I'm working on a client setup right now where the computer goes through ADE/DEP and a tech logs in as the administrator account. That kicks off the DEPNotify Helper script and that workflow. This includes the naming of the computer which, in turn, scopes the FileVault Configuration Profile to the computer. It also includes binding the computer to AD. At this point, if I check fdesetup for a list of enabled users, I just get the admin account. So far, so good. After that the admin logs out (but doesn't reboot or shut down or other wise go back to the FileVault lock screen) and a staff person logs in which creates the mobile account. Now if I run fdesetup I see the admin account and the staff account are both enabled. Jamf confirms the same thing. Both accounts are enabled and FileVault is turned on at this point. However... if I reboot, only the admin account is visible on the lock screen. If I don't reboot, but instead log in as either the staff account or the admin account again and j

Random puzzle for the day. I had an issue that I was over thinking and did not realize the vendor just changed the application name, but it raised a question that I wanted to solve for funzies.    You have a plist that you need to read CFBundleGetInfoString from (not that this ever happens), but the path to the plist has a random folder name in it (the example I was working on is the application vendor uses a random string at the end of the app name for whatever reason). Due to the variable, defaults cannot be used to read the plist. I was using find which works fine locally to identify the path of the plist but would take too long for an extension attribute and would make check-ins take too long. find /Applications -name "*.app" -print | grep "/Remote Support Customer Client.app/Contents/Info.plist" | while readplist; do defaults read "$plist" | grep CFBundleGetInfoString | awk -F'"' '{print substr($2, 1, 8)}' done   ~ % defaults read /Applications/.com.Applicatio

We have four networked printers that are pushed out to all Macs through our company that are tied to different locations where offices are located across the world.  We noticed that these printers have recently started installing duplicates on users' Macs and I cannot figure out why.  I have tried to write some scripts to delete duplicate printers on a few test Macs but no luck.  This has been working great for about a year and just recently started installed duplicate printers. I have also tested to push multiple printers to my own Mac but it never duplicates after the printer policy runs. Scratching my head on this. This is what I have setup in Jamf. 1. Printer Policy Trigger: LoginExecution Frequency: Once per monthPackages: Canon PS Installer pkgPrinter: XXX Printer Action: Map (I also have the ppd printer setup in Jamf Settings)Maintenance: Update Inventory Here is the script I am using to try and delete the duplicate printers:#!/bin/bash # Chec

Hello All,I was asked to generate a report for all mac devices with three columns printing total physical size of the disk, total  used space by user and OS/system and available free space can be used by user in future.Now the problem is that if I use diskutil list, diskutil info / and df -h for all commands I am getting different values for each and every requirement, please help to find the most appropriate command for each. I think diskutil list can provide me the most perfect physical size of the disk, and df -h is good for end user's available space and total space consumed by user and OS/system. Please correct me if I am wrong here.

We have an annual PCI audit that we have to run on randomly selected Macs once a year. After the Macs have been selected, I scope those Macs to a policy that runs the script below. Everything works up to the point of uploading the resulting .zip file to the computer record on the Jamf server. I keep getting a "curl: (26) Failed to open/read local data from file/application" error. Unfortunately my curl skills are weak and I can't figure out what I'm doing wrong. I think I'm doing something wrong with the -F option or I'm not using the variables correctly in the curl command (line 91).#!/bin/bash # this script s used to collect a full system profiler dump in txt format # as well as user accounts, groups, crowdstrike info, open ports # it will put all the files in /Library/company/PCI/<computername>/ # for later retrieval and submission for PCI audit # Set variables for the JAMF API jamf_url="https://company.jamfcloud.com" jamf_user="API-only-account" jamf_password="password_here

About 75% of the apps I'm trying to push to an open enrolled freshly provisioned Macbook Pro aren't installing, I am using Jamf Now Plus and have test a variety of apps including Keynote, Numbers and Pages. I have "purchased" a pool (100 licenses) through Business Manager and they show up correctly in my Jamf portal. However when trying to install I am getting a "License Not Found" error dialog (with the Mac App Store icon) on the Computer and an "Installation failed. Will retry in 24 hours." error inside of the Device profile on Jamf. The odd thing is I've tried with some paid licenses such as Pixelmator and that worked and in some cases Pages work but Keynote and Numbers keep failing.

I think that some of the 3rd party plugins offer this but I'm hoping someone might have a tool they can point me to.I'm re-visiting our JSS after some personnel turnover and am finding myself chasing my tail comparing working computers to non working computers when troubleshooting.  I'd like to see if anyone has a tool that might make a 'map' of the various policies / Config Profiles etc  and what groups they connect to etc.TIAEric

Might anyone have any words of wisdom on managing Apple Watches?  Found documentation but it does not appear to recognize the watch paired to the supervised iPhone after several attempts.Thanks either way

While JSS is working fine and some iPad are enrolling into JSS normally. On DEP iPads we are getting message. "The configuration for your iPad can not be downloaded. The configuration is not available." Any suggestions.

Has anyone tried using a VM as a distribution point on premise??.. Any advice would be welcomed   T.I.A

Hey all! Been struggling with the auto screensaver setting for a while now. Whenever i set the "start screensaver after" setting to 20 minutes in "configuration profile -> login window" nothing happens and it's still stuck to 1 minute. I want this to be set tot 20 minutes or I want my users to be able to set their own time. Setting it to 0 or disabling it kept it still at 1 minute without being able to change it.  Let me know if you need more info! Pretty new to this.. 

Hi there, I have recently started a new roll and am trying to fix up the JAMF instance on site. One thing that is really bothering me is that through deployment I need to have the user(s) enable Remote Management. I keep getting the error On Macs with macOS 13 and onwards, Jamf is no longer able to automatically enable Remote Management. If you haven't already, please do so manually before proceeding forward with deployment.Im sure this is great from a security standpoint for users however, when sending computers to users and asking them to do that is a bit of a headache.I guess what Im asking is, is there a way around this error/warning and a way to enable this with out relaying on the user?Thank you.  

I'm kind of confused here about this version of FileZilla in Jamf.  I 'purchased' about 300 "FileZilla Pro - FTP and Cloud" licenses. I created the available FileZilla app in Self Service from the Computers - Mac Apps - App Store. It installed fine and works, as I transferred files just fine. But I don't see anywhere that it is restricted nor where one would enter a subscription, it did not notify me anywhere that it is a trial.  Does it act like the free app?  It says it is a free app in the Jamf setup (see picture).  In the app blurb it says "Subscribe to FileZilla Pro to begin your 7 days free trial." If I don't subscribe does it just act like the free app? I did build a FileZilla package and had the free app available, but wanted something that would update the app, as many of the Jamf Mac apps do.  Any thoughts are appreciated!

Hello all,Let me start by saying that I'd consider myself a junior JAMF admin. I've got a user that reached out to me because they were trying to change their password via JAMF Connect > Change Password, which works fine for all other users.When she tries to do it, she gets an error "unable to reach any KDC in realm xxxxxxxxx.com, tried 0 KDCs" (realm redacted).I've found some information saying that a krb5.conf file needs to be placed in /etc, and tried that to no avail. The realm in the message is not our actual domain, which is odd. The realm it is showing is actually the end of her email address, which is part of our domain. So say her email is lsmith@presidentialdrinks.com, but our domain is productjb.com, it is showing the realm as presidentialdrinks.com.The machine was not bound to AD, so I binded it through Users & Groups, and still getting the same message. I was able to manually reset the PW through our AD system, and JAMF picked up on it and made h

Help! We're migrating to Jamf Connect from AD, and we've done successful testing and migrations and I've been setting up user accounts with no issues. But all of a sudden today when I went to change someone's password using the menu bar agent, I got this error: "Unable to reach any KDC in realm xxxxxxx, tried 10 KDCs"Nothing has changed in our infrastructure that I am aware of; does anyone know what would cause this? I am freaking out a little.

We have Configuration Profile to disable Apple ID in System Settings. <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>DisabledSystemSettings</key> <array> <string>com.apple.systempreferences.AppleIDSettings</string> </array> </dict> </plist> It works some of the time. I made sure the devices don't have pending or failed commands. Some times require a simple restart but most of the time require pushing the profile out again, inventory update, or send blank push. What am I missing?

hi all,anyone found a way to disable/lock itunes or parts of it? especially files transfer.

We have 802.1x on our Mac's configured by a Configuration Profile.  There are settings to authenticate to the network before login using a Device certificate to get network access.  I've just tested upgrading a M2 Mac Mini.  Upgraded from Ventura to Sonoma and after that the machine wasn't getting network so I logged in and manually started the network and was prompted to choose the device cert.  After doing that and authenticating to allow a change it connected.Later in the day I upgraded the machine to the beta version of Sequoia (15.0) and this time again, no network so logged in and again manually started the network but this time didn't have to choose the device certificate.Has anyone else seen this behaviour with upgrades?  Any ideas on how to fix the problem as we want people to keep their machines up to date.

We have a lot of older packages building up (pun intended) in Jamf for things that were older original installers, patch management packages, etc., and I was curious as to how long I should be keeping these things around? Obviously don't need the Firefox installer from 6 months ago, for example. What are some folks doing for managing that? Comb through every 30/90 days and delete things? Thanks!

Hi GuysI am struggling since multiple weeks with this new feature device compliance in jamf PRO und Azure Compliance.Everything is setted up like described here: https://learn.jamf.com/bundle/technical-paper-microsoft-intune-mobile-devices-current/page/Configuring_the_Intune_Integration.htmlThe connection between jamf and azure is fine. Partner Device Managament in Azure also fine.Following scenario:I tested 5 devices.one device (my productive) is the only one which was running the complete registration with company portal and jamfaad (jamf conditional access app) completely and the registration process was done completely with the steps in this screenshotall other devices are not runningi tried all other device multiple times (after clean install of macos) with my user, with another testuser, with another productive user from 2 colleaguesafter some longer troubleshoot i checked in terminal with log show --predicate 'subsystem CONTAINS "jamfAAD"' --last 30m​ and receive

I am running into an issue on big sur with prestage enrollments. After passing language and wifi, I run into the error stated above "an error occurred while obtaining automatic configuration settings" on the remote management screen. I have followed the vidoes and set my prestage to the same settings, yet big sur will not pull the configurations. On Jamf Pro 10.27. Any help would be appreciated.

One of our App dev teams is looking to use AWS EC2 mac for their pipeline.  Our security department wants this managed like any other Mac in our environment.  I know very little about AWS and these instances.  Anyone got step by step guide or suggestions?

Hi there,I'm not sure if this functionality exists for MacOS, but it does for Chromebooks, and it's pretty amazing, so we'd like to leverage it for our iMac labs at the very least, and if it works there maybe go org-wide with it. The problem is I'm not sure what method to attack this problem with.Currently our iMacs (like the rest of our Apple computers) are AD bound. Users log in with a mobile account, and use Enterprise Connect for password management.I know that Macs support Kerb/SSO authentication, and also that Google's SecureLDAP can work for macOS as well, but what I really want is for the login screen to show me a Classlink login page so users can sign in with a QR code badge.Since our Google accounts use Classlink as their IDP and show the splash page when you try to log into them via web browser, I started going down the rabbit hole of getting a test machine bound to Google Secure LDAP, thinking it might spawn a splash page for Classlink login. But now I'm realizing that mech

To support the migration from the legacy Conditional Access integration to the new Device Compliance integration, we published an update to our Cloud Connector that supports integration with Azure Government Cloud (GCC High). This feature is now enabled for Jamf Pro 11.7.1 and higher in all hosting regions and for all on-premise customers. Additionally, for customers using Jamf Cloud Premium Plus, the Cloud Connector is now available to connect to Microsoft Azure commercial cloud.  How to: In the Device Compliance settings of Jamf Pro, select “US Government” as the “Sovereign Cloud” to integrate with Microsoft Azure Government Cloud.  Note:  Jamf Pro on-premise customers will need to add a network rule to grant the server access to a new hosted service by Jamf Cloud Connector: Outbound TCP Port 443 to  registration.cloudconnector.gov.services.jamfcloud.com Resources: https://learn.jamf.com/en-US/bundle/technical-paper-microsoft-intune-current/page/Migrating_from_ma

New to this community so please be kind. I have noticed that if i enable File Vault i can no longer remote desktop onto that machine. I use apple remote desktop to manage a lot of Macs, so is there a workaround?