HelloI am having an issue getting Nudge to prompt for an update.I have installed the configuration profile & the latest nudge suite via policy to a test mac.The only 2 values i have set are requiredMinimumOSVersion & requiredInstallationDateI've confirmed that nudge can see the profile by running /Applications/Utilities/Nudge.app/Contents/MacOS/Nudge -print-profile-config<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>osVersionRequirements</key><array><dict><key>requiredMinimumOSVersion</key><string>15</string></dict><dict><key>requiredInstallationDate</key><string>2024-09-25T00:00:00Z</string></dict></array></dict></plist>But, if i check library/preferences and look at the nudge plist via xcodeIt does not have the same values

I have a simple content filtering configuration profile we use for ipads that is failing now with "permission denied" Any thoughts?

I'm an instructional coach trying to support teachers with using JAMF teacher more in their classrooms. I was hoping I could create lessons and then share them with teachers to take some of the time off their plate. Is there a way to do this? I can't seem to find a way, but maybe I'm missing something!

I'm getting the following error when running my script "[student: command not found/Library/Application Support/JAMF/tmp/student profile". The script checks to see who is lpgged in, and if it is "student" it needs to change the user's profile pic". script below:"#!/bin/sh# determines current userconsoleUser=$( /usr/bin/stat -f%Su /dev/console )if [$consoleUser == "student"]; thendscl . create /Users/$consoleUser Picture "/Users/Shared/THS_Files/images/Howie.png"fiif [$consoleUser == "howardstudent"]; thendscl . create /Users/$consoleUser Picture "/Users/Shared/THS_Files/images/Howie.png"fi"

I'm trying to re-enroll a device that has not checked in for some time due to the MDM Profile expiring on the device.  we've tried to do a sudo jamf recon and get the following:Retrieving inventory preferences from  (jamfserver)... Finding extension attributes... Locating accounts... Locating applications... Locating hard drive information... Searching path: /System/Applications Locating software updates... Locating printers... Searching path: /Applications Locating hardware information (macOS 13.6.0)... Submitting data to (jamf server)... There was an error. Invalid Message - The message could not be parsed.Looking at the log we are seeing:[ERROR] [502:CPPrefPaneExt] [CE] Profile installation (MDM Profile (00000000-0000-0000-A000-4A414D460003:00000000-0000-0000-A000-4A414D460003)) ==> New profile does not meet criteria to replace existing profile. <CPFAccess:102>Jamf is telling us that we need to re-image the machine, but it's really not acceptable for this u

Hi all, so, pretty new to Jamf, but I work at a school where lots of random softwares are used frequently in specific labs. One software we're using is OpenToonz, an animation software, and a FFmpeg plug in, which I have to point to a file path for OpenToonz to find the folder for. Problem is, this preference file is stored in /Applications/OpenToonz/OpenToonz_stuff/profiles/layouts, and generates a folder called "settings.usernamehere" So, I can create the preferences file and move it to a specific path on scoped computers, but what I can't seem to figure out is how to create a file based off the name of the current logged in user, and place it in that specific file path. (i.e settings.currentLoggedInUser) I assume a script is the way to go, but my googling has failed me this time around, and I'm a little out of my depth. Either way, appreciate any help you can give!    

HiI've set up sso connections to connect each time the mac is restarted.In my case, users always connect by sso. But I want users to be able to switch macs easily between each other.Except that once user A lends his Mac to user B, even if I've forced all connections to go through sso. it will ask me for user A password because filevault needs to unlock the disk before proposing a connection by sso.Do you have any idea how I can work filefault and sso together so that user B can connect without requiring user A password?Thanks 

Small shop so there not much need to automate much but to Rename laptops we've been editing them in Jamf Pro and then running a Policy that connects script: !/bin/bash ComputerName="$4"scutil --set HostName $ComputerNamescutil --set LocalHostName $ComputerNamescutil --set ComputerName $ComputerName To an "App" made available via scoping in Self Service. It works but seems like I'm doubling my workload. I'd like to keep the Self Service app and initiate the naming from it using a script like: !/bin/bash newName=$( osascript -e 'text returned of (display dialog "Enter a new name for your Mac..." default answer "" with title "Name Your Computer" with icon file posix file "/System/Library/CoreServices/Finder.app/Contents/Resources/Finder.icns")' )scutil --set ComputerName "$newName"echo "Setting ComputerName to $newName"exit 0 This 2nd script works if I run it from Terminal on t

Hola, I have an iMac running MacOS Monterey 12.7.6 that I loaded onto Jamf, and I can't get the Jamf Connect Login window to pop up, leaving the default MacOS login screen for local users. The Jamf Connect Login window has no issues loading with any other devices. FileVault is not enabled.I saw this post and tried a couple different things from it but wasn't able to get far: https://community.jamf.com/t5/jamf-connect/jamf-connect-login-window-stopped-displaying-at-boot/m-p/292707I tried to run the command /usr/local/bin/authchanger -reset -jamfconnect but AuthChanger isn't being recognized as a command. I tried to go to /usr/local/bin/ & /usr/local/jamf/bin but neither of them had authchanger there. When I check the Profiles, It looks like Jamf connect Login successfully installed. I also tried making a new Configuration Profile to flip both the DenyLocal and LocalFallback, trying various different combinations, and that didn't help.  

Hi I hope you can help, for a long time we have been using a Teamviewer custom branded Host package installer pkg which gets set up after initial enrolment. It goes into a single Teamviewer group and then we change the grouping depending on location in Teamviewer its worked well for us over the years.. We have had a company rebrand and so we updated the first install pkg. Now when the new pkg runs and installs the easy access is activated as intended but the check/tick box is still editable by a standard user whereas before it was locked (greyed out) and only editable by admin. Has anyone been able to work out how to disable the option to untick by a standard user please..This is the current script #!/bin/bashsudo launchctl load /Library/LaunchDaemons/com.teamviewer.teamviewer_service.plistsleep8APITOKEN= Goes herewhile true; doprocess=$(ps aux | grep TeamViewerHost | grep -v grep | wc -l)        echo "Process: $process"if [ $process -gt 2 ]; thenecho "Ass

Has anyone ever had luck using a smart group to change a device state based on time of day?For example, create a smart group that has app restrictions and move devices in and out of that group based on a recurring schedule. 

How is upgrading License 

Today we are releasing a maintenance version of Jamf Pro; this release addresses the following product issue: Jamf Pro Server [PI120491] [PI120535] Setting the wallpaper on multiple mobile devices using the Automated Management Set Wallpaper command no longer results in errors during enrollment or blank inventory data in device records.   For additional information on what's included in this release, review the release notes via the Jamf Learning Hub. To access new versions of Jamf Pro, log into Jamf Account with your Jamf ID. The latest version is located in the Products section under Jamf Pro.   Cloud Upgrade Schedule Your Jamf Pro server, including any free sandbox environments, will be updated to Jamf Pro 11.9.2 based on your hosted data region below. Review this guide if you need assistance identifying the Hosted Data Region of your Jamf Cloud instance. If you would like to upgrade manually, navigate to https://account.jamf.com/products/jamf-pro and

Hi,if I do a PreStage Enrolment and select Setup Assistant Options to not be displayed during Setup Assistant. What Option will be selected? Yes or no or some preset from Apple?

A proof-of-concept, caveat emptor workflow for securely executing a repository-hosted script Background While EDR tools can excel at running one-off code on a limited number of endpoints, device management solutions are often best suited for executing predefined policies at scale. EDR Script Runner strives to strike a balance between the immediate, dynamic needs of threat hunting teams and the reliability of a MDM server, by securely executing a repository-hosted script, only when necessary. Continue reading …

Why do I have to set the tablesettings every new at school? Why can't the setting be taken over from the top location? Nice Regards Peter

The new Devices inventory screen isn't showing the correct number of devices with updates in the sidebar.A live example when looking at the Devices Inventory screen:If I click on 'Updates', the number changes to '99':The difference of '5' is the following:Those 5 things are for our Mac Mini that we use as an Apple Caching Server, it isn't DEP enrolled, it was manually enrolled into Jamf School, which is a little frustrating since it means there's a few things we can't manage properly on it, but it is what it is (We bought it from an Apple reseller that doesn't support DEP/ADE back in 2018).

Hello everyone,We're just about to migrate our Jamf from eDirectory to Active Directory. I'm gonna have a meeting with our partner how's gonna help us with the migration. He tells us they have a good solution for us but sugests that we shell skip access to network drive within the AD because there will be more problems then good with it. Best way for all users is to use OneDrive instead. But that't not really how our policy works within our organisation.You who have mapped network drives for you users/computer, how do feel it works and what products do you use to get the computers to be a part of the AD and to get access to everything?

We have a restriction profile set and we're modifying the defer software updates, so users don't see any notifications. It's not deploying all devices, when you go to the log, at a certain point, the devices start saying it was cancelled and it won't install.

how great would this feature be, vote up if you haven't already! https://www.jamf.com/jamf-nation/feature-requests/5938/add-the-ability-to-repush-configuration-profiles

Since Jamf Pro was upgraded to 11.9.1 we are getting Profile installation failed message when configuring brand new iPads and also existing devices after erasing them.Screenshot of the error attached belowNo change on our environmentAny help would be appreciated. Thank you

Hi everyone.We are starting prestaged enrollment process for our employees enabling the locked recovery mode.I noticed that if the user gets the password wrong 3 times (filevault login), the Mac offers to restart in recovery mode to reset it. If the user accepts, he will remain stuck in recovery even after restarting, therefore he will be forced to contact us to carry out the reset procedure or get the lock key and then reboot in FV login. I would like to reduce the risk of this happening, what do you suggest I do? Is there a possibility to increase attempts or disable this prompted suggestion by MacOS?On the first 10 enrollments, we already got 2 cases. Maybe we're just unlucky :)Thanks.

Hello,I have a configuration profile set to enable FileVault upon enrollment & escrow the personal recovery key. This is working great, but here & there we had some keys not get escrowed, even after the computer inventory updated several times. I recently enrolled four computers and all four did not get their key escrowed. I am not sure what's going on - has anyone else experienced this? Each computer's encryption status is as follows:FileVault 2 Partition Encryption State: EncryptedPersonal Recovery Key Validation: Unknown The only remedy is to use Jamf's reissue FileVault key script, but that's not an ideal solution for my organization.

I have been using a Python script that uses a Google Sheet to locate serial numbers and match them up with names. When trying to use this with the M1 Mac's, it seems that the script isn't working as it should. Upon investigation, the script I was using was only updating the computer name, but not the two hostnames. On the Intel Mac's, this didn't seem to be an issue, but with the M1 Mac's, renaming via the script has become unreliable. More often than not, I have to manually rename the computers and manually add them to AD. Anyone have a better script for this? Here is mine that I cobbled together from other threads on Jamf Nation. #!/usr/bin/python ''' Rename computer from remote CSV using Jamf binary Pass in the URL to your remote CSV file using script parameter 4 The remote CSV could live on a web server you control, OR be a Google Sheet specified in the following format: https://docs.google.com/spreadsheets/u/0/d/1H9gsdRtmzb0v9TY8r47j8p8uUs

What is the best practice to deploy Jamf connect via pre-stage?I tried to push it via prestage, it installed Jamf connect app but not any of the agents or bundle. There is no login window for Jamf connect. When I run the same package via policy, it fixes the issue.