Hey everyone, we're currently working on upgrading to MacOS Sonoma using Jamf Pro as Admin. We're looking for a way to run the upgrade overnight without requiring end users to enter admin credentials. According to Apple Support documentation, users need to be volume owners to initiate the upgrade, but they still need admin credentials to do so.https://support.apple.com/guide/deployment/about-software-updates-depc4c80847a/web#dep7d4a58bedCan we implement any type of policy to run the upgrade without asking for admin credentials?

HiI am trying to ascertain the ECCN number for Jamf Connect. I cannot find this on the product document. Is anyone able to help? Thanks

I've been testing out a script to run the following command in Terminal: sudo dseditgroup -o edit -d <accountname> admin The command works fine when you put in the account name, but of course this is not ideal when there are about 100 Macs in scope. Is there any way to invoke the "current user" to be added to the line above? Ideally the script will check who is the current logged in user and remove their administrator rights. FWIW these are mobile AD accounts with local admin rights. Thanks!

How do you get SMB network shares to mount using Jamf Configuration Profiles, under macOS Mojave 10.14.5? All that I have seen is various bash and AppleScript scripts. I was looking for a way to mount the shares without resorting to scripting.

I'm looking at integrating some Macs with Azure AD. I had a call with a Jamf sales guy today about Connect and he mentioned there was a feature that in Connect that didn't work without using Jamf Pro as well. Something to do with local account / password synchronization with Azure AD. Does anyone have an idea what that is?We already use Intune as our MDM, so I don't plan on shelling out money for another MDM solution as well.

Hello, not a direct jamf question however i have configured the Kerberso SSO Extension and working fine. I want to create a launchAgent/LaunchDaemon to trigger a script when com.apple.KerberosPlugin.ConnectionCompleted i have as below but not working. Any ideas on how to get this working ?When i run launchctl list | grep the namei get error 78The script working fine when ran from terminal.launchDaemon.plistKeepAlivetrueLabelname.plistRunAtLoadtrueProgramArgumentspathtoScript-notificationcom.apple.KerberosPlugin.ConnectionCompleted-actionpathtoScript/nameofscript.sh

Hello community,I've seen a tremendous number of posts related to this issue. During DEP enrollment using a PreStage Enrollment configuration, the local MacOS account hangs for a while then fails with the error "Computer account creation failed".A high number of posts refer to the potential fix as being related to any of the following, which I've diligently tried to no avail:Complete wipe and reinstall of MacOS, removing any potential leftover files, users or authorization keys that might lead to the issue.Ticking and unticking of the "Setup Assistant Options" in the PreStage Enrollment configuration, which allows administrators to skip configuration steps during first-time enrollment.Skipping the local account creation altogether, creating a standard account or creating an administrator account through the PreStage Enrollment "Account Settings" page.None of these worked. However, I've tried creating a new, empty PreStage Enrollment, and adding back my desired settings, configuration p

HiWe are testing using intune to deploy an app in Kiosk mode with devices DEP enrolled. Everything is working great but we are trying to plan for different scenarios. Anyone know what happens when there is a Wi-Fi failure, if you're in Kiosk mode you can't get out to reconfigure the Wi-Fi , if your Wi-Fi has failed the ipad can't pick up the new profile moving it out of Kiosk mode to configure it. As well anyone push an enterprise cert for Wi-Fi for devices.

We were using Pulse Secure (and its older version, Junos Pulse) VPN software in our environment but have since upgraded. In looking for a way to remove the old clients we ran across their uninstallers. Running those prompted the users to save the old settings and notified them when the uninstall was complete... We didn't want this! Found a way to make it silent! If you dig into the uninstaller app, you can see that it's just calling a simple shell script that allows for arguments for ignoring all prompts and not saving the old config. I'm posting those one liner scripts here for anyone else who might be looking to do the same! Pulse Secure: !/bin/sh sudo sh /Library/Application Support/Pulse Secure/Pulse/Uninstall.app/Contents/resources/uninstall.sh 0 Junos Pulse: !/bin/sh sudo /library/Application Support/Juniper Networks/Junos Pulse/uninstall.app/contents/resources/Uninstall.sh 0 Now just build the Jamf policy to call these scripts and update maintenance. Set it to re

Ever since we upgraded to macOS Sonoma, the following script is no longer working that is used as an Extension Attribute within Jamf Pro to report if TouchID is Enabled and Disabled:#!/bin/shTouchIDStatus=`bioutil -rs | grep functionality | awk '{print $4}'`if [[ "$TouchIDStatus" = "0" ]]; thenresult="TouchIDDisabled"elif [[ "$TouchIDStatus" = "1" ]]; thenresult="TouchIDEnabled"elseresult="Error"fiecho "<result>$result</result>"What I see for TouchID is Error.Any advice is very much appreciated!

Having trouble figuring out how to deploy cisco AMP via Jamf. I know there are a few threads out there but I cant even find the .XML file everyone keeps mentioning. Not sure if things changed since then but I need help.

Hey everyone,This week my company swapped MFA providers from DUO to Okta and after doing so my Mac users are seeing this message when trying to sign into Connect:We have double and triple checked each users account in Azure when they get this message and all of their accounts are unlocked and in good standing. I have also updated all of our Macs to the latest version of Connect (2.35.0).Has anyone encountered this with Connect after swapping to a new MFA provider?I appreciate any help!

Hello Jamf Nation! Advanced threat controls has been added to Jamf Protect. Advanced threat controls intervene when unsafe or malicious activity considered high-risk by Threat Labs is detected. Detected activity is blocked and reported to administrators for further investigation. For additional information, see Threat Prevention in the Jamf Learning Hub. Thank you,The Jamf Protect team

As per subject, save the below & you’ll get either the version of the BigFix Client installed.. Or you’ll get a message of Not Installed. This is Mac only for now, I’ll have an attempt at the VBScript when I can... Unless someone else wants to finish that bit :) #!/bin/sh#This script has been verified to work on BESAgent 7.2.6.4 #Check to see if BESAgent is installedif [ -d "/Library/BESAgent/BESAgent.app" ]; then result="$(defaults read /Library/BESAgent/BESAgent.app/Contents/Version CFBundleVersion)" echo "<result>$result</result>"else echo "<result>Not installed</result>"fi

Today we are releasing a maintenance version of Jamf Pro; this release includes the following changes and improvements:   Support Added for Deploying Apps Using the Jamf Certificate SDK You can now deploy apps that use the Jamf Certificate SDK to personally owned mobile devices, including iOS, iPadOS, and visionOS devices. Previously only institutionally owned iOS devices were supported.   Important Notice Cloud Service Connection Manual Initialization—Starting in August 2024, if you have Jamf Pro 11.3.0 or earlier, you must upgrade to Jamf Pro 11.4.0 or later to initialize a Cloud Services connection manually. After upgrading to Jamf Pro 11.4.0 or later, you can enable a Cloud Services connection in Jamf Pro. For more information, see Cloud Services Connection in the Jamf Pro Documentation. If you already have a Cloud Services connection enabled, you will not need to take any action.   Resolved Issues Jamf Pro Server [PI118234] Text in the Socket Filter Designated Req

Is there any way to prevent the removal of the MDM/management profile from a Mac, if the user is an admin? We usually lock the "Profiles" pref pane using a Config Profile, but I'm wondering if there's a way to keep the user from deleting the management profile if we unlock that pref pane? In my testing, I've not been able to stop an admin-level user from deleting whatever profiles they want.

Hello,Unfortunately, we are unable to upload P12 certificates for device identification when creating (network) profiles.While the .cert certificate uploads without problems, we get the error message "Invalid certificate" (without further details, unfortunately) when trying to upload the individual .p12 certificate:This is most intriguing, since we uploaded these exact same certificates without any problems about a month ago.Does anybody have an idea, what we might be doing wrong?Florian

I am getting an error -1 The cert for this server is invalid.  I am not sure what cert its talking about.  Im thinking I dont have the app configuration.  Has anybody used it and what did you do to get it running

Has anyone put together a policy/script to uninstall homebrew with Jamf?They have an uninstall script located here:https://github.com/homebrew/install#uninstall-homebrew But if I upload that to Jamf and run it with "--quiet --force" it throws an error shown below.  Seems like something from Jamf is adding a "/" argument to the script and it's causing it to fail.  Script exit code: 1 Script result: Warning: Unrecognized option: '/' Homebrew Uninstaller Usage: /Library/Application Support/JAMF/tmp/uninstallHomebrew.sh [options] -p, --path=PATH Sets Homebrew prefix. Defaults to /usr/local. --skip-cache-and-logs Skips removal of HOMEBREW_CACHE and HOMEBREW_LOGS. -f, --force Uninstall without prompting. -q, --quiet Suppress all output. -n, --dry-run Simulate uninstall but don't remove anything. -h, --help Display this message.

When my server is complete - I'll need to deploy the VMware Horizon client as an application. This doesn't have an installer with choices as AnyConnect does. It requires a server FQDN to be added in order to connect to the virtual desktop. If I remember - it'll need to be deployed as a pkg first, correct? Is there a way to populate the server address once the app is pushed to the system - or - on the first launch?

Hello,I am getting an error while setting up the SCEP profile in the JAMF.We have integrated the okta with the JAMF 

Dear Jamf Team, We are an IT service provider managing multiple Jamf Pro Cloud Instances for our clients. Over the past few weeks, we have encountered significant technical issues that have disrupted our services and negatively impacted our client relationships. Below is a detailed description of the problems we faced: Technical Issues Encountered: • Previously uploaded and functional packages suddenly became unavailable. Within the Jamf Pro Web Interface, these packages displayed a status of "Availability pending."• Client-Side Errors: "Error: Package was not successfully downloaded. 500", "Error: Package-2.1.1.pkg is not available on the HTTP server."• Server-Side Errors: Unable to get download URL from JCDS 2. Falling back to JCDS 1.x. org.springframework.web.client.HttpClientErrorException$NotFound: 404 Not Found: "Not Found" Possible Cause and Support Interaction: • We suspect these issues stem from an infrastructure change implemented by Jamf in mid-Decem

Hello everyone,We're trying to set up so we can auto join devices to our Wi-Fi. We've deployed the certificate and configured the payload for the Wi-Fi but we keep getting an error when trying to install the profile, saying - The Wi-Fi network "Wi-Fi name" could not be set up for EAP.Any ideas what could be wrong, what we missed or what we can do?

Hey all,A number of years ago I inherited a Jamf platform that I am trying to improve and clean up. We have a policy of naming computers of your choice. Currently, it consists of three scripts, one of which is an AppleScript to bring up a dialog box where you can enter the desired name of the computer.This solution has worked fairly well until about a year ago. Now you have to run the script twice for it to work, at least for Ventura and Sonoma.The script looks like below and I was wondering if someone could help me, give me some tips to make it work better so that you don't have to run it twice?Thanks in advance.First script (how it's listed in Jamf policy) #/bin/sh #Skript som sätter en raett hostname osv. - Made by Marten B. BK.IT #define variables name=$(sudo /usr/sbin/scutil --get ComputerName) sname=$(echo "$name" | tr -cd '[[:alnum:].-]') # set computernames sudo /usr/sbin/scutil --set HostName "$name" sudo /usr/sbin/scutil --set LocalHostName "$sname" sudo

Our fleet includes nearly (70) 2020 Intel MacBook Pro laptops running macOS Monterey 12.7.2, 12.7.3, and 12.7.4.Over the past month, nearly a dozen of them have suddenly died. Each time it starts with the computer restarting without warning, sometimes more than once, before it won't power back on at all.Each of these laptops have been brought across the street to Apple, where the majority of them have been able to be revived via Apple Configurator. None of them have had a reoccurrence of the issue after being revived so far.Apple Diagnostics show no issues with the laptops and Apple support in the store and via their Help Desk Support have not been able to provide any insight or suggestions other than to bring it to them when it happens or to replace them.Curious if anyone has seen any similar issues and has any ideas for preventing this. Wondering if there is any preemptive action we can take.Notes:We can't currently update these laptops beyond macOS Monterey because we use on-site SM