Not sure if I am the only one experiencing this or not. We are using code 42 and some users folder /Library/Application\\ Support/CrashPlan was deleted. The app cannot be removed because it is locked and the uninstall script cannot be run because the aforementioned folder has been deleted. We also cannot reinstall the backup agent as we get a "Install failed contact the software manufacturer" error message. Has anybody experienced this and found a fix? I tried using the uninstall script from another computer but it failed saying that the script is not originally from the computer. 

New and somewhat confused JAMF-user here, and thus: silly questions.I'm using Entra as my Cloud Identity provider and I'm trying to create a smart user group based on membership in an Entra-group (JAMF_KLA) in order to build configurations for said usergroups. But I cannot for the life of me get it to work (nor do I know if it's actually possible).Looked at the mapping of both the SUG and in the CIP-setup, and everything there looks like it should work. Can also do a test against various users, and it works (User that is in the Entra-group gets green checkmark, user that is not in group gets red checkmark). Which tells me that the lookup is working.I see that I can also add users from a Directory Service from the Settings-menu. However, is that only for admins/auditors? I see that there's an option for Enrollment Only. Does this mean that the imported users do *not* have access to the JAMF-console?

Fortinet's recent FortiOS 5.4.1 release for their FortiGate security appliances prevents any version of FortiClient prior to 5.4.1 from registering to the appliance. Users may even get a "FortiClient is being actively blocked from registration" which can cause panic and confusion. The problem is that, as of this writing, FortiClient 5.4.1 has yet to be released. Talk about putting the cart before the horse. So let's say that you don't want to have a few hundred upset users and would rather uninstall FortiClient discretely, en masse. Fortinet's documentation tells you to run the FortiClientUninstaller GUI app to uninstall FortiClient. But here's a more streamlined and scriptable method: /Applications/FortiClientUninstaller.app/Contents/Resources/uninstall_helperrm -rf /Library/Application Support/Fortinet/ Optionally, check for the existence of the following file and delete if it exists/private/var/root/Library/Preferences/com.fortinet.FortiClientAg

Jamf is thrilled to announce the brand-new Jamf 140 Course; a free, self-paced course that builds foundational skills to manage, secure and deploy Apple devices in K-12 environments.Check out the blog post about the 140!

A complete, step-by-step deployment guide - including macOS Onboarding and Jamf ConnectAuthor: Meir ElimelechWith contributions from: Omer Ninyo / ​@Ninyo Why this guide exists – and who should read it Jamf’s move to make Self Service+ mandatory for macOS has prompted many organizations to re-evaluate their deployment and enrollment workflows. While Jamf’s documentation covers the supported installation and migration paths, real-world environments often include a mix of enrollment models, identity integrations, and timing-sensitive workflows that are not always addressed in isolation.This guide exists to provide a single, practical reference for migrating to Self Service+ across all common macOS scenarios — from brand-new enrollments to existing fleets, with or without Jamf Connect.It is intended for Jamf administrators, partners, and consultants who want to understand not only how to deploy Self Service+, but when different approaches are appropriate. In particular, it highlights a cr

Hey, So, after lots of tests and struggling with new ways to migrate DMG file to PKG I found that none of them really works and the agent never starts and works properly... I found this script (don't remember where) and this solved my issue! ``` !/bin/sh Downloading OSX Update Package to /tmp on the host curl -o /tmp/update.tgz http://YOUR_SERVER_NAME_OR_IP/SC_packages/update.tgz; sleep 3 Extracting update.tgz to /tmp tar -zxvf /tmp/update.tgz -C /tmp; sleep 3 Installing SecureConnector as a Daemon/Dissolvable w/ visible/invisible menu bar icon sudo -S /tmp/Update/Update.sh -t daemon -v 1; sleep 3 Checking/Starting processes in case they did not start on install daemon_pid=ps auxww | grep -v grep | egrep "ForeScout SecureConnector.-daemon" | awk '{print $2}'agent_pid=ps auxww | grep -v grep | egrep "ForeScout SecureConnector.-agent" | awk '{print $2}'daemon_plist=/Library/LaunchDaemons/com.forescout.secureconnector.daemon.plistagent_plist=/Library/LaunchAgents/com.forescou

School admins want us to set a restriction for students to not be able to use their iPads past 10pm. I asked Jamf AI but we currently don’t use Jamf Parent, nor Jamf Teacher. It also gave the option of using Screen Time Downtime, but when creating that Config profile, I don’t have that option available to me. Has anyone had any experience in doing this?

Soooooo with the new “Apple Business”, check out the new API endpoints!!https://support.apple.com/guide/business/create-an-api-account-axm33189f66a/1/web/1I’m drooling at the user options for scoping purposes.  Been waiting forever for these to appear 😍  

Hello,Google is our IdP for logging in to Jamf Connect Login. I am using Self Service+ which states that the local password is “In Sync”. If I change a users password in Entra (which then will sync to Google Workspace), the “in Sync” does not go away or update ever. If I were to reset the password locally though Self Service+ using the menu bar drop down (opens Entra password change portal) it then states that the password is out of sync and that I need to login again to Self Service+. Great! I login, it accepts the new password, and states that the password is “in Sync”. I am never prompted for the old password.If I log out of the user and log back in with the new password, I am successful at the Google SSO pane, but it then has a smaller Jamf Connect pane that asks for valid credentials, which is the previously set password. The local password will not update despite “being in sync”.I have to be doing something fundamentally wrong, any help would be really appreciated. 

Hi Jamf Community, We're experiencing an interesting DNS registration issue with our Mac fleet that I'm hoping someone might have encountered before. Issue Description When our Mac devices connect to our corporate WiFi network, they register in DNS (Infoblox) with generic names like mac.domain or macbook.domain instead of their proper hostnames (e.g., mbp-dav.domain). However, when these same devices connect via Ethernet cable, they register correctly with their actual hostnames. Environment Details DNS/DHCP: Infoblox Mac devices: Various models running macOS All Mac devices have proper hostnames configured What I've Verified I've confirmed the hostname settings are correctly configured on the affected devices:   scutil --get HostName mbp-dav.domain scutil --get LocalHostName   mbp-dav.domain scutil --get ComputerName mbp-dav.domain System preferences show the hostname is correctly set in the Mac'

I have written a long time ago and still use an Automator workflow which runs an AppleScript which front-ends the built-in ZIP command line tool. Its main purpose is to provide a means to generate password protected ZIP files. The built-in 'service' does not give this option even though I suspect it also frontends the same built-in ZIP command line tool.This workflow for me still works fine even in macOS Sonoma.It used to be (back in the good old days 😁) that installing an Automator workflow was literally a simple matter of copying it to either -/Library/Services/ (to make it available to all users)or~/Library/Services/ (for an individual user)These days it is a lot more complicated.You still need to copy it to /Library/Services/ but you then apparently need to open it in Automator, re-save it in the same /Library/Services/ location which appears to cause Automator to register it in the list of available services - this of course requires using an Administrator authen

Hello Jamf Nation! Last month, we were excited to share the Get Started with Scripting series in the Jamf Online Training Catalog enjoyed a full refresh, covering topics from Terminal fundamentals to the Jamf API. Now, we’d love to hear what you think!Whether you’re just getting started or have already earned your Command Line Innovator badge, we’ve put together a quick, three-question survey for you to let us know how we can continue to serve you in your learning journey. Have questions? Let us know in the comments below.

Hey Jamf Nation,Jamf is offering 10 individuals from the tech sector a fully sponsored experience at the Jamf Nation User Conference (JNUC) - happening September 23–25, 2026 in Kansas City, Missouri!🎟️ Here's what the sponsorship includes:• Full conference registration• Exclusive meet-and-greet with Jamf leaders• Networking happy hour with fellow recipients• $500 stipend to cover expenses• Access to social events and networking opportunitiesThe application deadline is May 1, 2026 at 5:00 p.m. CST. All applicants will be notified of decisions by July 1, 2026. Note: past recipients are not eligible to reapply.Apply here: https://www.jamf.com/blog/jnuc-diversity-sponsorship/Don't miss this incredible opportunity to connect, learn, and be part of the most connected community in high tech!❓Got questions? The folks behind it will be joining an open office hour session to answer any questions you may have about applying! The zoom room will be open for drop in for 30 minutes.When: April 16 Ti

Hoping someone can help as this has been making me pull my hair out.Running Jamf Pro with AD CS Connector delivering machine certs via SCEP. Macs are domain joined. Two SSIDs, one through Meraki APs with two NPS servers in the RADIUS config, another through a Cisco Z3 pointing to a separate NPS server. Same cert template, same Jamf profile structure across everything.The Z3 SSID works perfectly, Macs connect no problem. The Meraki SSID fails on every Mac. Windows machines on the same Meraki SSID and same NPS policy work fine.The CA is definitely issuing the cert, visible in certsrv. The Mac is also prompting to select a cert manually when it shouldn't be. NPS logs are completely silent, no 6273 events at all when the machine cert is used. The only time 6273 shows up in logs is when I manually pick a randomly assigned JAMF cert that belongs to a machine not in AD, and that's just "user account does not exist" shows up in my logs.eapolclient on the Mac shows the full TLS handshake comple

Hi, I have created a profile to only allow system settings and Pages apps. It worked as expected, but I keep getting the prompts below. Is there any way for me to disable them? Thank you.   

Our desk side support manager is pushing for his team and the service desk to have full access to our console in terms of systems settings, creating/modifying groups, creating and modifying configuration profiles, creating and modifying policies ,etc. I am of the opinion that these are administrative functions which require some specialized knowledge and should be limited to administrators. Presently, they have access to view device information, assign policies, and push some MDM commands. I’m curious to know how your organizations manage access to the console. How many full administrators do you actually have in your consoles? What is your policy on tracking changes? What permissions do you give to your help desk and desk side support?

We’re moving away from Cisco Secure Client. But this utility is cool, and helpful. • A macOS utility to repackage Cisco Secure Client DMG files for unattended deployment via Jamf Pro (or any MDM solution).• huexley/CiscoRepackager• https://github.com/huexley/CiscoRepackager?utm_campaign=MacAdmins.news&utm_medium=email&utm_source=MacAdmins.news_385

Hello there!I’m using Jamf School synced with ASM with shared iPads. I wanted to start using Jamf Teacher app on teacher’s shared iPads, so I’ve just configured Jamf Teacher following Jamf’s guidelines. It started working fine with all classes and students showing up correctly. But since I needed to rename all classes. I renamed in ASM, synced Jamf School, and reassigned teachers to their renamed classes. But now I get this error on Teacher’s iPads “You are not allowed to add students to manages classes. Contact your IT administrator for support” (I’m IT support). Any idea how to resolve this?Thanks! 

Apple Classroom on Teacher Macs in Jamf School - Possible without Managed Apple IDs?We're migrating from Jamf Pro to Jamf School. Previously had Apple Classroom working with Macs and iPads via ASM roster syncing from our SIS—no Managed Apple IDs needed.Current status in Jamf School:✅ Apple Classroom works on teacher iPads and student iPads ✅ Jamf Teacher app works on teacher Macs (shows rostered classes) ❌ Apple Classroom on teacher Macs won't load rostered classesTeacher Macs aren't receiving the Education Profile despite fresh enrollments. I suspect it's related to MDM-capable users, but can't confirm. Class data is clearly flowing (iPads get it, Jamf Teacher gets it), so it seems like a device-specific enrollment issue.Is Apple Classroom on teacher Macs possible in Jamf School without Managed Apple IDs?The solution seems tantalizing close based a on a checkbox still available in Jamf School - just that it only applied to pretty dated OS versions. Other 2 year old post   

Hi everyone,We’re currently using Jamf School to manage our Apple devices and are running into issues with Microsoft’s enforcement of strong certificate mapping as outlined in KB5014754.Our environment relies on certificate-based authentication with Active Directory. While we’ve configured UPN mapping using the RFC 822 SAN field, our domain controllers (now in Full Enforcement mode) are rejecting certificates that don’t meet the new strong mapping requirements.Unfortunately, Jamf School doesn’t appear to support:Inclusion of SAN URIs with SID Custom certificate templates Scripting or automation for explicit mapping via altSecurityIdentitiesWe’ve temporarily enabled Compatibility Mode on our domain controllers, but this is only viable until 10 September 2025, when Microsoft will enforce Full Enforcement by default.Questions for the community and Jamf staff:Are there any confirmed plans for Jamf School to support strong certificate mapping before the enforcement deadline? Has anyone foun

Hello,    I’m just getting started with SUPERMAN and have only done test computers and some alpha users.  Right now I have mine very simple.  I have JAMF API setup to run this so that the users do not need to have admin privleges.I have a PPPC Config Profile to enable this.I’m using Static / Smart Groups to target devices for deploying the Configuration Profile, and the Policy.The Configuration profile is the main area when I am configuring the Script behavior.Default Defered Timer = 30 minutesMenu Defered timer = 1hr, 2hr, 4hr, or 8hrSoft Count Deadline = 3And using a custom branding Icon. How aggressive have you been with your users to get MacOS upgraded?  My experience so far is that users like to be on the latest OS and don’t mind the upgrde (even when it changes some of the appearance).Do you prefer Hard Count over Deadline Date?What messaging or communication do you like to do with the end users?  We have a whole communication protocol in place, but I haven’t gotten any direction

 In any technology job across industries there’s an evident gender gap. As a young professional, I was fortunate enough to find role models who shared their tips on claiming a seat at the table, which helped me overcome imposter syndrome. When I think about “men’s overrepresentation” in technology, I’m always reminded that community and networking is one of the most powerful tools to make your mark.I wrote this article to celebrate International Women's Day, but even better to bring up this topic in April. Celebrating women is never wrong to do beyond the month of March. I connected with leaders I admire in the Mac Admins space about the moments which defined their career, the advice that spurred them on to pursue their dreams, and the big wins defining their career so far. Kim Trojanowski, ​@ktrojano Systems Administrator II - School District of Waukesha & Admin - Women in Tech Apple AdminsJamf GroupThe “oh no” moment:It was my first day at a new job and I was shadowing my new co-

We’ve been using the jamf provided MakeMeAnAdmin shell script for temporary user account elevation without any issues for a while, but as of the last week or so it appears to have stopped working. jamf/MakeMeAnAdmin: Provides temporary admin access for a standard user via Jamf Self Service This has failed on two separate devices, one 26.2 and another on 26.4.  When reviewing logs, it mentions a group no longer being found.  I’ve looked around on Reddit and these forums and haven’t seen any other mentions of this issue recently, so figured it would not hurt to check in with the community. Typically we have been using the script via the Self Service app with no issues.  I know Self Service + is coming fast - could this be related?  Or is this just awkward timing on that front. We don’t use Jamf Connect, but putting a partial configuration for it and using the Self Service + app is successful in elevating the user temporarily to Admin permissions.  It is just the standard method of Self S

Hi Jamf Folks,I use nginx file distrubtion server. It works, but I have errors in the nginx log everytime I install something via Self Service +```2026/02/17 12:54:16 [error] 13387#0: *1 open() "/<pathToPkg>/Package.pkg/index.bom" failed (20: Not a directory), client: <ip-addresse>, server: webserver.de, request: "GET /<pathToPkg>/Package.pkg/index.bom HTTP/1.1", host: "webserver.de"```When I download it via webbrowser or wget, I do not get an error.here is my nginx.conf```worker_processes  1;events {    worker_connections  1024;}http {    include mime.types;    default_type application/octet-stream;    server {        listen 443 ssl;        http2 on;        server_name webserver.de;        ssl_certificate     fullchain.pem;        ssl_certificate_key privkey.pem;        location /Packages/ {            alias /<pathToPkg>/Packages/;            auth_basic "Downloads";            auth_basic_user_file /<pathto>/htpasswd;            types {                appl

Hi all,I’m looking for guidance on how to fully automate macOS updates across our company-managed Mac devices.We currently manage our Mac fleet using Jamf Pro version 11.24.1-t1769438062288. At present, macOS updates are being deployed manually through Self Service using packaged installers, but we would like to move to a more reliable and scalable automated process.So far, I have tried the following methods, but I have not been successful with either approach:Mass Action Command Managed Software UpdatesFor context, all company devices are:Enrolled via PreStage Enrollment Supervised Configured with Bootstrap Token allowed and escrowedIf anyone has successfully implemented a fully automated macOS update workflow in a similar Jamf environment, I would greatly appreciate your advice on the recommended process, prerequisites, or any known limitations.