I had this extension attribute that will tell me if the mac had Office 2016 or 2019 installed, I need one now for office 2021, can anyone help me modify it? #!/bin/bashwordVersion=$(defaults read "/Applications/Microsoft Word.app/Contents/Info.plist" CFBundleShortVersionString)majorVersion=$(awk -F '.' '{print $1}' <<< "$wordVersion")minorVersion=$(awk -F '.' '{print $2}' <<< "$wordVersion")if [[ $majorVersion -ge "15" ]]; thenif [[ "$majorVersion" -ge "16" ]] && [[ "$minorVersion" -ge "17" ]]; thenecho "<result>2019</result>"elseecho "<result>2016</result>"fielseif [[ -d "/Applications/Microsoft Office 2011/" ]]; thenecho "<result>2011</result>"elseecho "<result>Not Installed</result>"fifiexit 0

This is for iPhone. I have enrolled some devices and i was wondering if its possible to password protect certain apps so the user has to input the passcode to open X app.  Thanks!

SSID discovery in macOS 15 Sequoia need not require excessive execution cycles Background One of the many under-the-hood changes in macOS 15 Sequoia of which Mac Admins should be aware is how to determine a Mac’s currently assigned Service Set Identifier (SSID), commonly known as the name of the user’s selected Wi-Fi network. Continue reading …

Hi All, I'm trying to automate the actual Computer to Site assignment via API as we keep on having Computers assigned to wrong Sites.. :) So far I have not had much success, does anyone maybe have an idea how to tackle this?

Hi wondering if anyone has any tips on installing Adobe Plug-ins that are serialized so the plug in will work for all users. 

Hello,Previously, I was able to execute policy in Self Service from a Custom Menu bar in Jamf Connect, but it hasn't worked in months. When executed with Self Service closed, I get "Self Service quit unexpectedly" "Click Reopen to open application again. Click Report to see more detailed information and send a report to Apple." The command works fine if Self Service is already open though, so it seems like it's an issue just launching Self Service from the menu bar.Here is the section of the custom menu bar I'm talking about, if someone sees something that no longer works, please let me know:<dict>     <key>Action</key>     <array>          <dict>               <key>Command</key>               <string>url</string>               <key>CommandOptions</key

Hi all,   We have recently switched our LDAP integration from AD to OKTA. How do I bulk update user and location from AD based outdated info over to OKTA based. Any assistance is appreciated.    The MUT app looks like it would require alot of manual work to setup excel and is labor intensive.  

so it seem that the build it option JAMF Pro does not woke and i see the same problem others have posted the white brick when i try a ad login, so i suck with Mac scripting also now to JAMF looking to do is when the system runs in enrollment or first boot and it see the MDM setting and start to run that.   last step would be join AD.what i am looking to have it do is1. Join AD2. set the OU3. set the AD commuter name the the SN then reboot if needed4. this maybe a second scrip ( when assign a use set the Mac name that show up in mac info to the Users name)

Designed as a possible last step before a MDM “Lock Computer” command, FSWL.bash *may aid in keeping a Mac computer online for investigation, while discouraging end-user tampering Background When a macOS computer is lost, stolen or involved in a security breach, the Mobile Device Management (MDM) Lock Computer command can be used as an “atomic” option to quickly bring some peace of mind to what are typically stressful situations, while the MDM Wipe Computer command can be used as the “nuclear” option. For occasions where first forensically securing a macOS computer are preferred, the following approach may aid in keeping a device online for investigation, while discouraging end-user tampering. Continue reading …

Hi All,I have a machine which is appearing in JAMF when searched for under the Inventory tab. However, it is not showing up in the Settings > Global > Automated Device enrolment menu, or in Computers > Enrollments > Prestage Enrollments. Can confirm that it exists in JAMF and is enrolled in the MDM in ASM.As it does not exist in 'Prestage enrollment' when booting it doesn't go through prestage enrollments.I can enrol the device using the online login https://ourjssdomain/enrol, however this is a specific use case where I need the machine to be enrolled through Prestage as the machine could be wiped whilst the user is on the go for security reasons.When running sudo profiles renew -type enrollment get the message: DEP enrollment failed: No device Enrollment configuration was found for this computer (MDMDeviceEnrollment:103)Which is obviously occurring because JAMF hasn't got it selected to run the device enrollment config, because it doesn't exist in there.Any idea on w

 Hi,I have managed to mostly create a configuration profile that will make our Sonoma Macs compliant with CIS Lvl. 2. But I have come across two problems:1. An Administrator Account Cannot Login to Another User's Active and Locked SessionIf I am not mistaken, this should be fixable in one of two ways:a) By executing/usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1which I have done, and the corresponding check, whether this has worked,/usr/bin/security authorizationdb read system.login.screensaver 2>&1 | /usr/bin/grep -c '<string>authenticate-session-owner</string>'produces a result of 1, which is correct. But still that policy is failing in Jamf Protect.b) By setting values in /Library/Preferences/com.apple.PowerManagement.plist which I have also done through a policy. But this actually sets the values in /Library/Managed Preferencesand has no effect.Can you point me in the right direction?2. When I set

Jamf Protect hast baselines for CIS Lvl.1 and Lvl.2.Is it possible to use a different baseline, e.g. v8?

I'm unable to login to Jamf Pro after following the setup procedures.  I'm integrating Jamf with Google Workspace and got locked out. Google Error 403.Error: app_not_configured_for_userService is not configured for this user. I am the admin on the account and GWP.

I have two profiles setting proxies up in the com.apple.SystemConfiguration domain.Both work if I double click on the profile and install via system settings, neither work if I install them via Self Service or pushing them from Jamf.Running 'scutil --proxy' shows an empty dictionary and trying various websites that should work all fail.I've tried a few different version of Sonoma and none work. I'm running "11.1.1-t1701704198" Jamf Pro on-prem.

Anyone else getting stuck in a boot loop after installing Rosetta? 2020 M1 MacBook installed 14.6.1, enrolled with JAMF, but after installing rosetta the computer gets stuck in a boot loop. DFU restore doesn't fix the issue. Happens with multiple laptops.

I have a computer where the MDM profile didn't renew last month, so it is expired. Haven't had the chance to look into why it didn't renew automatically, since I have many others that have. I did dig up some old notes from a SCEP issue I had previously and found the following command:'sudo profiles renew -type enrollment'It isn't perfect and I don't have another test with and expired profile. Running it on a test machine did require that I log in as the first "Setup User" that was logged in when the computer enrolled the first time via DEP during the assistant. After straightening that out it pretty much did what the man page suggests. A notification appeared, clicking it took me over into System Settings and a new MDM profile was installed with an expiration set to two years in the future. This does trigger an enrollement and reset some of the once-per-computer policies, so a little care was needed to descope/exclude some things that shouldn't run twice. Apart from that it seems like

Since Sequoia will be prompting users to review their screen recording settings monthly, I was wondering if it was possible to create a Smart Group that displays which apps in the Screen & System Audio Recording are either enabled or not enabled. Ideally, I'd be able to query by app name (Teams, Chrome, Zoom, etc).My goal is to regularly prompt users to turn this setting on for the app(s) it is not enabled for.Thanks,Michael

We are in the process of migrating a jamf instance from a company that we are splitting from into our very own jamf instance.I have a lot of configuration profiles so far that are all "uncategorized" and I have gone through a few of them one by one to move to our temporary categories but would love to know if there was a way to assign them in batches so I don't sit here for the next 20-30 minutes doing them one at a time if I don't have.If there isn't a way to do this then that is fine, I'll just click them each and do what I've been doing. Thanks!

Hey guys! So today we came across an interesting issue with a few iPads. It seems that if someone goes to Safari and clicks on a page to create a bookmark and then saves it to the home screen, you cannot go and remove the bookmark. These particular iPads do NOT have a home screen layout profile setup and while they do have Restrictions payload, we tried allowing permission to remove both user and System apps and neither options allowed removal. Anyone know if there is an option someone else I could be missing? I looked over every single checkbox in the Restrictions payload and the only others in effect are Passcode and Lock Screen so those should not be conflicting. Any help or advice would be much appreciated!Alex

We have an app that is set to automatically install on all our managed iPads (i.c. Google Docs). Some functionality is only available in the web version, but access to the web version is limited because the browser's default behaviour is to redirect you to the app.A workaround is: uninstall the app, until you need it again. But although I can uncheck the box 'prevent users from removing the app' and disable 'reinstall this app when it's removed by the user', I need a way to make it reinstallable via the Student/Teacher apps (in My resources).I tried to make a second group of iPads, containing the same set as the first one, so that every iPad has both the 'automatic installation' and the 'on demand installation'. But the app doesn't show up in the list. Is this workaround not possible, or am I overlooking something?

Hey guys,I've been working on a computer lab and I have some time to troubleshoot. I had to upgrade the lab from Ventura and 2022 Adobe apps to Sonoma and Adobe 2024 apps.Previously for the Adobe 2022 apps I would run them though Composer and I had no problem pushing them out and they would install successfully on my lab computers.However, this time round the installations fail about 90% of the time, a few would work but most of the time they would fail. I have Photoshop, Illustrator, Acrobat, etc and package them individually.I came across this: https://community.jamf.com/t5/jamf-pro/adobe-product-package-fails-to-install/m-p/301627I was going to try that when I also read to check the \\var\\log\\install.logI had it open when I was using Composer to create a new snap shot and I could see a bunch of failed messages. Mostly saying Install failed: The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. Then when the Insta

Hi, i am trying to script the final step in our onboarding process, where the user is presented with a list of Locations to chose, and once selected, the script will pull the serial number and rename the machine the location-serialnumberI'm 90% sure I have it right but i am getting echo errors when testing in CodeRunner... and i'd appreciate some extra eyes / advice....  #!/bin/bash #/usr/local/bin/dialog # Pull device serial number for lookup serialNumber=$(ioreg -c IOPlatformExpertDevice -d 2 | awk -F\\" '/IOPlatformSerialNumber/{print $(NF-1)}') nserialNumber=${serialNumber} #Specify variables for swiftDialog dialogInstalled="/usr/local/bin/dialog" downloadDialog="https://github.com/swiftDialog/swiftDialog/releases/download/v2.5.1/dialog-2.5.1-4775.pkg" pathToDownload="/usr/local/dialog" pathToPackage="/usr/local/dialog/dialog-2.5.1-4775.pkg" #Check if swiftDialog is installed if [ -e "$dialogInstalled" ];then   echo "Dialog Is installed" else   echo "Dialog is no

Hello everyone not really a reach out for help but more informational.Our company ticketing system has been getting a lot of reports once upgrading to 14.6 & 14.6.1 that their macs are slow to lock and their touchid no longer work or theres a huge delay. I myself upgraded and was affected.Reading through some apple forums someone identified that the issue was with a configuration profile that sets the local device password policy. It uses the com.apple.mobiledevice.passwordpolicy payload type.I went looking into our jamf instance and found a password policy configuration group and unscope my machine from it. I then locked my mac and both lock and touchid were back to instantly working. I rescoped the same policy back to my mac and boom delays again.This is where things get complicated for our environment, we have conditional access policies set by intune that our macs register to for access to certain apps. Those conditional access policies are tied to our jamf  password

Our Company utilizes JAMF Pro and JAMF Connect for MDM Management, Up until recently, we have always had local accounts created manually during prestage - then sign out and sign in with the users Azure Credentials - connect the local account and then merge the passwords so the local account and network account have the same credentials through JAMF Connect.We want to streamline this process and switch over to a Full Zero Touch Deployment - Currently we do have some minimal connection on the JAMF Pro side using LDAP Credentials/Directory services, so we can have admins login with their LDAP Creds and then techs can manually assign Location and User data by searching LDAP. We do not have an LDAP server connected and again, SSO is not setup yet. Part of that process I know we can setup SSO and use it in an enrollment customization then pass it through to Jamf connect during that process so the user can authenticate with their company account, it will generate the local acco

We have been using Jamf Setup with Entra SSO for a year now. Since the begining one of the first steps required is to log into Microsoft authenticator and register the device to the tenant using an account with cloud device administrator access. At JNUC I asked one of the sessions and they thought that requirement has been removed. I look at the documentation but I am not seeing any configuration changes but any device we setup still requires that step. Can anyone point to what I need to change to no longer require that registration step?