Hi all,   We have recently switched our LDAP integration from AD to OKTA. How do I bulk update user and location from AD based outdated info over to OKTA based. Any assistance is appreciated.    The MUT app looks like it would require alot of manual work to setup excel and is labor intensive.  

so it seem that the build it option JAMF Pro does not woke and i see the same problem others have posted the white brick when i try a ad login, so i suck with Mac scripting also now to JAMF looking to do is when the system runs in enrollment or first boot and it see the MDM setting and start to run that.   last step would be join AD.what i am looking to have it do is1. Join AD2. set the OU3. set the AD commuter name the the SN then reboot if needed4. this maybe a second scrip ( when assign a use set the Mac name that show up in mac info to the Users name)

Designed as a possible last step before a MDM “Lock Computer” command, FSWL.bash *may aid in keeping a Mac computer online for investigation, while discouraging end-user tampering Background When a macOS computer is lost, stolen or involved in a security breach, the Mobile Device Management (MDM) Lock Computer command can be used as an “atomic” option to quickly bring some peace of mind to what are typically stressful situations, while the MDM Wipe Computer command can be used as the “nuclear” option. For occasions where first forensically securing a macOS computer are preferred, the following approach may aid in keeping a device online for investigation, while discouraging end-user tampering. Continue reading …

Hi All,I have a machine which is appearing in JAMF when searched for under the Inventory tab. However, it is not showing up in the Settings > Global > Automated Device enrolment menu, or in Computers > Enrollments > Prestage Enrollments. Can confirm that it exists in JAMF and is enrolled in the MDM in ASM.As it does not exist in 'Prestage enrollment' when booting it doesn't go through prestage enrollments.I can enrol the device using the online login https://ourjssdomain/enrol, however this is a specific use case where I need the machine to be enrolled through Prestage as the machine could be wiped whilst the user is on the go for security reasons.When running sudo profiles renew -type enrollment get the message: DEP enrollment failed: No device Enrollment configuration was found for this computer (MDMDeviceEnrollment:103)Which is obviously occurring because JAMF hasn't got it selected to run the device enrollment config, because it doesn't exist in there.Any idea on w

 Hi,I have managed to mostly create a configuration profile that will make our Sonoma Macs compliant with CIS Lvl. 2. But I have come across two problems:1. An Administrator Account Cannot Login to Another User's Active and Locked SessionIf I am not mistaken, this should be fixable in one of two ways:a) By executing/usr/bin/sudo /usr/bin/defaults write /Library/Preferences/com.apple.loginwindow screenUnlockMode -int 1which I have done, and the corresponding check, whether this has worked,/usr/bin/security authorizationdb read system.login.screensaver 2>&1 | /usr/bin/grep -c '<string>authenticate-session-owner</string>'produces a result of 1, which is correct. But still that policy is failing in Jamf Protect.b) By setting values in /Library/Preferences/com.apple.PowerManagement.plist which I have also done through a policy. But this actually sets the values in /Library/Managed Preferencesand has no effect.Can you point me in the right direction?2. When I set

Jamf Protect hast baselines for CIS Lvl.1 and Lvl.2.Is it possible to use a different baseline, e.g. v8?

I'm unable to login to Jamf Pro after following the setup procedures.  I'm integrating Jamf with Google Workspace and got locked out. Google Error 403.Error: app_not_configured_for_userService is not configured for this user. I am the admin on the account and GWP.

I have two profiles setting proxies up in the com.apple.SystemConfiguration domain.Both work if I double click on the profile and install via system settings, neither work if I install them via Self Service or pushing them from Jamf.Running 'scutil --proxy' shows an empty dictionary and trying various websites that should work all fail.I've tried a few different version of Sonoma and none work. I'm running "11.1.1-t1701704198" Jamf Pro on-prem.

Anyone else getting stuck in a boot loop after installing Rosetta? 2020 M1 MacBook installed 14.6.1, enrolled with JAMF, but after installing rosetta the computer gets stuck in a boot loop. DFU restore doesn't fix the issue. Happens with multiple laptops.

I have a computer where the MDM profile didn't renew last month, so it is expired. Haven't had the chance to look into why it didn't renew automatically, since I have many others that have. I did dig up some old notes from a SCEP issue I had previously and found the following command:'sudo profiles renew -type enrollment'It isn't perfect and I don't have another test with and expired profile. Running it on a test machine did require that I log in as the first "Setup User" that was logged in when the computer enrolled the first time via DEP during the assistant. After straightening that out it pretty much did what the man page suggests. A notification appeared, clicking it took me over into System Settings and a new MDM profile was installed with an expiration set to two years in the future. This does trigger an enrollement and reset some of the once-per-computer policies, so a little care was needed to descope/exclude some things that shouldn't run twice. Apart from that it seems like

Since Sequoia will be prompting users to review their screen recording settings monthly, I was wondering if it was possible to create a Smart Group that displays which apps in the Screen & System Audio Recording are either enabled or not enabled. Ideally, I'd be able to query by app name (Teams, Chrome, Zoom, etc).My goal is to regularly prompt users to turn this setting on for the app(s) it is not enabled for.Thanks,Michael

We are in the process of migrating a jamf instance from a company that we are splitting from into our very own jamf instance.I have a lot of configuration profiles so far that are all "uncategorized" and I have gone through a few of them one by one to move to our temporary categories but would love to know if there was a way to assign them in batches so I don't sit here for the next 20-30 minutes doing them one at a time if I don't have.If there isn't a way to do this then that is fine, I'll just click them each and do what I've been doing. Thanks!

Hey guys! So today we came across an interesting issue with a few iPads. It seems that if someone goes to Safari and clicks on a page to create a bookmark and then saves it to the home screen, you cannot go and remove the bookmark. These particular iPads do NOT have a home screen layout profile setup and while they do have Restrictions payload, we tried allowing permission to remove both user and System apps and neither options allowed removal. Anyone know if there is an option someone else I could be missing? I looked over every single checkbox in the Restrictions payload and the only others in effect are Passcode and Lock Screen so those should not be conflicting. Any help or advice would be much appreciated!Alex

We have an app that is set to automatically install on all our managed iPads (i.c. Google Docs). Some functionality is only available in the web version, but access to the web version is limited because the browser's default behaviour is to redirect you to the app.A workaround is: uninstall the app, until you need it again. But although I can uncheck the box 'prevent users from removing the app' and disable 'reinstall this app when it's removed by the user', I need a way to make it reinstallable via the Student/Teacher apps (in My resources).I tried to make a second group of iPads, containing the same set as the first one, so that every iPad has both the 'automatic installation' and the 'on demand installation'. But the app doesn't show up in the list. Is this workaround not possible, or am I overlooking something?

Hey guys,I've been working on a computer lab and I have some time to troubleshoot. I had to upgrade the lab from Ventura and 2022 Adobe apps to Sonoma and Adobe 2024 apps.Previously for the Adobe 2022 apps I would run them though Composer and I had no problem pushing them out and they would install successfully on my lab computers.However, this time round the installations fail about 90% of the time, a few would work but most of the time they would fail. I have Photoshop, Illustrator, Acrobat, etc and package them individually.I came across this: https://community.jamf.com/t5/jamf-pro/adobe-product-package-fails-to-install/m-p/301627I was going to try that when I also read to check the \\var\\log\\install.logI had it open when I was using Composer to create a new snap shot and I could see a bunch of failed messages. Mostly saying Install failed: The Installer encountered an error that caused the installation to fail. Contact the software manufacturer for assistance. Then when the Insta

Hi, i am trying to script the final step in our onboarding process, where the user is presented with a list of Locations to chose, and once selected, the script will pull the serial number and rename the machine the location-serialnumberI'm 90% sure I have it right but i am getting echo errors when testing in CodeRunner... and i'd appreciate some extra eyes / advice....  #!/bin/bash #/usr/local/bin/dialog # Pull device serial number for lookup serialNumber=$(ioreg -c IOPlatformExpertDevice -d 2 | awk -F\\" '/IOPlatformSerialNumber/{print $(NF-1)}') nserialNumber=${serialNumber} #Specify variables for swiftDialog dialogInstalled="/usr/local/bin/dialog" downloadDialog="https://github.com/swiftDialog/swiftDialog/releases/download/v2.5.1/dialog-2.5.1-4775.pkg" pathToDownload="/usr/local/dialog" pathToPackage="/usr/local/dialog/dialog-2.5.1-4775.pkg" #Check if swiftDialog is installed if [ -e "$dialogInstalled" ];then   echo "Dialog Is installed" else   echo "Dialog is no

Hello everyone not really a reach out for help but more informational.Our company ticketing system has been getting a lot of reports once upgrading to 14.6 & 14.6.1 that their macs are slow to lock and their touchid no longer work or theres a huge delay. I myself upgraded and was affected.Reading through some apple forums someone identified that the issue was with a configuration profile that sets the local device password policy. It uses the com.apple.mobiledevice.passwordpolicy payload type.I went looking into our jamf instance and found a password policy configuration group and unscope my machine from it. I then locked my mac and both lock and touchid were back to instantly working. I rescoped the same policy back to my mac and boom delays again.This is where things get complicated for our environment, we have conditional access policies set by intune that our macs register to for access to certain apps. Those conditional access policies are tied to our jamf  password

Our Company utilizes JAMF Pro and JAMF Connect for MDM Management, Up until recently, we have always had local accounts created manually during prestage - then sign out and sign in with the users Azure Credentials - connect the local account and then merge the passwords so the local account and network account have the same credentials through JAMF Connect.We want to streamline this process and switch over to a Full Zero Touch Deployment - Currently we do have some minimal connection on the JAMF Pro side using LDAP Credentials/Directory services, so we can have admins login with their LDAP Creds and then techs can manually assign Location and User data by searching LDAP. We do not have an LDAP server connected and again, SSO is not setup yet. Part of that process I know we can setup SSO and use it in an enrollment customization then pass it through to Jamf connect during that process so the user can authenticate with their company account, it will generate the local acco

We have been using Jamf Setup with Entra SSO for a year now. Since the begining one of the first steps required is to log into Microsoft authenticator and register the device to the tenant using an account with cloud device administrator access. At JNUC I asked one of the sessions and they thought that requirement has been removed. I look at the documentation but I am not seeing any configuration changes but any device we setup still requires that step. Can anyone point to what I need to change to no longer require that registration step?

Hi guys,New to the Mac OS world, was an AD Engineer for 10+ years working in powershell.How are you guys going about deploying your vpn configuration files when installing your vpn?My org is using Aviatrix, I want to create a script to deploy the custom configuration file and name the profile after it's creation.

I'm wondering if I can default Jamf Connect Login to show the local logins first instead of the network sign-in.Our network (call it NET-RAD) currently uses RADIUS, which we knew, so we'd planned to use our WPA2 network (call it NET-DEV) for Connect Login.A logged in user needs to be on NET-RAD, and even though the password for NET-DEV is saved on the device, Connect Login always asks for the password to NET-DEV.Since we don't share the NET-DEV password with users (it's pushed out via config profile) they end up with no network access on Connect Login and unable to fix it themselves without some sort of hotspot.I understand this is expected due to how Connect Login handles network credentials, but I'm wondering if there's a way I can default Connect Login to the local login page, as opposed to the network login page, at least until we can get Clearpass in place and figure out a better way to do our network for Connect Login. That, or if someone has better ideas.

Hello Everyone,We’re expanding our student loaner program to include Mac laptops. Each semester, students will check out these laptops for their coursework, and at the end of the term, the devices are returned to be reset and reissued.Here are the key issues we’re facing:Active Directory Binding: All devices must be bound to AD, and there’s no workaround at the moment. We’re looking into Jamf Connect or an alternative, but those options won’t be ready in the near future.Data Removal: We need a reliable way to remove user data at the end of each loan period.External Resetting: The entity handling the checkout process (not internal IT) will need to complete the reset. This means the "Wipe" command isn't viable since we can't ensure consistent internet access or the ability to follow a complex process.We currently have a Self Service item that successfully removes user profiles. It works great for us. However, the biggest challenge is managing applications. We need to find a way to remove

Hi guys,I recently used this video: https://www.youtube.com/watch?v=UtdPLbpREtM to erase a computer lab of MBAs to go from Catalina to Monterey. It worked great.Now I have two more computer labs that I need to do from Monterey to Sonoma. These MBAs are M1s, the others were Intels.I got the first part to work where it downloads Sonoma, but I can't get it to install. I have it set to install through Self Service but no dice. To see the errors I ran it through Terminal. I get the error: Could not find the provided own on this systemI've edited the Execute Command in the Files and Processes from when I used it for the first lab. (see screenshot below). But it doesn't want to work for me.Any help is appreciated. Thanks!

Hi jamf-types, I have been out of the jam loop for a few years, as the company I'm was in used a different product .Now I am looking to pitch jams at a new company... but I don't have access to all the data I used to have. Can anyone point me to a complete list of all the API calls that can be used in jamf? 

Hello Jamf Nation! To ensure on-time release of Jamf Pro 11.9.0, which will support Apple’s operating system releases this fall, we’ve made the decision to move the Jamf Pro 11.8.0 release content to Jamf Pro 11.9.0. This means there will be no Jamf Pro 11.8.0 release and you can expect these improvements and fixes to be included in Jamf Pro 11.9.0. The Jamf Pro 11.9.0 Beta Release features the exciting improvements and enhancements for managing your Apple devices found in 11.8.0 and a few new ones. Starting with 11.9.0, Jamf Pro admins will be able to set a minimum OS for MacBooks, iPhones, and iPads through prestage enrollment. Apple Vision Pros can now be enrolled in Jamf Pro through Automated Device Enrollment. New Configuration Profile keys are introduced for MAC address randomization on macOS, Lockdown Mode, and more. How to join the beta: Enroll in the Beta Program under Product Feedback at account.jamf.com. Once you enroll you'll receive an invitation to join the Beta Foru