your machine, you can do it with a click (after a few lines of scripting) why not make script/application



The script runs, disables / kills jamf process, moves the jamfsoftware startup launch agents and daemons to a hidden folder



Then have another script/app that moves these back when needed & activate the plists or boot the machine so casper is magically back running.






This is from one of our generic client machines





You can always do a Verbose & Be sure to remove MdmProfile as well.. i do the following when wacking a machine.



```
sudo jamf removeMdmProfile -verbose



sudo jamf removeFramework -verbose
``



& then remove computer from the JSS



What is Removed you ask??



jamf binaries

/usr/local/jamf/bin/jamf - The binary used to execute most tasks for the Casper Suite.
/usr/local/jamf/bin/jamfagent - Agent launched per user account to work in conjunction with the LaunchDaemons and LaunchAgents to report on specific user data.
/usr/local/bin/jamf - Symbolic Link to the jamf binary so it can be found in the default search paths.
/usr/local/bin/jamfagent - Symbolic Link to the jamf agent binary so it can be found in the default search paths.

LaunchDaemon/LaunchAgent

/Library/LaunchDaemons/com.jamfsoftware.task.1.plist - Used for recurring check-in to the JSS.
/Library/LaunchDaemons/com.jamfsoftware.startupItem.plist - Used to call the StartupScript.sh management framework check-in script.
/Library/LaunchDaemons/com.jamfsoftware.jamf.daemon.plist - Used for Application Usage, Network State Changes, iBeacons, FileVault information sent to JSS, Restricted Software, notifications, and Self Service actions.
/Library/LaunchAgents/com.jamfsoftware.jamf.agent.plist - Used in conjunction with the com.jamfsoftware.daemon.plist for tasks such as Application Usage, Restricted Software, and Self Service actions.

Property Lists

/Library/Preferences/com.jamfsoftware.jamf.plist - Defines the JSS URL, Management Framework Change ID and security settings such as SSL verification, clock skew, and package validation.
/var/root/Library/Preferences/com.apple.loginwindow.plist - Used to store the defined login/logout hooks for the system.

Jamf Application Support Directory

/Library/Application Support/JAMF/.blacklist.xml - Contains list of Restricted Software.
/Library/Application Support/JAMF/.userdelay.plist - Contains policies that have been deferred.
/Library/Application Support/JAMF/bin/jamfHelper.app - Application used to display messages to an end user.
/Library/Application Support/JAMF/bin/Management Action.app - Application used to display messages to an end user in the macOS Notification Center.
/Library/Application Support/JAMF/Composer/ - Contains working directory for Composer to save package sources.
/Library/Application Support/JAMF/Config/ - Contains JSS defined iBeacons.
/Library/Application Support/JAMF/Downloads/ - Temporary storage for downloaded packages.
/Library/Application Support/JAMF/JAMF.keychain - Enables certificate based authentication with JSS.
/Library/Application Support/JAMF/ManagementFrameworkScripts/StartupScript.sh - Script that is called by the com.jamfsoftware.startupItem.plist to enable a check-in to the JSS at startup.
/Library/Application Support/JAMF/ManagementFrameworkScripts/loginhook.sh - Script that is called by the com.apple.loginwindow.plist to enable a check-in to the JSS at login.
/Library/Application Support/JAMF/ManagementFrameworkScripts/logouthook.sh - Script that is called by the com.apple.loginwindow.plist to enable a check-in to the JSS at logout.
/Library/Application Support/JAMF/Offline/ - Contains the contents of the policies marked to be Available Offline.
/Library/Application Support/JAMF/Receipts/ - Contains receipts for all packages installed by the Casper Suite.
/Library/Application Support/JAMF/run/ - Temporary Storage for FileVault key prior to submission.
/Library/Application Support/JAMF/Self Service/ - Contains Self Service plugins.
/Library/Application Support/JAMF/tmp/ - Contains temporary storage for logs and other files.
/Library/Application Support/JAMF/Usage/ - Contains the application usage data to be sent to JSS.
/Library/Application Support/JAMF/Waiting Room/ - Contains temporary storage for Cached Packages.

Jamf Client Log

/var/log/jamf.log - Contains a record of what the jamf binary does.

SOURCE: https://www.jamf.com/jamf-nation/articles/100/components-installed-on-managed-computers

Reply