Has anyone managed to get this working?  We have tried to set this up without any success.  We have added the required certificate to our Config Profile and I can see it on the machines in Keychain Access but our Network team say the devices are presenting the JSS Built in Certificate to the server instead of the certificate we have added in the Config Profile?The certificate is trusted and we have the correct common name, but it doesn't appear to be being sent out from the mac.Any suggestions appreciated. 

jamf recon command when run in verbose mode shows that it works upto JSS is available and doesnot update inventory. When check the JAMF client logs, there is a couple of error messages. JSS connectivity state change - state: notActive, user: nil Error triggering policy id: 386 error: Error Domain=NSCocoaErrorDomain Code=4099 "The connection to service named com.jamf.management.daemon.selfservice was invalidated." USerInfo={NSDebugDescription=The connection to service named com.jamf.management.daemon.selfservice was invalidated.}

Does anyone know how I can use a RegEx in a smartgroup for devices less than 12.0.1

Now that v11.1 is released comments are for the production release. 1) Performance still seems quite laggy. Almost unusable.Setup - Control computer and target computer on the same LAN. Both on my desk. macOS firewall disabled on both. WAN is 600/40 business cable.Actions (clicks, opening windows, etc) performed by the control computer appear instantly on the target computer - but take roughly 1.5 seconds to register on-screen on the control computer. By comparison, under the same setup/conditions, Splashtop SOS has a lag of roughly 0.5 seconds (or less).Looks like there's still a far amount of performance tuning to be done. 2) During a control session. . .When the control computer moves the mouse, the cursor moves on the target computer.When the user at the target computer moves the mouse, the cursor DOES NOT move in the control computer's session window. Items highlight when clicked by the user at the target computer - but no cursor movement. This creates two prob

We are currently in the process of preparing a migration from traditional AD binding to Jamf Connect with EntraID. Most users login's are working fine, however when a user with a local password that is different than their Entra password attempts to log in, they are hit with a screen that says "Verify Password, Invalid Password". I was under the impression that if configured correctly, it would instead prompt the user to enter their old password to sync the two. When the user enters their old local password, it does not sync it to the new one and just continues to prompt them for their old local password whenever they log in. Currently, our Jamf Connect login window profile is set to passthrough auth and disallow a separate local and entra password and I can't seem to find any other options that would be missing. Any thoughts?  

I am on JAMF Pro 11.5.1 and I am having a strange issue on a number of macs where Self Service is crashing immediately but only for Mobile accounts. Local Accounts can open Self Service without any problems. Has anyone run into this before? I have tried re-installing Self Service and re-running recon and policy but its still persisting. 

I need to turn off the Ad topics, Site-suggested ads, and Ad measurement from Google Chrome to 200 MacBooks, do you know if there is a way we can do this through JAMF via script?

We are relatively new to Jamf Pro.  NFR/Test was set up for us to use by Jamf staff.  Now that we have a few devices in our PRODUCTION instance and ABM setup along with that, I decided to stand up the Test/NFR environment.  When I get to the point of creating the new MDM server in ABM, I am prompted to download a new "MDM Server Token."  However, I am warned that doing that will result in my existing token being reset.  I do not want to break Production.  Is there a way around this?  Thanks.

Wondering if anyone can share their method for creating a PKG file from the source files for the TN5250J emulator? Some of our users are using an older version that's getting flagged by our Information Security team, so it's time to upgrade them. I don't know how our last Mac admin created the package for that older version, and so far anything I've tried to build in Composer doesn't result in a working package. Haven't found any answers yet on the internets. Only related post I could find in the forums here was this one, which didn't garner any responses:  Mac M1 Java and iSeries TN5250j - Jamf Nation Community - 225341.GitHub download page for the emulator is Releases · tn5250j/tn5250j (github.com). 

So I wanted to push an OS update to my test Macs, which I have previously done via Inventory, pick the machines I want, Actions, Update OS version etc.It's still there, I can still choose its radio button, but a blue box appears saying "You can now use Software Updates to manage OS updates". But the Software Updates feature appears to be a beta, and I don't particularly want to use a beta. I would like to use the existing Update OS Version mass action.The blue box says that I can continue using the existing feature, but that it will be deprecated in a future version. But the "Next" button is greyed out, with no indication as to why.So, despite the wording, is it already deprecated? Or should the Next button still be available, and if it should be, has anyone got any ideas about why it isn't?Thanks,Lisa.

I am an Active Directory user and log in to my Mac using AD authentication.This allows me to check the last user to log in to the Mac from the computer usage logs in the computer's history, but is there a way to collect SSO user information when using Platform SSO?thanks

BackgroundNow that macOS Monterey is out, we wanted to allow our opt-in Beta Testers with local admin rights easy access to nuke-and-pave their Macs the "Apple" way:macOS Monterey includes Erase All Content and Settings, a way to quickly and securely erase all of your settings, data, and apps, while maintaining the operating system currently installed. If your Mac includes this feature when using macOS Monterey, use it instead of other utilities to erase your Mac.Source: HT212749Smart GroupErase AssistantAnd / Or CriteriaOperatorValue   Operating System Versiongreater than or equal12.0.1 and(Architecture Typeisarm64 or Boot ROMlikeiBridge)PolicyOptionsGeneralDisplay Name: Erase AssistantExecution Frequency: OngoingFiles and ProcessesExecute Command:  /usr/bin/su \\- "/usr/bin/stat -f%Su /dev/console" -c "/usr/bin/open '/System/Library/CoreServices/Erase Assistant.app'"​  ScopeTargetsErase AssistantSelf ServiceSelf Service Display N

Hi, We have some smart groups that set target OS on Mac products, which currently forces user above the target OS to downgrade via DFU blaster.....  our target Stable OS in ventura, but unfortunately newly purchased macs with m3 processors will not go back to Ventura, so i want to exclude them from them from the smart group. Is there a processor identifier/or model identitfier i can use as advanced criteria in the smart groups  to  select M3 processors?

Hey guys, we're looking for an opportunity to grey out the option "Allow this user to administer this computer" in system settings. Our users are no local admins and we do not want them to enable that option. Any ideas? thank you so much, Best, Florian

Here is a script I made to remove old installations of Cisco AnyConnect that were done back before a choices.xml file was used. #!/bin/bash #This script will uninstall the full install of Cisco AnyConnect with all the modules # It will first look for the existance of the dart installer. If it is there, it will run. # then it will run the full anyconnect uninstaller. After that is completed, then we can install # the new version of Cisco Anywhere that only installs the VPN component. if [ -e "/opt/cisco/anyconnect/bin/dart_uninstall.sh" ] then /opt/cisco/anyconnect/bin/dart_uninstall.sh else echo "no DART to remove" fi /opt/cisco/anyconnect/bin/anyconnect_uninstall.sh exit 0 It works great... with the exception that in Big Sur and Mojave (I haven't tested other versions), it throws up the following dialog: Obviously the point of running things in Self Service is so end users don't have to get an admin to authenticate for them. Does anyone know how I can make this alert not

Has anyone figured out an automated way to allow non admin users to the System Preferences -> Security & Privacy -> Privacy to be able to Allow anyways to open apps. i've tried  #!/bin/shsecurity authorizationdb write system.preferences allowsecurity authorizationdb write system.preferences.datetime allowsecurity authorizationdb write system.preferences.SecurityPrivacy allowsecurity authorizationdb write system.preferences.security allowexit 0 But still cant get this to work with out admin credentials. 

I know that most folks are recommending user-driven provisioning where the end-user gets to enjoy the process of being involved in setting up their Macbooks. Our org is not one of those. Our users prefer to get their Macbooks and get to work immediately and not have to wait for apps to install or things to be configured while they sit and do nothing. We achieve this in Windows by pre-provisioning (Microsoft calls it white glove) where we assign common apps (Office, Chrome, VLC, etc) to the devices rather than the user and we leave user-specific apps (not all users get Adobe Creative Cloud for example) to be installed after the user logs in. This way, we can get a fleet of Windows laptops ready for use by anyone with very minimal delays experienced by the user (they can work in Outlook and Chrome while Adobe CC is being installed in the background). I plan to achieve the user side of things using DEPnotify but any suggestions how to pre-provision common apps? Is putting the comon a

I'm looking for a way to not have Keynote, Numbers, and Pages install on enrollment. Is there a way to do this? Or do I just have to remove them afterward?

Lately, every Mac that has tried to perform user-initiated enrollment in Jamf has been met with "Device Signature Error in the jamf log. To resolve, we perform these steps:1. Remove Jamf Framework2. Remove Jamf CA certificate3. Remove contents of /Library/Application Support/JAMF/Downloads/4. Run this command: sudo update_dyld_shared_cache -force5. Delete the mac from Jamf console6. Run the QuickAdd package on the mac7. Approve the Device Management Profile on the Mac8. Assign the user to the Mac in the Jamf Pro console This issue seems to have started with MacOS 10.14.5, but that may be coincidence. I have attached screenshots from an affected Mac. We have 3 macs that are broken right now, and 2 that were repaired using the procedure above. Anyone else seeing encountering this?

Hi,We're in the process of deploying Taegis XDR from SecureWorks to our Macs.  Unfortunately like most XDR's it's a mess.  Has anyone used Jamf to deploy Taegis.Beside the privacy settings, one of the issues we have is automating the registration process.  SecureWorks provides a .mobileconfig profile for inTunes but not Jamf.  I tried using it anyways but it didn't work. Are there differences in an InTune mobileconfig and a Jamf mobileconfig?  I thought a mobileconfig file or plist would be the same no matter the MDM.TIA,Chuck

Hello everyone,Is there any way to solve the installation of Office 365 without creating a package and policy with all the apps? Maybe with a script in some way through Self Service?

I have a number of users that are using Loom, but don't have administrative access on their computers anymore.  How is everyone dealing with updates like this?  I see that it can be managed by Patch Management, but how do I push out the updates when they are sent as a .dmg?

Dear Team,I know that with Jamf Protect can do App Control to block all the know apps with attribute like hash file/team id/sign id....Can Jamf Protect support to control the all black list apps not only App Store but also the third-part apps.Example my Org has many departments. Each departments will have the whitelist apps. Therefore, it is not in the whistlist the apps should not launch. The thing here is due to user's role need administrator permission, it is hard to control except check inventory manually. Mass thank

I am working with a Jamf environment that currently does not have any Jamf LAPS capable admin accounts. They did not create a “Management Account” in User-initiated enrollment. They did not create a “local administrator account” int PreStage Enrollment.   We have since specified a “Management Account” and a “local administrator account”. With two separate names. They are using Apple Business Manager Automated Device Enrollment. There are some locations that do not have ABM, so they are using User-initiated enrollment. (That is begin resolved). LAPS is working with newly enrolled Mac systems using either admin accounts.    Is there away to retroactively add a User-initiated enrollment “Management Account”? I’ve tried using “jamf policy -trigger enrollmentComplete”. This will successfully re-run the enrollment policies, but it does not create the “Management Account” from User-initiated enrollment. “profiles -N” does work. But that requires user interaction.   Thought

We have a Mac that will be used in a production environment (Live TV). I would like to keep it in JAMF but essentially just for record keeping, loss prevention and for our security software. A broadcast engineer will be responsible to keep it running. We tend to have a bunch of updates triggered by smart groups, basically if it has this software then do the update or action.Without excluding this computer from every single smart groups one-by-one, is there a way to single out a computer so any action to the computer is explicitly and only when it's named? Perhaps just a way to exclude it from all smart groups/groups.