Hii need help.We  want to monitor Time Machine. If Time Machine is disabled on Macs, Jamf Protect should trigger an alert and notify me. In the custom analytics, there is a sensor type called "File System Event" that can monitor which files are created, updated, or deleted. The question is, is it possible in Jamf Protect to match the content of files (plist) when creating custom analytics? For example, to search for a key "LastKnownEncryptionState" in /Library/Preferences/com.apple.TimeMachine.plist?We also want to monitor the firewall . If users disable them, we need to be notified. In Jamf Protect, we can create custom analytics and upload scripts. I have already implemented this for the firewall. When I use the terminal and execute the command 'socketfirewallfw', Jamf Protect is alerted and I receive a notification. However, Jamf Protect does not get alerted when I disable the firewall through the System Preferences on the desktop.please with examples :)Thanks

hello. Does anybody know how to modify the password requirements to remove this requirement "Not have two consecutive, or three sequential characters". I checked all over JAMF and i looked at apple's pwpolicy and there is nothing that shows that requirements. Our computers are not attached to AD. Thank you!

Hello,After going through efforts in attempt to get the AutoDesk Maya application packaged up, wanted to post here with regards to how I did it so that others can leverage it (its a culmination of multiple different techniques, and some digging deep to get the right scripting language). Maya includes Arnold Render and will be installed along with Maya. There are two passes that need to occur, as I had found that the licensing components don't always work the first time around.1) Mount the dmg acquired from AutoDesk and copy the 'Install Maya 2024.app' to /tmp/, and remove all the spacing to just 'InstallMaya2024.app'2) Leverage this script (test local first, then attach as post-installation script in WhiteBox Packages) #!/bin/sh #Application Info (For each AutoDesk app, change the app/year/pKey/package) app="Maya" year="2024" pKey="Product Key" #Location where the application file is going to sit (remove the spaces) pkgpath="/tmp/InstallMaya2024.app" #For Redundant Servers (3),

How is everyone capturing new print qeue now jamf has removed Jamf admin which had a nice feature to do it. This Jamf alternative https://github.com/jamf/jamf-printer-managerHowever it didnt seem to pickup the new print qeue I created.ThanksTom  

Hello, we are preparing for Jamf 11.6 upgrade and losing JAMF Admin.Our JAMF Pro is on-prem with local file distribution point - so the way we are going to manage packages is copying it directly to distribution point folder, then creating a matching record in JAMF Pro packages.Recently I was going through a list of our packages, and noticed some of them have pkg.zip format, not just pkg or dmg. Moreover, when I tried to re-upload new versions of those apps packages as pkg - JAMF Admin converted them to pkg.zip again, while the size of those packages wasn't big.Do you know, why is JAMF Admin doing that?  And what are the possible consequences if we upload just pkg, not pkg.zip for those apps to distribution point in future, when JAMF Admin is gone?Thank you!

We have 300 Macs. Most of our users are developers with standard accounts, but they have the SAP Privileges app installed which allows them to elevate their account to admin.We notice a lot of unapproved apps are installed. We need to stop this, so we are going to release the necessary apps to Self Service. We are planning to remove SAP Privileges from all users or limit SAP Privileges only to certain users.Couple questions about this:1. Once we have released the necessary apps to Self Service, is there any way to prevent users with SAP Privileges from installing other apps from other places (App Store, DMG and PKF files)? Dont want to use JAMF restricted software. Might be using Santa.2. We know that adding printers require admin rights. What else should be configured in JAMF in advance to allow users to continue working normally and to minimize the number of contacts to the Service Desk? Which user tasks really require admin rights?3. Are you still allowing adminstrator accounts? Why

Hi Everyone, I am new to Jamf Pro and i need a bash script to upgrade brew in our environment. Command i want to run - "brew upgrade xz". Could someone please help me with the shell script on priority? Thanks

how to do custom subdomain for jamfcloud to point my own domain

Microsoft has released Company Portal 5.2401.2 with support for Platform SSO.Users with SSO profiles receive a pop-up requesting registration with Azure Account to synchronize the local Mac password.Has anyone had this experience?

Been playing with this today I have everything working fine except for the DefaultSearchengine. it won't switch to Ecosia (don't ask)I created 2 versions one witha forced extension for the ecosia plugin. But this locks the user from being able to change setting..without extension<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>DefaultSearchProviderEnabled</key><true/><key>DefaultSearchProviderName</key><string>Ecosia</string><key>DefaultSearchProviderSearchURL</key><string>https://www.ecosia.org/search?tt=</string><key>HomepageIsNewTabPage</key><false/><key>HomepageLocation</key><string>**********</string><key>NewTabPageLocation</key><string>https://www.ecosia.org/?c=en</string><key>RestoreOnStartup</ke

I recently had a user complain to one of our technicians that the low power mode setting requires admin credentials to modify. A vast majority of the macs in our fleet are laptops, and I don't mind letting users change this setting on the fly. Looking into it online, most folks have said to allow system.preferences.energysaver, but it doesn't look like that is actually linked to the low power mode option at all. Is there another key I can use to modify the behavior of low power mode in the battery pane? Thanks.

Dear Team,I use the profile to enforce password policy for MAC OS computer.But sometimes, the user reported that the password is not meet requirement even though the password typing does meeting the requirement.Can I know  anyone has meet this issue yet?     

Hi! New to Jamf and discovering all the APIs! I wanted to find out if there is an API command to Unenroll an iOS device from Jamf? I can see that we have a Deletes a mobile device enrollment profile by ID API, does this have the same result of removing the enrolled profile and all the configs from the managed iOS device in Jamf.  

Hello everyone,I hope to find some help here with our issue. We are using the Kerberos SSO Extension to synchronize the passwords of Mac users with their Active Directory (AD) passwords.During initial setup, the user logs in with their AD account, followed by a password synchronization window. Here, they enter both their AD password and the Mac password to synchronize them.This process works initially.However, we have a department at one location experiencing an issue where the password synchronization window pops up as many as 50 times a day. It doesn’t matter whether a password is entered or if someone just clicks "cancel".We have reinstalled all the Macs at this location. Everything was fine for about a month, and then the problem gradually started again.I went to the location with my MacBook and did not experience the problem there. The colleagues also have this issue at home over VPN.All are using macOS 14.4.1. However, the problem was also present in previous versions, including

Hello everyone, I've been searching high and low for a way to be able to update the username in a VPN profile based on the user who is logged in. We are currently using a configuration profile which works only when only 1 person uses a Macbook but as soon as a 2nd user logs in, the username of the 1st user remains in the VPN settings when the 2nd user tries to connect. Has anyone managed to find a way around this?

Hello everyone, I would like to know if it is possible to deploy pkg from a url. The reason I'm asking is because the linked url contains a version of the pkg that automatically logs in our agent. If I simply download the pkg of the agent and store it on a cloud or other distribution point, it simply installs a generic agent which then needs to be logged into. You can understand how it’d be problematic to log into every computer individually after the agent has been installed. Atera has a terminal command that allows one to download an instance of their agent with a url. This instance automatically logs in the user into the linked Atera environment upon completion of the install through terminal. Does anyone know of a way to use Jamf Pro to ease that process so the agent of the url can be deployed on computers rather than the generic one from the pkg file? Thank you.

Hi all  i tried all to deploy the 1 password Google Chrome extension but it is not working did anybody do that and able help for me 

What are we talking about? Handling json in the macOS shell of your choosing. Why? Because there still isn't a great way to do this natively, it's extremely useful given how many macOS binaries & logs output json-ish data, and, there are ways of working around this limitation. Arg-nauts is an unforgivable pun, however, there are some real explorers in this area. I rounded some of them up here: https://community.jamf.com/t5/jamf-nation/firefoxy/td-p/266970 I will try to be a bit more exhaustive this time... • From the crafty Joel Brunner (you may know him as @brunerd...) jpt: https://www.brunerd.com/blog/2022/02/01/jpt-1-0-can-deal-with-multiple-json-texts/ljt: https://www.brunerd.com/blog/2022/02/22/ljt-1-0-0-a-little-json-tool-for-your-shell-script/ I have used ljt in production. It's lightweight & works a treat. Once you're on Joel's blog, check out ALL of his json related posts! • The post below inspired much ado in the Mac Admins Slack channels rega

With recent IOS updates, the "Bringing Devices Together" settings reverts to default despite users toggling it off. This is problematic because some users carry both a work phone and a personal phone while on duty. The person may toggle off this setting in the Airdrop settings menu, only to have it toggle back on with IOS updates. We would like the option to keep Airdrop on but toggle off this setting in a persistent way or turn off device proximity notifications, because it's annoying to the users. Any thoughts on how to do this?

This might show up twice due to login weirdnesses, if it does I apologize...I'm creating a new prestage enrollment, and I have around 10 devices I want to assign.  I have individually found the serial numbers one at a time which is tedious but doable and checked the assign box, but in the interest of verifying that the correct machines (and only the correct machines) are assigned, I want to see only the assigned machines, not the several hundred "Not Assigned" ones.  the "Filter Results" box will let me filter for "Assigned" but that still shows me all the "Not Assigned" ones as well - I cannot figure out or find online the correct syntax to exclude the "Not Assigned".

I'm using JamfPro MDM in cloud to manage computers on a campus. I wanted to allow users (employees) to be able to change their local user password (99% are standard, non-admin users) via the mac computer's Users & Groups settings user "Change Password" button while at the SAME TIME NOT ALLOWING them to change the "Allow this user to administer this computer" toggle listed on the same popup window. I tested by creating an duplicate config profile for security & privacy settings with the only change being to allow password change. This policy was applied to a test machine and unfortunately it gives users the ability to decide if the user can administer the computer which defeats the purpose. I don't understand why this one change password setting in the security & privacy config profile section does more than give password change permission. Any thoughts or suggestions with this?A while ago, I resorted to a self-service app script, that the user would trigger, that would requ

Is anyone else's Tomcat settings in Jamf Pro Server Tools broken after upgrading to 11.3 on On-Prem Windows Server?Webserver is running just fine but Jamf Pro Server Tools show it as "not running" and throwing an error when trying to start it.Can control Tomcat through net start/stop tomcat9 or the tomcat9w.exe without any issue.As per warning:As a result of PI116512, new installations and upgrades using the installers will fail if Java 21 is installed. Mitigation: Uninstall Java 21 and reinstall Java 11, or manually install Jamf Pro.we stayed on Java 11.Just curious if this is something with our install or a general update issue?Thanks!

I have an asset that was auto-enroll via JAMF connect. However, the asset did not do the filevault encryption eventho the policy is there. I opened up a ticket with the to resolve the problem ont he new devices. However, I still have a few devices lingering with filevault not enable.I just tried to manually enable one of these assets and then cycle the key. However, it is not letting me.when I tried with my account. it doesnt take my password or the admin password. if I do it under, a users account it asks for the admin password and the same thing it doenst look like it takes.This is on a M2 with Ventura (13.6.5)I know this has to do with the security token not being enable for the account. Not sure how to fix this. any help greatly appreciated. 

Hi all, we're having a difficult time uninstalling Sophos Endpoint Protection from our Mac endpoints with Jamf. This particular enterprise version of Sophos employs Tamper Protection, which was easy enough for us to disable by creating a policy that deletes the SophosSecure.keychain file that Tamper Protection creates on all the endpoints, but even with Tamper Protection disabled we can't figure out how to remotely uninstall the client itself. So far, we've tried the following approaches, both of these scoped to a test machine with Sophos Endpoint Protection installed and with Tamper Protection disabled: Packaged the Sophos uninstaller (Remove Sophos Endpoint.app) with Composer and added it to a Policy with the Packages payload (specifically, we installed Sophos on the test machine, started Composer and took a before snapshot, uninstalled Sophos, then took an after snapshot, saved and uploaded the resulting .pkg to Jamf) Created a Policy with the Files & Processes

After weeks of working and looking for a solution with Sonoma NOT showing the WiFi through the control center to all my wired lab users, I felt you might stumble across this and need specifics to a solution. I disable the WiFi on my machines.  I do so by running:     sudo networksetup -setnetworkserviceenabled Wi-Fi offThis will cause the WiFi icon to show an explanation point.  This is a nasty thing for users, making them think that they don't have internet when they do.  So to eliminate this, I created a Configuration Profile that I push out to these computers.Here it is: Then under Application & Custom Settings, I choose Upload and created the following: The scope will be those computers running Sonoma. I hope you find this useful.Jack LawtonIT Manager/Lab Manager (5 labs - 100+ machines)School of Journalism and New MediaUniversity of Mississippi