Following the use of JAMF Mac Apps to update Chrome, some users have reported an issue where they are unable to access any internet or intranet sites from Chrome. The browser becomes unresponsive, and the issue is resolved only after a device restart. Has anyone else encountered this issue, and are there any insights or suggestions available?

Help! I have been trying to endlessly to get this to work...what am I doing wrong? I know for a fact that the logged in user has the workplace join key in their keychain but for some reason, when trying to run this for an EA it doesn't report correctly.  I know the jamf runs with elevated privileges, but should it be able to run this without prompt for user credentials (like root), or is this not going to be possible?   #!/bin/zsh currentUser=$( echo "show State:/Users/ConsoleUser" | scutil | awk '/Name :/ { print $3 }' ) uid=$(id -u "$currentUser") haswpjkey="No" wpjkey=$(launchctl asuser "$uid" sudo -iu "$currentUser" security dump-keychain | grep "Workplace Join Key" | xargs) [[ "${wpjkey}" == *"Microsoft Workplace Join Key"* ]] && haswpjkey="Yes" echo "<result>$haswpjkey</result>"  

If I wanted to test a script locally on my mac before deploying it out - how would i go about doing it?Do I open my terminal and drag the".sh" file in there?

I'm trying to configure my updates to run via S.U.P.E.R finally, and I keep running into the error: Warning: Inaccurate deferral found for macOS major upgrade 1 of 1 is: DeferredUntil:2025-01-10 00:00:00,Title:macOS Ventura 13.7.2,Build:22H313,Version:13.7.2 I have config profiles setup for Apple Software Updates and  SUPER the following: Apple Software Allow installation of macOS beta releases Automatically install macOS updates Automatically install app updates from the App Store Restrict software updates to administrator users only Automatically check for updates Automatically download new updates when available Automatically install configuration data Automatically install system data files and security updates   MacJutsu.Super <key>AuthJamfComputerID</key> <string>$JSSID</string> <key>InstallMacOSMajorUpgrades</key> <true/> <key>InstallMacOSMajorVersionTarget</key> <strin

Instead of using the Okta Authentication API, Jamf Connect can also use the Custom identity provider type with an application set up for OIDC/ROPG in the Okta tenant. This allows for granular application of Authentication Policies in the new Okta Identity Engine tenants. Create App Integration in Okta Navigate to the organization Okta administration page.  Select Applications → Applications and pick the Create App Integration option.     Select the options for OIDC - OpenID Connect and Native Application.  Select Next to continue. Select a name for the App integration name.  In Grant type, select the options for: Resource Owner Password (this enables ROPG for ongoing password checks) Implicit (hybrid) Scrolling down for more options, remove the default entries with the X option for Sign-in redirect URIs and Sign-out redirect URIs.  Enter a new sign-in redirect URI with the value https://127.0.0.1/jamfconnect Optionally, assign users to the Jamf Co

Hello everyone. We recently setup Kerberos SSO and are having some issues with it syncing passwords after a password change. Upon initial setup it works as intended. User logs in with their AD credentials, it asks for their AD password and their Mac password, it then syncs the password to match the AD password. However, when a user changes their password, they are able to log into SSO with their new password, but it never prompts to sync the mismatched passwords, so their computer still uses their old password.  Has anyone run into this issue?  Password sync is enabled and the system currently running into this issue is running 10.15.2

Hello  We have a group of iPads which need to have their time zone moved forward one hour. I'm using Jamf Pro Cloud version 11.11.1-t1731016358 and I have administrator rights. I've checked the configuration profile for this group of iPads and can't find the correct setting to specify the correct time zone. There is only the setting Restrictions - Functionality - Automatic Date and Time setting, which doesn't allow me to set a specific time zone. Can you please tell me how to change the time zone setting in Jamf Pro Cloud interface? Thank you.

Has anyone had success setting up SMTP in JSS using Google's SMTP relay? We are struggling to find settings that work. This is the doc I'm referencing: https://support.google.com/a/answer/2956491?hl=en

Can anybody share what smart group criteria you're using to see what mobile devices in the environment are using eSIM? Or is eSIM compatible? 

We have added a new reward to Jamf Nation Rewards: the ability to donate using points to Los Angeles County by supporting organizations providing emergency relief. Dangerous wildfires, including the destructive Palisades fire, are burning in Los Angeles County. The wildfires have burned more than 60 square miles and destroyed over 12,000 buildings. More than twenty people have died, dozens more are missing and more than 90,000 people are under evacuation orders.  It is the most destructive fire in LA history. It only takes 50 points to donate $25! To find out where the donations are heading, check out this page -https://jamf.benevity.org/community/fundraiser/24332 Donations can be made under the reward '$25 Donation to Emergency Relief LA County'. Please reach out to jamfnation@jamf.com should you have any issues. Haven't joined Jamf Nation Rewards yet? More info can be found here!  As always, thank you for your kindness. Jamf Community Team

Hi Nation,  We have an issue with keychain while we are trying to make google chrome as a default browser via our prestage script. So, basically we have two scripts: 1. PreStage script (trigger set to immediately after the enrollment) 2. Script 1 enables another trigger which sets google chrome as a default browser.  We are using Jamf setup manager to install chrome.  The first script looks like this   #!/bin/bash # Initial PreStage Script # This script runs a manual policy trigger to # allow the policy or policies associated with that # trigger to be executed. waitForSetupToFinish() { # Wait until setup is complete and the user is logged in. logToFile "Waiting for Setup to complete" currentUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' ) while ( [[ $currentUser == "_mbsetupuser" || $currentUser == "loginwindow" ]] || ! ( (pgrep -x "Dock") && (pgrep -x "Finder") ) ) ;

Hi, Can anyone please help me with this??We had a restriction payload to delay major macOS for 90 days, which is working fine even more than we wanted. Since it has been more than 90 days after the release of macOS 15, this should be available to update for every device. But macOS 15 is still not showing up when trying to update! I thing I did was, I modified the same profile but only disable ChatGpt integration didnt change macOS Settings and re-pushed the same profile couple of days ago. JAMF Support confirms that re-pushing the same profile for macOS restrictions doesnt restart the timer, as this timer is depend on the release date by Apple. Really lost in here! And btw we dont have any profile controlling the macOS except disabling the macOS betas.

Is there any way to detect if a computer was enrolled through User Initiated Enrolment? JAMF Pro Cloud 10.610.13.4 Clients the only way I can think of is to use exclusions for other enrolment methods i.e DEP but I am very reluctant to use Exclusions.

We would like to create a Smart Group for computers that has IP addresses within xx.xx.243.1 to xx.xx.255.254. From other posts, we have the condition as IP Address Like xx.xx.243.x. However, this doesn't include all the IP within this DHCP range. How should we create the condition so it captures all IP within xx.xx.243.x to xx.xx.255.254 without creating xx.xx.243.x, xx.xx.244.x,...? Thank you!

No text available

Good afternoon All, I tried multiple times to get S.U.P.E.R.M.A.N script to work in my Jamf Pro instance. If anyone have a basic configuration profile that works well with their instance please share. I read the Wiki page but I do not see how the policy uses the configuration profiles to run and control when "super".

Hi, After updating macOS to 15.2.0, not able to sign in to Kerberos Extension. Showing Network credential not available. When trying to sign in getting error as "Your organization is not available". I tried command like kinit, kdestroy. Any other suggestions? Would Appreciate any help.   Thanks.

Hello !For some reasons, I would like to change the default icon of FileMaker Pro. I install the app, change the icon in the information tab and package it using Composer.But when I deploy it on some test computers with a Jamf policy, I have different message errors like "The app is damaged and cannot be opened", sometimes with a message telling me to drop it in the trash. If I right click on the app or it's dock icon then click "Open", it will open.I would like to be able to avoid this message,  allowing the app to open using command line or Apple Script to bypass that security, or another way to customize the FileMaker Pro's icon without having this message.I found that it could be possible to make appear again the ability to choose to open apps from any source, but I would like to avoid that option for security purpose. I want to keep it as "Open from Apple and identified developers".Thank you !

Since our client is renting an Apple device(Mac), client are using the user-initiated enrollment method to register the device with jamf pro. Also, through Jamf pro, the profile item was disabled to use jamf pro restrict configuration profiles -> restrictions -> preference -> disable profile item. The end-point with Monterey installed is normally graded out, but the profile is not disabled on the end-point with Ventura installed. Are you experiencing any issues like this or have you solved them?If you have one, please share it with us.

Hello everyone, We are currently using Jamf School to manage our devices and would like to automate the process of assigning configuration profiles to specific device groups like Group 4 students. While reviewing the API documentation (https://api.zuludesk.com/docs/), I could not find a dedicated endpoint for this functionality. Could you please confirm if there is an existing API endpoint or method that allows us to: - Assign a configuration profile to a device group. - Remove a configuration profile from a device group.   I really appreciate any help you can provide.

I migrated over to S.U.P.E.R.M.A.N. late last year (ok...the company didn't even have any type of policy in place...it was the wild Wild West over here...).  I am sure that this script is not perfect in anyway, but it is working for me, so I thought I would share it in case anyone starting out would like a starting point.  For you seasoned admins, any feedback on better improvement(s) is greatly appreciated!     #!/bin/zsh # Writen by: Scott E. Kendall # Last Revision: 01/10/2025 # # Execute Superman script with passed parameters from JAMF # Options include Allow on minor updates, install major updates (speicific versions) and donwload only # # Parm #4 - Update Type (Major, Minor, Download, Defer, Reset) # Parm #5 - Force OS Version # Parm #6 - Deferral Time (in minutes) # Parm #7 - Deferral Count # Parm #8 - Deadline Date # Parm #9- Icon path # Parm #10- Test Mode On/Off # export PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin LoggedInUser=$(echo "show State:/

Hi Folks,So we use Unity Hub in our classroom, I have always been able to activate for multiuser's by running.https://docs.unity3d.com/Manual/ManagingYourUnityLicense.html /Applications/Unity/Hub/Editor/2022.2.0b4/Unity.app/Contents/MacOS/Unity -quit -batchmode -serial SB-XXXX-XXXX-XXXX-XXXX-XXXX -username 'name@example.com' -password 'XXXXXXXXXXXXX'When I run it, it looks like it works, but when I log in as another user it is not activated.I verified that the path exists, if anyone has any advice id be grateful Unity support has a 30 day wait time for a response (I am not kidding I put in a ticket over 2 weeks ago)

Hi all,   I'm the only Jamf admin for my company and have been asked to removed a specific Chrome extension from all our Macs across 9 locations. Is there a way AI can do this without physically going to all locations and removing it one by one? I saw a few posts, but I'm a newbie and don't know where to even start. Thanks in advance!

I am trying to figure out how to completely remove Jamf connect from my machines.I have tried running the uninstaller but it leaves profiles in my profile list of client machines that do not exist in my profiles built and deployed from Jamf Pro. I have looked for these profiles in my list of deployable profiles and they do not exist.I have turned off every profile and policy I believe is related to connect but two profiles still show up in the list on client machines. 

Hey! I work in a school district where we have given teachers MacBooks. We have restricted the teachers from adding printers because we would really like to cut down on the insane amount of printing that they were doing. Before we had done this, a lot of the teachers had brought their own personal computers and added our IP base network printers. So we were thinking that they would do the same with their new district issued MacBooks and blocked the addition of printers behind admin credentials. We have given them the option to all print to the district's Xerox machines and that's it. However, a lot of these users would like to add their own personal printers. I was wondering if there was a way to allow the users to add their own personal home printers while still restricting them from adding a IP based network printer? I've seen some scripts that would add the user to a specific group that would allow them to add printers, but I am nervous that this would allow them to start adding